News for hackers. Stuff that matters.

A comment on Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years. Parent comment

Re:Facebook Stored Hundreds of Millions of User Passwords in... by EpicEng on Thursday March 21, 2019 @12:57PM (#19454546)
My point is that it's irrelevant. Have more data? Need more auditing. Any system which touches sensitive data is subject to security review. Yes, FB systems are massive. They should have massive oversight as well. You may as well be defending a nuclear meltdown because desiging nuclear power plants is hard.

>Ensuring that sensitive data isn’t logged takes more than some occasional greps.

Right; it requires investment into process, requirements, testing, and oversight. Most importantly, it requires a company wide, top down mentality that your customer's privacy and protection is more important than your margins.

If you can't (won't) dedicate the resources required to ensure your customers data is protected then you have no business operating at such a scale.

[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by ryandrake on Thursday March 21, 2019 @01:15PM (#19454782)
Exactly. Can every piece of data logged be tied back to a legitimate business purpose? What’s needed here is a mentality change: These logs should be thought of as liabilities rather than assets. You should log only what you need, while you need it, and then turn off the log when you’re done. If your mentality is “log everything, always, because maybe we’ll need it later” then these privacy and security trash fires should be expected.
[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by viraptor on Thursday March 21, 2019 @03:24PM (#19456295)
Log everything: you don't care about privacy.

Treat logs as liabilities: why can't you solve the issue I experienced yesterday?

You can't win. Either you log more than you think you need right now or you can't do engineering investigations on past data. You're going to end up somewhere in the middle realistically.

[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by matz1 on Thursday March 21, 2019 @01:27PM (#19454945)
Everything is a tradeoff, how much cost that fb incure due to this incident, I would guess not so much, at least not big enough to warrant massive resources needed.
[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by EpicEng on Thursday March 21, 2019 @01:47PM (#19455177)
Well, that's the problem really; they obviously don't care.
[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by NoodleIncident on Thursday March 21, 2019 @02:07PM (#19455432)
According to the timeline of events in The Fine Article, this story only exists because someone cared. At many companies the story would end at "one diff reviewer noticed passwords getting logged in one diff". All of the numbers in this story come from an internal investigation to see where else they're making the same mistake, _so they stop doing that_. That's not what you do if you don't care.
[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by EpicEng on Thursday March 21, 2019 @02:25PM (#19455648)
If FB truly cared it would likely never have happened, let alone gone on for years. I'm not saying no employee at FB cares; I'm saying FB as an organization doesn't, and we have plenty of "I'm sorry, we'll do better" statements to back that up.
[ Parent | on HN ]
[dead]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by dang on Friday March 22, 2019 @01:56AM (#19459947)
Crossing into personal attack isn't allowed here, regardless of how right you are or feel you are. Most of your comments to HN have unfortunately been like this. Would you mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the spirit of this site to heart? It's particularly important when your points are right, so as not to discredit them.
[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by EpicEng on Thursday March 21, 2019 @10:26PM (#19459159)
It's hard to take you seriously when your argument boils down to name calling and how obviously awesome FB is.
[ Parent | on HN ]