5 ms·
Meta fined $102M for storing passwords in plain text
- ChrisArchitect 2y ago[dupe] Discussion: https://news.ycombinator.com/item?id=41669912 https://news.ycombinator.com/item?id=41669912
- Culonavirus 2y ago> a senior employee told Krebs on Security back then that the incident involved up to 600 million passwords. Some of the passwords had been stored in easily readable format in the company's servers since 2012. They were also reportedly searchable by over 20,000 Facebook employees I thought this was gonna be some limited faux pas... but no. That's terrible.
- DexesTTP 2y agoContext: This is for a 2019 data breach on a system that was created in 2012. The GDPR was instated in 2018 (has it really been that long? Wow feels like yesterday) and Meta failed to disclose the 2019 data breach properly under GDPR, hence the fine.
- pibefision 2y agoGDPR fine is 4% of global turnover from previous fiscal year. 102m seems low to me.
- bootsmann 2y agoThats the maximal fine I think, the judges can set the amount depending on the severity of the violation.
- poincaredisk 2y agoThat's the maximal fine (that was never used as far as I know, at least on a large company). In this case the fine is understandably much smaller, since the privacy incident is not critical, and Facebook reported the problem to the authorities on its own.
- sakisv 2y agoHonest question: How was it discovered? Was it reported by a pentester? (ex-)employee? Facebook itself? How do we know that it goes back to 2012? I know in the public sector you have to disclose such things to ICO, but does that also apply to private companies? Who is going to hold them accountable?
- chrismorgan 2y agoI was concerned, reading your thing first, that the title (“Meta fined $102M for storing passwords in plain text”) was going to be false—that they were actually only fined for not disclosing the breach. But the article says the decision also claimed a GDPR violation for storing the passwords in plaintext, so that’s good: > The DPC found that Meta violated several GDPR rules related to the breach. It determined that the company failed to "notify the DPC of a personal data breach concerning storage of user passwords in plaintext" without undue delay and failed to "document personal data breaches concerning the storage of user passwords in plaintext." It also said that Meta violated the GDPR by not using appropriate technical measures to ensure the security of users' passwords against unauthorized processing.
- AmericanChopper 2y agoThis is a very imaginative use of the word “breach”, according to the details reported in the article at least. Internal staff (inadvertently) had access to users plaintext passwords. The article doesn’t mention any use of these credentials in a breach though, and doesn’t make any refutation of Meta’s claim that this never occurred. Internal staff having access to my data is what I would normally expect from a service like the ones Meta operates. It’s a bad mistake to make, but contriving these circumstances into being a “breach” is a bit more mask-off than I’m used to the Data Protection agencies being. Hope Ireland makes good use of its $102M.
- nomilk 2y agoIn many senses, internal staff having access to plaintext passwords is a breach.
- AmericanChopper 2y agoIt’s a control failure, not a breach. It would also be an incident, one that could result in a subsequent breach, or one that warrants some work to be done to ensure it does not turn into a breach. But it has not resulted in an unauthorised party gaining access to the data, and is therefor not a breach.
- ethbr1 2y agoI think it's impossible to say there was no breach, given they were exposed for 7 years.
- AmericanChopper 2y agoI would agree. Which is why I’m suggesting that the Irish Data Protection Commission and Engadget should refrain from saying that. It’s also impossible to say that I am not responsible for a breach of your private data either. How much should the Irish Data Protection Commission fine me?
- nomilk 2y ago[flagged]
- Mountain_Skies 2y agoMost of them have signed an NDA promising not to do it. Is that not enough? /s
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- can16358p 2y agoI really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.
- progbits 2y agoIt's unbelievable how little most developers care about security. At this point I've given up on educating them since it went nowhere, instead I'm locking down permissions to things like firewall and secret vault so random people don't fuck it up.
- wahnfrieden 2y agoTheir managers don't incentivize them spending time on it, and their PM will fight security tickets they don't understand the need for. Most devs have little autonomy at orgs today and operate under a strict hierarchy of command at the ticket level.
- pbhjpbhj 2y agoPresumably, "we're been storing 600 Million passwords in plaintext" is understandable to their PMs given its understandable to complete laymen. Aren't FAANG companies supposed to employ the very brightest minds. Hard to imagine this wasn't done on purpose.
- throwawaysleep 2y agoUsing the terms, wallet, threat, or prestige, make me as a non aultristic person care about the security of the systems my employer owns.
- radicalbyte 2y agoI don't see that in capable developers (who usually end up pushed to "backend") but it is absolutely endemic in frontend and extremely problematic in organisations which have full stack created frontend-first. All too often even the super seniors / leads have a very limit knowledge of security (or performance, reliability etc).
- schleck8 2y agoCan't wait to give them access to everything I do on the daily by wearing their AR glasses.
- saad_123 2y ago[dead]
- hannofcart 2y agoOh so the hashing and rainbow table attack questions they ask in Meta interviews is basically a cry for help?
- Topfi 2y agoSalt and pepper? Sure you aren't applying to our canteen?
- foota 2y agoIt's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.
- gm3dmo 2y agoSanitize your outputs?
- delusional 2y ago> Meta does not intend Is an odd concept. Is the argument that nobody noticed? If somebody noticed, but the cleanup was deffered, them they did "intend to". It's like defending a bank robber by saying that he didn't intend to rob the bank, he just had a gun in his hand, and then he figured the damage was already done, so he may as well get some money.
- locallost 2y agoI think the comment is the context of being a software developer. "Everyone" knows you shouldn't do that, so it would be a bit odd if the company of Facebook's size would. But if it was accidental, then it makes it clearer how it happened. It's still a grave mistake, but not unthinkable. I personally write bugs all the time.
- osullip 2y agoLogging passwords on the fly is probably common. Some debug or log action setup and forgotten. However, if you ever see a password in plain text you should raise alarms to the highest level. In this case, I don't think the alarm was raised.
- cogman10 2y agoI agree, but also I know of devs that don't understand the basic security implications of passwords being in logs. I could easily see how someone, maybe even a couple of people, could see these logs and think nothing of them.
- bberrry 2y agoI would hope it's not the authentication team's systems that are logging payloads with passwords.. they should definitely know better. Presumably it happened some infrastructure component owned by another team.
- junon 2y agoWhy are passwords leaving the auth services though?
- qwerty456127 2y agoWow I didn't know this is illegal.
- cubefox 2y agoCertainly depends on the country.
- grayhatter 2y agoyou didn't know that it was illegal to be careless in a way that's well known to cause harm to other people?
- nh2 2y ago0.1 % of current revenue fine. If your company made a billion $ revenue per year, it'd have to pay $100k. Doesn't feel like a great incentive to do it right. If they improved debuggability by logging all requests to make the company more than 0.1 % efficient, it's a good deal for them.
- incognition 2y agoIt’s more like there’s a Director who gets paid $1 million to make sure the logging goes right and he fucked up his job so it’s like he should get fired because they could have replaced him 100x
- tveyben 2y ago102M$ might sound like a large sum - but the math shows that a leaked clear text password here is just fined with less than one dollar… (Yes I have read the fine is triggered by not informing the authorities in due time) Interesting how the affected user is actually valuated…
- deleted 2y ago[deleted]
- Myrmornis 2y agoWho gets the money and what will it be spent on?
- s_dev 2y agoPrevious discussion: https://news.ycombinator.com/item?id=41669912#41672163 https://news.ycombinator.com/item?id=41669912#41672163
- 1vuio0pswjnm7 2y agoIncompetence does not require intent.