5 ms·

Well, Facebook has a pretty poor history with regard to security, so I'm not so sure either way.

by root_axis 7y ago

buboard 7y ago
Do they ?
- root_axis 7y ago
  Yes. https://arstechnica.com/information-technology/2018/09/50-million-facebook-accounts-breached-by-an-access-token-harvesting-attack/ https://arstechnica.com/information-technology/2018/09/50-mi...
  - buboard 7y ago
    Well no, facebook has pretty good security. 50 Mil stolen credentials in 15 years out of what is probably more than ten billion accounts is nothing.
    - root_axis 7y ago
      https://www.cbsnews.com/news/millions-facebook-user-records-exposed-amazon-cloud-server/ https://www.cbsnews.com/news/millions-facebook-user-records-... I'm guessing your response will be that it wasn't Facebook's fault. I would also note that there aren't even 10 billion people living on earth, so it sounds like you're just making stuff up.
      - buboard 7y ago
        you 'll notice in that article that it wasn't facebook's servers that were breached. Also facebook has probably way more accounts than humans, i think just recently they deleted 3 billion fake ones. Regardless, imho from many years working with their platform, they do take security seriously and they ve helped to popularize methods for securing accounts and passwords.
        root_axis 7y ago
        > you 'll notice in that article that it wasn't facebook's servers that were breached A distinction without a difference. If Facebook's security policy permits PII to be moved into insecure systems then Facebook itself is insecure. Here's another: https://www.businessinsider.com/facebook-uploaded-1-5-million-users-email-contacts-without-permission-2019-4 https://www.businessinsider.com/facebook-uploaded-1-5-millio... Yeah. 1.5 million, who cares right? No big deal. This is clearly a pattern, not an isolated incident.
        buboard 7y ago
        this is a privacy issue, but their security is still pretty good, relative to the staggering size of the users and data they hold.
        root_axis 7y ago
        > still pretty good, relative to the staggering size of the users and data they hold. Hundreds of millions of exposed users is not "pretty good", it's objectively horrible. > this is a privacy issue It is a privacy issue but primarily a security issue since the scandal is that the data was unintentionally leaked, not that it was shared with a 3rd party.
        grey-area 7y ago
        Regardless, imho from many years working with their platform It is difficult to get a man to understand something, when his salary depends on his not understanding it. Upton Sinclair
        buboard 7y ago
        nah i wish that was the case
    - kerng 7y ago
      Normalization of Deviance at its finest- 50 million (and over time and aggregated its been way more) is not something to be proud of, rather the opposite CSO, maybe even CEO should have resigned for how frequent they have breaches and "bugs".
- jazzyjackson 7y ago
  I keep coming back to this blog when it comes to Facebook's handling of PII -- they didn't lose it accidentally, but they gave access to it in exchange for developing popular / viral apps for facebook as a platform, "What the f* was facebook thinking" https://medium.com/@jamesallworth/what-the-f-was-facebook-thinking-a1c49dbf29c2 https://medium.com/@jamesallworth/what-the-f-was-facebook-th... They gave out users' unique global ID with the export API so it was trivial to merge PII from multiple sources. They didn't have to be hacked, they left the door open. Facebook was full of dumb 'which x-movie-character are you' because every one of those grabbed a few more profiles and at one point, private inbox messages, all to be merged back into somebody's data trove.
  - buboard 7y ago
    this is about privacy not security though. and all of these sensationalized articles fail to mention that users consented to share that data with the apps when they first used it through a dialog that's pretty much unambiguous. Even their table says so: "permissions", plus i m pretty sure at that time facebook was already sharing an app-scoped, not the global user id. Regardless , it was sloppy privacy practices, which were fine at the time and nobody cared because Trump had not happened. It's not a security breach, though.

Well, Facebook has a pretty poor history with regard to security, so I'm not so sure either way.

buboard 7y ago

Do they ?

root_axis 7y ago
Yes. https://arstechnica.com/information-technology/2018/09/50-million-facebook-accounts-breached-by-an-access-token-harvesting-attack/ https://arstechnica.com/information-technology/2018/09/50-mi...
- buboard 7y ago
  Well no, facebook has pretty good security. 50 Mil stolen credentials in 15 years out of what is probably more than ten billion accounts is nothing.
  - root_axis 7y ago
    https://www.cbsnews.com/news/millions-facebook-user-records-exposed-amazon-cloud-server/ https://www.cbsnews.com/news/millions-facebook-user-records-... I'm guessing your response will be that it wasn't Facebook's fault. I would also note that there aren't even 10 billion people living on earth, so it sounds like you're just making stuff up.
    - buboard 7y ago
      you 'll notice in that article that it wasn't facebook's servers that were breached. Also facebook has probably way more accounts than humans, i think just recently they deleted 3 billion fake ones. Regardless, imho from many years working with their platform, they do take security seriously and they ve helped to popularize methods for securing accounts and passwords.
      - root_axis 7y ago
        > you 'll notice in that article that it wasn't facebook's servers that were breached A distinction without a difference. If Facebook's security policy permits PII to be moved into insecure systems then Facebook itself is insecure. Here's another: https://www.businessinsider.com/facebook-uploaded-1-5-million-users-email-contacts-without-permission-2019-4 https://www.businessinsider.com/facebook-uploaded-1-5-millio... Yeah. 1.5 million, who cares right? No big deal. This is clearly a pattern, not an isolated incident.
        buboard 7y ago
        this is a privacy issue, but their security is still pretty good, relative to the staggering size of the users and data they hold.
        root_axis 7y ago
        > still pretty good, relative to the staggering size of the users and data they hold. Hundreds of millions of exposed users is not "pretty good", it's objectively horrible. > this is a privacy issue It is a privacy issue but primarily a security issue since the scandal is that the data was unintentionally leaked, not that it was shared with a 3rd party.
      - grey-area 7y ago
        Regardless, imho from many years working with their platform It is difficult to get a man to understand something, when his salary depends on his not understanding it. Upton Sinclair
        buboard 7y ago
        nah i wish that was the case
  - kerng 7y ago
    Normalization of Deviance at its finest- 50 million (and over time and aggregated its been way more) is not something to be proud of, rather the opposite CSO, maybe even CEO should have resigned for how frequent they have breaches and "bugs".
jazzyjackson 7y ago
I keep coming back to this blog when it comes to Facebook's handling of PII -- they didn't lose it accidentally, but they gave access to it in exchange for developing popular / viral apps for facebook as a platform, "What the f* was facebook thinking" https://medium.com/@jamesallworth/what-the-f-was-facebook-thinking-a1c49dbf29c2 https://medium.com/@jamesallworth/what-the-f-was-facebook-th... They gave out users' unique global ID with the export API so it was trivial to merge PII from multiple sources. They didn't have to be hacked, they left the door open. Facebook was full of dumb 'which x-movie-character are you' because every one of those grabbed a few more profiles and at one point, private inbox messages, all to be merged back into somebody's data trove.
- buboard 7y ago
  this is about privacy not security though. and all of these sensationalized articles fail to mention that users consented to share that data with the apps when they first used it through a dialog that's pretty much unambiguous. Even their table says so: "permissions", plus i m pretty sure at that time facebook was already sharing an app-scoped, not the global user id. Regardless , it was sloppy privacy practices, which were fine at the time and nobody cared because Trump had not happened. It's not a security breach, though.