Re:Instagram's Million Dollar Bug
by dogecoinbase on Thursday December 17, 2015 @05:16PM
(#10754991)
I certainly wouldn't consider dumping credentials to test for reuse/continued use a privacy violation. If FB wants people not to dump data, they need to make that explicit and specific.
[ Parent
| on HN ]
Really? The article states: "To say that I had gained access to basically all of Instagram's secret key material would probably be a fair statement". How on earth would holding on to that data not be a privacy violation?
Re:Instagram's Million Dollar Bug
by dogecoinbase on Thursday December 17, 2015 @05:24PM
(#10755039)
Holding credentials is not violating privacy. It would be possible to use those credentials to violate privacy, but merely having them is not that act.
Holding sensitive credentials is absolutely a violation of privacy. This is like saying that having a user's password is not a privacy violation unless you use it to gain access to their account.
So would you agree that holding the keys to someone's house is also a privacy violation? What if instead of keys, you were holding a set of lockpicks? Would everyone's privacy of home be immediately violated?
It's all a question of intent. If you keep the lockpicks so that you can pick locks, then yes. If you're a lockpick collector, then no.
Holding a manually chosen password can be a privacy violation because it's a small peek into the user's psyche. (I wouldn't say the employee "changeme", "instagram" etc. passwords count, although the act of running a password cracking tool meant that he could have seen a more personal password.)
Holding some randomly generated numbers that could be used to access a server is not.
Re:Instagram's Million Dollar Bug
by Gravityloss on Thursday December 17, 2015 @06:19PM
(#10755416)
I understood it was employee credentials, not customer.
Surely they would have to revoke all the keys anyway as they would have no idea if a blackhat got their first and took the keys before the vulnerability was reported?
According to the timeline, Instagram have known about the ssl keys since 1 Dec.
My browser is currently showing an ssl cert for instagram.com that was issued in April and expires on Dec 31.
Doesn't look like they're in any hurry to revoke that one. (I guess like Alex Stamos told his employer - it's "trivial and of little value"...)
Or, like almost any company that's reasonably competent, they have multiple certificates with different private keys.