Yeah, it's important to note that while my anecdote was from the "post-CA timeframe", they had also just had an exploit that resulted in mass harvesting of OAut

Yeah, it's important to note that while my anecdote was from the "post-CA timeframe", they had also just had an exploit that resulted in mass harvesting of OAuth tokens[1]. And of course, a couple months later it came out that they were storing passwords in plaintext logs[2]. This wasn't just about CA. There was a class of problems that FB was facing, and the guy didn't acknowledge a single thing they could have done better. [1] https://arstechnica.com/information-technology/2018/09/50-million-facebook-accounts-breached-by-an-access-token-harvesting-attack/ https://arstechnica.com/information-technology/2018/09/50-mi... [2] https://www.npr.org/2019/03/21/705588364/facebook-stored-millions-of-user-passwords-in-plain-readable-text https://www.npr.org/2019/03/21/705588364/facebook-stored-mil...