4 ms·

Making money off "mistakes" that keep happening, darn it!

_cs2017_ 7y ago
I don't think they can make money off plain text passwords? They can only lose money from that, if it's discovered and they are fined and lose some users. They can make money from contact lists, but IIUC the article said they didn't use the contact lists. Also, given that it only affected a couple million users (like 0.1% of their user base), the damage to their reputation would far outweigh any benefits of actually using those contact lists. On the last item, the collection of email passwords, the only benefit would be if they actually use those passwords to get information, so the above point covers it. Let me know if I'm missing something.
- wavefunction 7y ago
  how about extracting a user's contacts with their plaintext passwords that would usually be hashed into a database (at least in my professional experience) and thus unusable by facebook?
  - deleted 7y ago
    [deleted]
  - _cs2017_ 7y ago
    You can do many evil things with passwords. But, according to the articles, that's not what happened. They did download contact lists, even though they never used the plaintext passwords they stored in the logs. The users involved in the two incidents were different.
bastawhiz 7y ago
Storing plain text passwords doesn't make them money, but it negatively affects users, should those passwords be compromised. Though FB didn't prosper from the mistake, users potentially feel a cost, so the outcome is the same. Criminal negligence might not benefit the bad actor, but it's still a crime either way.
- wavefunction 7y ago
  or using the plaintext passwords to extract a user's contacts when hashing it into a database would prevent facebook from impersonating that user and logging in to access their non-facebook social graph?
- _cs2017_ 7y ago
  Yes that's a good point. It's a bit like Exxon Valdez: they don't profit from spilling oil in the ocean, but they should still be penalized for cutting corners on safety.

_cs2017_ 7y ago

I don't think they can make money off plain text passwords? They can only lose money from that, if it's discovered and they are fined and lose some users. They can make money from contact lists, but IIUC the article said they didn't use the contact lists. Also, given that it only affected a couple million users (like 0.1% of their user base), the damage to their reputation would far outweigh any benefits of actually using those contact lists. On the last item, the collection of email passwords, the only benefit would be if they actually use those passwords to get information, so the above point covers it. Let me know if I'm missing something.

wavefunction 7y ago
how about extracting a user's contacts with their plaintext passwords that would usually be hashed into a database (at least in my professional experience) and thus unusable by facebook?
- deleted 7y ago
  [deleted]
- _cs2017_ 7y ago
  You can do many evil things with passwords. But, according to the articles, that's not what happened. They did download contact lists, even though they never used the plaintext passwords they stored in the logs. The users involved in the two incidents were different.

bastawhiz 7y ago

Storing plain text passwords doesn't make them money, but it negatively affects users, should those passwords be compromised. Though FB didn't prosper from the mistake, users potentially feel a cost, so the outcome is the same. Criminal negligence might not benefit the bad actor, but it's still a crime either way.

wavefunction 7y ago
or using the plaintext passwords to extract a user's contacts when hashing it into a database would prevent facebook from impersonating that user and logging in to access their non-facebook social graph?
_cs2017_ 7y ago
Yes that's a good point. It's a bit like Exxon Valdez: they don't profit from spilling oil in the ocean, but they should still be penalized for cutting corners on safety.