6 ms·

One thing that may have prevented this hacking: facebook could have noticed that the primary email for the user was for an expired domain, and proactively notif

One thing that may have prevented this hacking: facebook could have noticed that the primary email for the user was for an expired domain, and proactively notified them to remove it. When a domain expires, there's a grace period, and just checking daily whether a user's email's domain is expired, and if so texting them or otherwise notifying them to change the email, would have been sufficient. This wouldn't even require _that_ many checks since the total number of unique domains to check is probably low. 99% of all users will be on gmail/outlook/yahoo/etc, and all users using the same domain only require a single check a day for the domain not having lapsed.

lawgimenez 4y ago
She's a mom of 2 who recently is living in a new place. Things like this are always overlooked. Let's just cut her some slack. I am a parent too, I know how difficult kids are. On that note, maybe there is a chance if she contacted someone from LinkedIn who works in Meta.
- Thorrez 4y ago
  >Let's just cut her some slack. TheDong isn't suggesting something she could have done. TheDong is suggesting something Facebook could have done.
  - lawgimenez 4y ago
    Thanks for pointing that out.
scaramanga 4y ago
It's just an expenditure that won't produce any profit. The technical term for this is "waste." The only way this would not be waste is if fixing it would do something to reduce the amount of ill will towards facebook which is quite intangible and unlikely to add up to covering the costs. But who knows what calculations are being made, or how they may change in the future.
cookiengineer 4y ago
The whois check for a domain literally contains when it will expire. You can do this one time (combined with an MX lookup) while the email is added. And knowing the ASN of a domain is also quite helpful. If anything changes (e.g. geolocation of ASN or different domain registrar) you can easily force the user to confirm this while they are already logged in. Source: I am doing this for my tholian.network products.
- oefrha 4y ago
  > The whois check for a domain literally contains when it will expire. You can do this one time (combined with an MX lookup) while the email is added. That’s not reliable. A domain can be deleted before expiration.
  - amenod 4y ago
    Sure, but that is usually by the request of the owner, if I'm not mistaken? Better cover most of the cases than none.
    - oefrha 4y ago
      All I’m saying is if you’re building such a system you should be aware of this and possibly account for it with some low frequency scanning before listed expiry. Or not, if you decide it’s not worthwhile.
      - amenod 4y ago
        Fair enough.
  - eszaq 4y ago
    Could also be renewed
  - cookiengineer 4y ago
    Alternatively you could do a whois query of the domain (and verify against cached details) before sending out the recovery email. It's probably best to do that every time the email addresses are changed or updated.
Thorrez 4y ago
How many accounts per year do you think are hacked this way? How many accounts per year do you think are hacked in other ways? Facebook has a finite amount of engineering effort, and the effort they put in to stopping hacks probably goes toward things they expect will prevent a large amount of hacks.
- wombatpm 4y ago
  I’m sorry. Meta has a finite amount of engineering? The profit margins are so thin that there is no possibility of improving service for users? That everyone is fully dedicated to new development that support for existing products can’t be spared? That Zuckerberg is so fearful of his board that he is afraid of being forced out if he lets up on the gas for just 1 sec? Or is it that they just don’t care?
  - Thorrez 4y ago
    >The profit margins are so thin that there is no possibility of improving service for users? I'm saying that there are many ways of improving service for users. If we prioritize those ways, I doubt doing checks for expiring DNS would be near the top.
    - wombatpm 4y ago
      Based on experience, it does not seem like they prioritize ANY improvements in customer service. And until there is a credible threat of government action I doubt they ever will
      - verve_rat 4y ago
        Remember that most users are not customers here, they are inventory. A bit of breakage is expected. The advertisers are the customers.
  - smsm42 4y ago
    Yes, they don't care. Why would they? That user probably doesn't generate much revenue, and losing them won't cause any major scandal in the press or anything embarrassing to top FB managers. I can't see any motivation for them to care.
DeathArrow 4y ago
>One thing that may have prevented this hacking: facebook could have noticed that the primary email for the user was for an expired domain, and proactively notified them to remove it. Almost any website, app or online activity that requires logging uses email based authentication. Do you think all existing web sites and apps should verify the expiration of mail domains? And what about phone numbers? A user can lose his phone number, should they verify that, too?
- _vertigo 4y ago
  >Do you think all existing web sites and apps should verify the expiration of mail domains? No - it probably wouldn't be worth it. But it could absolutely be worth it (weighing bad outcomes against amount of effort needed to prevent those outcomes) for the biggest sites with billions of users.
  - prawn 4y ago
    ... especially when they won't otherwise offer recourse/support in case of rare events like this. Rare events become less rare when there are billions of users.
varajelle 4y ago
And every small website who offer email authentication should implement all of that that and more?
vintermann 4y ago
This should be a part of the process of ALL sites that use email/domain ownership as proof of identity. There are a lot of them besides Facebook. Yeah, it's not currently possible for phone numbers, but that's not a reason for not doing it for domains where it is possible. It's also easy to imagine a privacy-respecting public registry for phone numbers, which only reported when the ownership had changed.
deleted 4y ago
[deleted]
Alex3917 4y ago
> facebook could have noticed that the primary email for the user was for an expired domain, and proactively notified them to remove it. Or just wait at least a week before emailing a password reset PIN to secondary email addresses. I reported this exact vulnerability 4 years ago: https://news.ycombinator.com/item?id=17835127 https://news.ycombinator.com/item?id=17835127

lawgimenez 4y ago

She's a mom of 2 who recently is living in a new place. Things like this are always overlooked. Let's just cut her some slack. I am a parent too, I know how difficult kids are. On that note, maybe there is a chance if she contacted someone from LinkedIn who works in Meta.

Thorrez 4y ago
>Let's just cut her some slack. TheDong isn't suggesting something she could have done. TheDong is suggesting something Facebook could have done.
- lawgimenez 4y ago
  Thanks for pointing that out.

scaramanga 4y ago

It's just an expenditure that won't produce any profit. The technical term for this is "waste." The only way this would not be waste is if fixing it would do something to reduce the amount of ill will towards facebook which is quite intangible and unlikely to add up to covering the costs. But who knows what calculations are being made, or how they may change in the future.

cookiengineer 4y ago

The whois check for a domain literally contains when it will expire. You can do this one time (combined with an MX lookup) while the email is added. And knowing the ASN of a domain is also quite helpful. If anything changes (e.g. geolocation of ASN or different domain registrar) you can easily force the user to confirm this while they are already logged in. Source: I am doing this for my tholian.network products.

oefrha 4y ago
> The whois check for a domain literally contains when it will expire. You can do this one time (combined with an MX lookup) while the email is added. That’s not reliable. A domain can be deleted before expiration.
- amenod 4y ago
  Sure, but that is usually by the request of the owner, if I'm not mistaken? Better cover most of the cases than none.
  - oefrha 4y ago
    All I’m saying is if you’re building such a system you should be aware of this and possibly account for it with some low frequency scanning before listed expiry. Or not, if you decide it’s not worthwhile.
    - amenod 4y ago
      Fair enough.
- eszaq 4y ago
  Could also be renewed
- cookiengineer 4y ago
  Alternatively you could do a whois query of the domain (and verify against cached details) before sending out the recovery email. It's probably best to do that every time the email addresses are changed or updated.

Thorrez 4y ago

How many accounts per year do you think are hacked this way? How many accounts per year do you think are hacked in other ways? Facebook has a finite amount of engineering effort, and the effort they put in to stopping hacks probably goes toward things they expect will prevent a large amount of hacks.

wombatpm 4y ago
I’m sorry. Meta has a finite amount of engineering? The profit margins are so thin that there is no possibility of improving service for users? That everyone is fully dedicated to new development that support for existing products can’t be spared? That Zuckerberg is so fearful of his board that he is afraid of being forced out if he lets up on the gas for just 1 sec? Or is it that they just don’t care?
- Thorrez 4y ago
  >The profit margins are so thin that there is no possibility of improving service for users? I'm saying that there are many ways of improving service for users. If we prioritize those ways, I doubt doing checks for expiring DNS would be near the top.
  - wombatpm 4y ago
    Based on experience, it does not seem like they prioritize ANY improvements in customer service. And until there is a credible threat of government action I doubt they ever will
    - verve_rat 4y ago
      Remember that most users are not customers here, they are inventory. A bit of breakage is expected. The advertisers are the customers.
- smsm42 4y ago
  Yes, they don't care. Why would they? That user probably doesn't generate much revenue, and losing them won't cause any major scandal in the press or anything embarrassing to top FB managers. I can't see any motivation for them to care.

DeathArrow 4y ago

>One thing that may have prevented this hacking: facebook could have noticed that the primary email for the user was for an expired domain, and proactively notified them to remove it. Almost any website, app or online activity that requires logging uses email based authentication. Do you think all existing web sites and apps should verify the expiration of mail domains? And what about phone numbers? A user can lose his phone number, should they verify that, too?

_vertigo 4y ago
>Do you think all existing web sites and apps should verify the expiration of mail domains? No - it probably wouldn't be worth it. But it could absolutely be worth it (weighing bad outcomes against amount of effort needed to prevent those outcomes) for the biggest sites with billions of users.
- prawn 4y ago
  ... especially when they won't otherwise offer recourse/support in case of rare events like this. Rare events become less rare when there are billions of users.

varajelle 4y ago

And every small website who offer email authentication should implement all of that that and more?

vintermann 4y ago

This should be a part of the process of ALL sites that use email/domain ownership as proof of identity. There are a lot of them besides Facebook. Yeah, it's not currently possible for phone numbers, but that's not a reason for not doing it for domains where it is possible. It's also easy to imagine a privacy-respecting public registry for phone numbers, which only reported when the ownership had changed.

deleted 4y ago

[deleted]

Alex3917 4y ago

> facebook could have noticed that the primary email for the user was for an expired domain, and proactively notified them to remove it. Or just wait at least a week before emailing a password reset PIN to secondary email addresses. I reported this exact vulnerability 4 years ago: https://news.ycombinator.com/item?id=17835127 https://news.ycombinator.com/item?id=17835127