3 ms·

This was a couple of years back, so maybe the attitude has changed, but... The last time I reported a security problem to Facebook, I got an email warning me ab

This was a couple of years back, so maybe the attitude has changed, but... The last time I reported a security problem to Facebook, I got an email warning me about my online activity, telling me that my account might have been hacked, and that my password had been changed as a result. Several weeks later the problem I had been trying to report was still there. I've heard similar experiences from several other people - so even though this guy looks like he was being irresponsible, I personally will no longer report security problems to Facebook because I don't feel like it would get taken seriously, and will probably only inconvenience me further. I'm not sharing this to flame Facebook, I just would honestly like someone on the inside to know this is a problem. I never knew about the whitehat link because all I see on the Help page is targeted towards victims that probably don't know what they're doing.

mkjones 15y ago
Shoot, sorry to hear that. I think our attitude has always been pretty good, but the communications channels a few years ago were just not great or easy to find (it sounds like you were stuck on a "my account was hacked" workflow). We've improved a lot in the last couple years though - we launched the explicit whitehat program in 2010: http://www.insidefacebook.com/2010/12/22/facebook-security-terms-change-removes-risk-for-those-who-report-problems/ http://www.insidefacebook.com/2010/12/22/facebook-security-t... and the bug bounty in July of this year: https://www.facebook.com/security/posts/238039389561434 https://www.facebook.com/security/posts/238039389561434. Feel free to respond here or let me know if you ever run into similar issues with the whitehat program (hopefully you'll change your mind about no longer reporting security problems!).
- TallGuyShort 15y ago
  Well like you said, with an explicit whitehat program, I do think that improves things a lot. The main problem was that I didn't know what to do to not come across as the enemy and/or a nuisance. Next time I find a problem - I'll give the whitehat route a shot - so thanks for sharing.

mkjones 15y ago

Shoot, sorry to hear that. I think our attitude has always been pretty good, but the communications channels a few years ago were just not great or easy to find (it sounds like you were stuck on a "my account was hacked" workflow). We've improved a lot in the last couple years though - we launched the explicit whitehat program in 2010: http://www.insidefacebook.com/2010/12/22/facebook-security-terms-change-removes-risk-for-those-who-report-problems/ http://www.insidefacebook.com/2010/12/22/facebook-security-t... and the bug bounty in July of this year: https://www.facebook.com/security/posts/238039389561434 https://www.facebook.com/security/posts/238039389561434. Feel free to respond here or let me know if you ever run into similar issues with the whitehat program (hopefully you'll change your mind about no longer reporting security problems!).

TallGuyShort 15y ago
Well like you said, with an explicit whitehat program, I do think that improves things a lot. The main problem was that I didn't know what to do to not come across as the enemy and/or a nuisance. Next time I find a problem - I'll give the whitehat route a shot - so thanks for sharing.