15 ms·

Seems like they should add another 0 to the fine after the recent hat trick: 1) Prompting users to give Facebook their email passwords.[0] 2) Using that email

Seems like they should add another 0 to the fine after the recent hat trick: 1) Prompting users to give Facebook their email passwords.[0] 2) Using that email access to "inadvertently" upload the information of their email contacts.[1] 3) Storing said passwords and others in plaintext. [2] It's pretty impressive that a company could do something so brazenly malevolent and be confident that they will escape with no more than a fine. [0] https://www.thedailybeast.com/beyond-sketchy-facebook-demanding-some-new-users-email-passwords https://www.thedailybeast.com/beyond-sketchy-facebook-demand... [1] https://www.theguardian.com/technology/2019/apr/18/facebook-uploaded-email-contacts-of-15m-users-without-consent https://www.theguardian.com/technology/2019/apr/18/facebook-... [2] https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...

wnevets 8y ago
> 3) Storing said passwords and others in plaintext. [2] in logs.
- munk-a 8y ago
  If you're a small business - I get it, it's good to whitelist whatever information you're logging explicitly, but for smaller teams a hard to diagnose issue might lead the team to "log everything so we can sort it out later". Facebook is Facebook, whether this decision was the product of the corporation as a whole, a small dev team, or a highly paid consultant/third party, Facebook is a big enough company that they don't have the "I didn't realize..." excuse anymore.
  - fuzz4lyfe 8y ago
    Seems like a pretty trivial automated test for so many PHD's to miss: create_user('Bob', 'BobPassword123') assert "BobPassword123" not in logfile
    - munk-a 8y ago
      Hrm, so you checked the apache access logs, or maybe an error log, what about the system logs? Does the login request spin up a bash script and pass the password to it? I don't think it's trivial to guarantee non-existence.
      - jlarocco 8y ago
        > I don't think it's trivial to guarantee non-existence. I disagree in this case. Log messages don't spontaneously appear in arbitrary places. If the developers understand what their software is doing and how their systems are configured then they should know where to check for the logging messages.
        noselasd 8y ago
        Until someone turned on logging of the full request body on the load balancer/proxy or otherwise unknown-to-you middlebox that was the TLS termination point in production that you did not know about
        fuzz4lyfe 8y ago
        So their incompetence lies in lacking configuration management in production as opposed to a lack of testing? Why are they manually configuring production servers anyway at that scale?
        munk-a 8y ago
        They are managing a lot of things, they have full responsibility to be aware of these things as a company but I'd guess that with the scale of ops Facebook has regular developers never interact with the team that's managing their attempt at high availability by scattering servers across different hosts, data centers, legal jurisdictions etc. in fact I'd imagine at a op the size of Facebook that sort of problem has a dedicated department. That said, someone should have been watching for this stuff and failed to do so (or to exist), so I'm not excusing them - but this is not a trivial thing to protect against.
  - beat 8y ago
    I've worked for multiple Fortune 25 companies, and that excuse does not fly. Not in banking or healthcare, where breaches of privacy/confidentiality are actually illegal, rather than merely distasteful. Small teams and careless devs doing that sort of bad logging will be caught and corrected by strict security oversight. This is the sort of thing that leads the HN crowd to sneer at the old, slow ways of the enterprise world.
    - deleted 8y ago
      [deleted]
    - gjs278 8y ago
      hey just so you know your https ssl certificate is broken for congruence.io so much for how careful you are with computers. it’s telling you worked for multiple fortune 25’s.
    - Aunche 8y ago
      The passwords in plaintext wasn't a breach or a leak. If you punish Facebook for it, they would be less inclined to share such information in the future.
      - tkxxx7 8y ago
        That's how you handle children, though. No one is going to ignore wrongdoings in hopes the perp will continue to play nicely.
      - munk-a 8y ago
        If we can't trust a company to audit themselves fairly (in fact, we can't generally) then they should bear the burden of paying for an external audit of their processes, many "boring" industries have these sorts of requirements.
      - jyrkesh 8y ago
        There might not have been a large-scale public data dump of passwords, but if 20,000[1] employees had access to logs with plaintext passwords, there is no guarantee I could ever accept that zero of them read or used customer passwords for personal purposes. What's to stop a malicious ex-lover from grabbing a FB password and reading that person's private messages? If FB didn't even know there were passwords in plaintext, they very likely weren't auditing log access as much as was needed. [1] https://www.theverge.com/2019/3/21/18275837/facebook-plain-text-password-storage-hundreds-millions-users https://www.theverge.com/2019/3/21/18275837/facebook-plain-t...
  - wavefunction 8y ago
    I'm on a small team (5 engineers) that is GDPR compliant so no PII is logged. It's not hard if you care.
    - UncleMeat 8y ago
      Its a lot easier on a small team. Security isn't a stable state.
      - wavefunction 8y ago
        I'm replying to the parent who made the opposite assertion I can't f'in believe I have to explicate such simple things to supposedly intelligent and thoughtful people
- organsnyder 8y ago
  Great—so potentially subject to even less security/privacy controls compared to other places they could've stored it.
- taurath 8y ago
  Which is the NUMBER ONE MOST BASIC rule of handling users confidential data. It reflects incredibly poorly on the engineering practices of Facebook that this managed to get through. It should be a criminal liability.
  - wnevets 8y ago
    I'm not arguing this wasn't a bad thing but comment made it sound like they were storing plaintext passwords in the database circa 2002.
    - taurath 8y ago
      Storing them in logs is the same thing IMO. Logs are usually more easily accessible than a user database.
      - wnevets 8y ago
        Gonna have to disagree. I think it would be way worse if we found out they were storing passwords were plaintext in the database in 2019. Even if the security implications are the same/worse, the policy/decision making of such a revelation would be beyond terrible. edit: To put it another way, remote code execution flaws are terrible but they can happen. However it would be way worse if someone put in a static username/password backdoor. The security outcome may be the same but one is beyond terrible policy/decision making.
        taurath 8y ago
        As is the policy/decision making that results in logs having the passwords - you can still have very locked down database access. Logs tend to get spread around all sorts of systems, and access control for logs is almost ALWAYS lower than DB keys. They're also cached for search-ability on any number of elasticsearch or business intelligence platforms, so getting rid of them after the fact is even harder. At the very least its an equivalent problem.
- whateveracct 8y ago
  even worse
- TallGuyShort 8y ago
  That's still a pretty elementary error for a company that gets off on using CS-y riddles in interviews like Google used to. Move fast and break things, and then get a $5B fine.
- OrgNet 8y ago
  > in logs. ... for seven years.
- chopin 8y ago
  So, it's not in plaintext if it is in logs? Storing passwords in logs is even worse than on a database since access more likely is less restrictive. Every programmer worth its salt knows about this problem (I surely wrote code to prevent this). Sorry, but it is like saying "there is no SQL injection, only bad input validation".
- golergka 8y ago
  The first thing I did after setting up Jenkins for our small dev shop was to find and install and test a plugin that removes all kinds of credentials from the logs. And I'm just a developer, and I never claimed nor think that I have any devops or administration qualifications - just common sense. If Facebook devops engineers, who are probably among the best trained and highest paid on the planet, lack the same common sense for their users passwords... I can't even come up with an ending to this sentence that would properly express my emotions right now.
munk-a 8y ago
Let's hope this fine doesn't cover those actions and prevent any real justice from being meted out.
cycrutchfield 8y ago
Let's not act like this sort of cavalier attitude towards user data has changed since the very beginning. > Zuck: People just submitted it. > Zuck: I don't know why. > Zuck: They "trust me" > Zuck: Dumb fucks
- colejohnson66 8y ago
  Can we quit it with posting this quote every time something negative on Facebook comes up. It’s practically a meme now and, quite honestly, it’s getting annoying.
  - deviomi 8y ago
    It is annoying, but it also reflects Zuckerbeg's mindset pretty well. What has changed since that quote is that he has learned to mask that mindset and lie and deflect.
  - ionised 8y ago
    The only people who find this annoying seem to be Facebook employees, shareholders or people with vested interests in being allowed to go about the kind of cavalier data collection that Facebook does. On the contrary, I think we need to keep repeating it. Everything I know about Zuckerberg, everything he says, the lies he tells, his actions and the actions of his company...they all lead me to one conclusion; that that particular quote is the deepest insight we have into the mind of Mark Zuckerberg, and we should never forget it.
    - shhehebehdh 8y ago
      I am none of those things you mentioned (employee, shareholder, other vested interest), and I also find it annoying. It’s something Zuck said when he was much younger. If his views haven’t changed since that age then he is an unusual person indeed.
      - ionised 8y ago
        I think it's pretty clear that his views haven't changed. Judge him by his actions, not his PR.
monsieurbanana 8y ago
I'm ashamed to say that up until now, when I saw Facebook (or similar) acting evil I thought about the quote, "Never attribute to malice that which is adequately explained by stupidity". Well, fuck that and fuck me, those people are not idiots, they're criminals.
- mnm1 8y ago
  Except the quote is generally wrong when it comes to issues of profit. It's simply backwards. People are fucking evil when it comes to money, profits, power, status, pleasure, and generally getting ahead of others. Considering those are the main motivators for almost all human actions, Hanlon's razor is clearly a bunch of bullshit that people spread around to end actual debate and discussions they don't like.
  - ALittleLight 8y ago
    I don't think the quote is wrong, it's just that some things aren't well explained by stupidity. "Oops, we accidentally stole your data and used it" isn't explainable by stupidity but is explainable by malice. In other words, Hanlon's Razer doesn't say that there is no such thing as malice just that you shouldn't default to assuming malice.
    - mnm1 8y ago
      Yes. I'm saying that you should default to assuming malice because in most human endeavors and motives it's the primary factor. Even stupid people can and are evil. The motives I list above cover probably over 90% of human actions. Although that's just my own guess as to percentage, that means hanlon's razor is useful only ten percent of the time.
- quickben 8y ago
  That gets me every time I read in the media about a 'bug' that enabled some complex data transfer. People, somebody has to decide, plan, code, test and deploy the behaviour, and make sure it works. And yet, people accept the explanation it seems without much thought.
tyingq 8y ago
LinkedIn was caught harvesting people's contacts with dark patterns. They settled a class action suit for $13M.
- therein 8y ago
  They weren't using the cleartext password to scrape contacts, though, were they?
  - javagram 8y ago
    LinkedIn did in fact have that as an explicit feature where users would insert their email password on LinkedIn’s website. https://www.linkedin.com/help/linkedin/answer/5204/email-password-prompt-after-attempting-to-import-your-address-book?lang=en https://www.linkedin.com/help/linkedin/answer/5204/email-pas... > If your email provider doesn't support OAuth, you'll need to enter your email password before clicking Continue. LinkedIn will use your password only for a moment to authenticate your account. We don't store or save your email password during this process. Facebook’s feature was similar I believe. Where they stumbled was connecting an email verification feature to the code written almost a decade ago for contact import.
  - deleted 8y ago
    [deleted]
oneepic 8y ago
If I understand this right, #3 happened and was (allegedly) resolved before #1 and #2 happened, so that's not a fair shake. #1 and #2 are still valid points.
l33tbro 8y ago
Is there anything left I can do to escape Facebook? This is just depressing for someone who was in college when FB came out and never signed up. Nor any other social network (still a favorite oxymoron) since. What kind of a profile of me would they be able to glean from email? Whole thing feels so fucking invasive.
ChrisCinelli 8y ago
I remember the era started by Sean Parker with Plaxo: https://en.wikipedia.org/wiki/Plaxo https://en.wikipedia.org/wiki/Plaxo ... Everybody was doing it: https://blog.codinghorror.com/please-give-us-your-email-password/ https://blog.codinghorror.com/please-give-us-your-email-pass...
- ChrisCinelli 8y ago
  In 2008-2010 companies had the chance to harvest millions of emails and other personal data. The opportunity is not likely to come back this easily. Shutting down these options, even if it is the right things to do for the users, is effectively increasing the barriers of entry and reducing the growing speed of new companies. The result is that those companies will maintain a dominant position on the market.
wang_li 8y ago
> 2) Using that email access to "inadvertently" upload the information of their email contacts.[1] If they wanted to show proper contrition, they'd not only delete that information from their systems, they'd also remove all links in the social graphs that can be in any way a result of that information. They'd also take 100% of their revenue that was even slightly influenced/generated by the inappropriately gather data and send it out to the users whose data was copied without permission. Also they should probably put together a legal team who will be ready to start handling the $150,000 per copied item that they didn't have the right to copy. :lol
ian0 8y ago
Spotted this in the guardian link: >> “When we looked into the steps people were going through to verify their accounts we found that in some cases people’s email contacts were also unintentionally uploaded to Facebook when they created their account,” Im struggling with the "unintentionally" part and to play devils advocate trying to figure out if it could be possible. Perhaps they had a service already that performed the login to upload peoples contacts on request and to save time reused this service to also verify the account?
m463 8y ago
nothing linkedin hasn't done. (don't know about the plaintext passwords) [I meant this as a serious observation, linkedin was sued but I believe they only got a mild slap on the wrist]
macspoofing 8y ago
>Seems like they should add another 0 to the fine after the recent hat trick You're under the impression that regulators are in the business of bankrupting companies. All the instances you cited of Facebook's wrongdoing are not worth a $50billion(!!) fine. They just aren't.

wnevets 8y ago

> 3) Storing said passwords and others in plaintext. [2] in logs.

munk-a 8y ago
If you're a small business - I get it, it's good to whitelist whatever information you're logging explicitly, but for smaller teams a hard to diagnose issue might lead the team to "log everything so we can sort it out later". Facebook is Facebook, whether this decision was the product of the corporation as a whole, a small dev team, or a highly paid consultant/third party, Facebook is a big enough company that they don't have the "I didn't realize..." excuse anymore.
- fuzz4lyfe 8y ago
  Seems like a pretty trivial automated test for so many PHD's to miss: create_user('Bob', 'BobPassword123') assert "BobPassword123" not in logfile
  - munk-a 8y ago
    Hrm, so you checked the apache access logs, or maybe an error log, what about the system logs? Does the login request spin up a bash script and pass the password to it? I don't think it's trivial to guarantee non-existence.
    - jlarocco 8y ago
      > I don't think it's trivial to guarantee non-existence. I disagree in this case. Log messages don't spontaneously appear in arbitrary places. If the developers understand what their software is doing and how their systems are configured then they should know where to check for the logging messages.
      - noselasd 8y ago
        Until someone turned on logging of the full request body on the load balancer/proxy or otherwise unknown-to-you middlebox that was the TLS termination point in production that you did not know about
        fuzz4lyfe 8y ago
        So their incompetence lies in lacking configuration management in production as opposed to a lack of testing? Why are they manually configuring production servers anyway at that scale?
        munk-a 8y ago
        They are managing a lot of things, they have full responsibility to be aware of these things as a company but I'd guess that with the scale of ops Facebook has regular developers never interact with the team that's managing their attempt at high availability by scattering servers across different hosts, data centers, legal jurisdictions etc. in fact I'd imagine at a op the size of Facebook that sort of problem has a dedicated department. That said, someone should have been watching for this stuff and failed to do so (or to exist), so I'm not excusing them - but this is not a trivial thing to protect against.
- beat 8y ago
  I've worked for multiple Fortune 25 companies, and that excuse does not fly. Not in banking or healthcare, where breaches of privacy/confidentiality are actually illegal, rather than merely distasteful. Small teams and careless devs doing that sort of bad logging will be caught and corrected by strict security oversight. This is the sort of thing that leads the HN crowd to sneer at the old, slow ways of the enterprise world.
  - deleted 8y ago
    [deleted]
  - gjs278 8y ago
    hey just so you know your https ssl certificate is broken for congruence.io so much for how careful you are with computers. it’s telling you worked for multiple fortune 25’s.
  - Aunche 8y ago
    The passwords in plaintext wasn't a breach or a leak. If you punish Facebook for it, they would be less inclined to share such information in the future.
    - tkxxx7 8y ago
      That's how you handle children, though. No one is going to ignore wrongdoings in hopes the perp will continue to play nicely.
    - munk-a 8y ago
      If we can't trust a company to audit themselves fairly (in fact, we can't generally) then they should bear the burden of paying for an external audit of their processes, many "boring" industries have these sorts of requirements.
    - jyrkesh 8y ago
      There might not have been a large-scale public data dump of passwords, but if 20,000[1] employees had access to logs with plaintext passwords, there is no guarantee I could ever accept that zero of them read or used customer passwords for personal purposes. What's to stop a malicious ex-lover from grabbing a FB password and reading that person's private messages? If FB didn't even know there were passwords in plaintext, they very likely weren't auditing log access as much as was needed. [1] https://www.theverge.com/2019/3/21/18275837/facebook-plain-text-password-storage-hundreds-millions-users https://www.theverge.com/2019/3/21/18275837/facebook-plain-t...
- wavefunction 8y ago
  I'm on a small team (5 engineers) that is GDPR compliant so no PII is logged. It's not hard if you care.
  - UncleMeat 8y ago
    Its a lot easier on a small team. Security isn't a stable state.
    - wavefunction 8y ago
      I'm replying to the parent who made the opposite assertion I can't f'in believe I have to explicate such simple things to supposedly intelligent and thoughtful people
organsnyder 8y ago
Great—so potentially subject to even less security/privacy controls compared to other places they could've stored it.
taurath 8y ago
Which is the NUMBER ONE MOST BASIC rule of handling users confidential data. It reflects incredibly poorly on the engineering practices of Facebook that this managed to get through. It should be a criminal liability.
- wnevets 8y ago
  I'm not arguing this wasn't a bad thing but comment made it sound like they were storing plaintext passwords in the database circa 2002.
  - taurath 8y ago
    Storing them in logs is the same thing IMO. Logs are usually more easily accessible than a user database.
    - wnevets 8y ago
      Gonna have to disagree. I think it would be way worse if we found out they were storing passwords were plaintext in the database in 2019. Even if the security implications are the same/worse, the policy/decision making of such a revelation would be beyond terrible. edit: To put it another way, remote code execution flaws are terrible but they can happen. However it would be way worse if someone put in a static username/password backdoor. The security outcome may be the same but one is beyond terrible policy/decision making.
      - taurath 8y ago
        As is the policy/decision making that results in logs having the passwords - you can still have very locked down database access. Logs tend to get spread around all sorts of systems, and access control for logs is almost ALWAYS lower than DB keys. They're also cached for search-ability on any number of elasticsearch or business intelligence platforms, so getting rid of them after the fact is even harder. At the very least its an equivalent problem.
whateveracct 8y ago
even worse
TallGuyShort 8y ago
That's still a pretty elementary error for a company that gets off on using CS-y riddles in interviews like Google used to. Move fast and break things, and then get a $5B fine.
OrgNet 8y ago
> in logs. ... for seven years.
chopin 8y ago
So, it's not in plaintext if it is in logs? Storing passwords in logs is even worse than on a database since access more likely is less restrictive. Every programmer worth its salt knows about this problem (I surely wrote code to prevent this). Sorry, but it is like saying "there is no SQL injection, only bad input validation".
golergka 8y ago
The first thing I did after setting up Jenkins for our small dev shop was to find and install and test a plugin that removes all kinds of credentials from the logs. And I'm just a developer, and I never claimed nor think that I have any devops or administration qualifications - just common sense. If Facebook devops engineers, who are probably among the best trained and highest paid on the planet, lack the same common sense for their users passwords... I can't even come up with an ending to this sentence that would properly express my emotions right now.

munk-a 8y ago

Let's hope this fine doesn't cover those actions and prevent any real justice from being meted out.

cycrutchfield 8y ago

Let's not act like this sort of cavalier attitude towards user data has changed since the very beginning. > Zuck: People just submitted it. > Zuck: I don't know why. > Zuck: They "trust me" > Zuck: Dumb fucks

colejohnson66 8y ago
Can we quit it with posting this quote every time something negative on Facebook comes up. It’s practically a meme now and, quite honestly, it’s getting annoying.
- deviomi 8y ago
  It is annoying, but it also reflects Zuckerbeg's mindset pretty well. What has changed since that quote is that he has learned to mask that mindset and lie and deflect.
- ionised 8y ago
  The only people who find this annoying seem to be Facebook employees, shareholders or people with vested interests in being allowed to go about the kind of cavalier data collection that Facebook does. On the contrary, I think we need to keep repeating it. Everything I know about Zuckerberg, everything he says, the lies he tells, his actions and the actions of his company...they all lead me to one conclusion; that that particular quote is the deepest insight we have into the mind of Mark Zuckerberg, and we should never forget it.
  - shhehebehdh 8y ago
    I am none of those things you mentioned (employee, shareholder, other vested interest), and I also find it annoying. It’s something Zuck said when he was much younger. If his views haven’t changed since that age then he is an unusual person indeed.
    - ionised 8y ago
      I think it's pretty clear that his views haven't changed. Judge him by his actions, not his PR.

monsieurbanana 8y ago

I'm ashamed to say that up until now, when I saw Facebook (or similar) acting evil I thought about the quote, "Never attribute to malice that which is adequately explained by stupidity". Well, fuck that and fuck me, those people are not idiots, they're criminals.

mnm1 8y ago
Except the quote is generally wrong when it comes to issues of profit. It's simply backwards. People are fucking evil when it comes to money, profits, power, status, pleasure, and generally getting ahead of others. Considering those are the main motivators for almost all human actions, Hanlon's razor is clearly a bunch of bullshit that people spread around to end actual debate and discussions they don't like.
- ALittleLight 8y ago
  I don't think the quote is wrong, it's just that some things aren't well explained by stupidity. "Oops, we accidentally stole your data and used it" isn't explainable by stupidity but is explainable by malice. In other words, Hanlon's Razer doesn't say that there is no such thing as malice just that you shouldn't default to assuming malice.
  - mnm1 8y ago
    Yes. I'm saying that you should default to assuming malice because in most human endeavors and motives it's the primary factor. Even stupid people can and are evil. The motives I list above cover probably over 90% of human actions. Although that's just my own guess as to percentage, that means hanlon's razor is useful only ten percent of the time.
quickben 8y ago
That gets me every time I read in the media about a 'bug' that enabled some complex data transfer. People, somebody has to decide, plan, code, test and deploy the behaviour, and make sure it works. And yet, people accept the explanation it seems without much thought.

tyingq 8y ago

LinkedIn was caught harvesting people's contacts with dark patterns. They settled a class action suit for $13M.

therein 8y ago
They weren't using the cleartext password to scrape contacts, though, were they?
- javagram 8y ago
  LinkedIn did in fact have that as an explicit feature where users would insert their email password on LinkedIn’s website. https://www.linkedin.com/help/linkedin/answer/5204/email-password-prompt-after-attempting-to-import-your-address-book?lang=en https://www.linkedin.com/help/linkedin/answer/5204/email-pas... > If your email provider doesn't support OAuth, you'll need to enter your email password before clicking Continue. LinkedIn will use your password only for a moment to authenticate your account. We don't store or save your email password during this process. Facebook’s feature was similar I believe. Where they stumbled was connecting an email verification feature to the code written almost a decade ago for contact import.
- deleted 8y ago
  [deleted]

oneepic 8y ago

If I understand this right, #3 happened and was (allegedly) resolved before #1 and #2 happened, so that's not a fair shake. #1 and #2 are still valid points.

l33tbro 8y ago

Is there anything left I can do to escape Facebook? This is just depressing for someone who was in college when FB came out and never signed up. Nor any other social network (still a favorite oxymoron) since. What kind of a profile of me would they be able to glean from email? Whole thing feels so fucking invasive.

ChrisCinelli 8y ago

I remember the era started by Sean Parker with Plaxo: https://en.wikipedia.org/wiki/Plaxo https://en.wikipedia.org/wiki/Plaxo ... Everybody was doing it: https://blog.codinghorror.com/please-give-us-your-email-password/ https://blog.codinghorror.com/please-give-us-your-email-pass...

ChrisCinelli 8y ago
In 2008-2010 companies had the chance to harvest millions of emails and other personal data. The opportunity is not likely to come back this easily. Shutting down these options, even if it is the right things to do for the users, is effectively increasing the barriers of entry and reducing the growing speed of new companies. The result is that those companies will maintain a dominant position on the market.

wang_li 8y ago

> 2) Using that email access to "inadvertently" upload the information of their email contacts.[1] If they wanted to show proper contrition, they'd not only delete that information from their systems, they'd also remove all links in the social graphs that can be in any way a result of that information. They'd also take 100% of their revenue that was even slightly influenced/generated by the inappropriately gather data and send it out to the users whose data was copied without permission. Also they should probably put together a legal team who will be ready to start handling the $150,000 per copied item that they didn't have the right to copy. :lol

ian0 8y ago

Spotted this in the guardian link: >> “When we looked into the steps people were going through to verify their accounts we found that in some cases people’s email contacts were also unintentionally uploaded to Facebook when they created their account,” Im struggling with the "unintentionally" part and to play devils advocate trying to figure out if it could be possible. Perhaps they had a service already that performed the login to upload peoples contacts on request and to save time reused this service to also verify the account?

m463 8y ago

nothing linkedin hasn't done. (don't know about the plaintext passwords) [I meant this as a serious observation, linkedin was sued but I believe they only got a mild slap on the wrist]

macspoofing 8y ago

>Seems like they should add another 0 to the fine after the recent hat trick You're under the impression that regulators are in the business of bankrupting companies. All the instances you cited of Facebook's wrongdoing are not worth a $50billion(!!) fine. They just aren't.