News for hackers. Stuff that matters.

A comment on Facebook Network Breach Impacts Up to 50M Users. Parent comment

Re:Facebook Network Breach Impacts Up to 50M Users by romed on Friday September 28, 2018 @08:55PM (#18098127)
That doesn't just seem like a few unlucky coincidences. That seems like a fundamentally unsound design. Why should it even be theoretically possible for a request under the authority of one user to create a token with the authority of another user?
[ Parent | on HN ]
Re:Facebook Network Breach Impacts Up to 50M Users by flgr on Friday September 28, 2018 @09:02PM (#18098146)
Notably, they previously had issues were "View as" allowed you to view notifications and messages of the user you were viewing as.

If they'd done a proper post mortem and corrected the fundamental issue, and made sure it wouldn't have re-occured, this should not have happened.

[ Parent | on HN ]
Re:Facebook Network Breach Impacts Up to 50M Users by bigiain on Friday September 28, 2018 @11:58PM (#18098633)
Instead they moved fast and broke things.
[ Parent | on HN ]
Re:Facebook Network Breach Impacts Up to 50M Users by nautilus12 on Saturday September 29, 2018 @12:17AM (#18098679)
Its more important for you to move fast and break things and make us money than to move slow and do things the right way. The life of an engineer...Do it now! why did you do it that way!? Now we are screwed??
[ Parent | on HN ]
Re:Facebook Network Breach Impacts Up to 50M Users by pyman on Sunday September 30, 2018 @06:20AM (#18105522)
Facebook’s php developers like to move fast and break things. Bad design choices, monkey patching, breaking things on production, it’s all part of Facebook’s “engineering” principles.
[ Parent | on HN ]
Re:Facebook Network Breach Impacts Up to 50M Users by calc_exe on Friday September 28, 2018 @09:16PM (#18098177)
Yeah, sounds like https://en.wikipedia.org/wiki/Confused_deputy_problem to me.
[ Parent | on HN ]
Re:Facebook Network Breach Impacts Up to 50M Users by everdev on Friday September 28, 2018 @09:42PM (#18098265)
Not the root cause, but I'm guessing a microservice architecture made it more possible. It sounds like both the token generating service and the video upload service have bugs.
[ Parent | on HN ]