News for hackers. Stuff that matters.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by unyttigfjelltol on Friday August 20, 2021 @03:59PM (#28250713)
So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most profitable businesses in the world. Weird.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by captainmuon on Friday August 20, 2021 @05:09PM (#28251437)
There are many motels, but Facebook has a monopoly on facebook accounts. If you could make a facebook account somewhere else, you could "take your business elsewhere".

Last I checked, FB actively banned using their APIs to build a competing product. I wish the government would make it mandatory to offer federation if you had, say, more than a million customers. But alas, governments rarely do what's convenient for customers.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by tqi on Friday August 20, 2021 @08:47PM (#28253035)
How would you prevent a Cambridge analytica style data "breach"?
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by captainmuon on Saturday August 21, 2021 @03:39AM (#28255029)
You make explicit that all data that people enter, they enter for purposes of sharing. At the same time, you ban creating profiles with data that has not been explicitly shared. IMO:

- Make a telefone-book style listing, or searching for "all metalheads < 25 near Chicago" where people entered that into their profiles -> OK

- Tracking users on your site -> OK

- Tracking users on third party sites, and then aggregating this data, so you can see "people who searched for baby carrages" or "people who bought diapers with their credit card" -> not OK

- Having some kind of database where people could concievably look up what user tqi purchased, searched, what their political affiliation is (when not made public) -> not OK (unless you have extreme auditibility, four-eye principle, and so on)

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by tqi on Monday August 23, 2021 @03:55PM (#28281097)
"You make explicit that all data that people enter, they enter for purposes of sharing."

I think the data captured by CA was also entered for the purposes of sharing, (often) limited to friends and friends of friends. I think the crux of this all is that as a society we haven't really established how those rights are transferred. If I share my email address with a friend, can they share it with their contact management app? I'm not sure how you create a consistent policy in a federated model.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by captainmuon on Thursday August 26, 2021 @07:06AM (#28313226)
The German Facebook clone back in the day was called StudiVZ which means "Student's directory". This was before social media and was more of a social network. Everything you put in there you do because you want it to be public, like your number in a telefone directory. It was almost a pure platform for self-presentation, like MySpace or LinkedIn.

I'm well aware of "more is different" aka the dialectic transform of quantity in quality. Lots of data that in individually innocent can be problematic if somebody amasses it. But especially for this reason I think it is not good to have these kind of semi-public spaces where the data is public and the only protection is it is cumbersome to collect. Public data should be clearly public, and private data should be clearly private, and the UX should be really clear so people know what is happening.

(By the way, I'm not even sure CA was a "scandal" or that it was bad for FB. I think the only effect was that FB used it to justify locking down their API more.)

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by squeaky-clean on Saturday August 21, 2021 @01:39AM (#28254517)
I had an economist friend of mine suggest this a few years ago in a conversation (I don't think it was a novel idea of his, it's just the first time I heard it). At the time I thought it was ridiculous and disagreed. But I've really started to come around to liking the idea over time.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by kapp_in_life on Friday August 20, 2021 @06:54PM (#28252314)
That's pretty silly. Should I be able to use Amazon APIs to host reviews for my competing ecommerce site? Or be able to proxy user search requests to google and then intersperse my own advertisements in the results for my web search service?
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by strgcmc on Friday August 20, 2021 @07:47PM (#28252675)
I'm not the person you're responding to, but I would say unequivocally and unironically, yes! The end result is more competition, lower prices, and more options for the end consumer. Sure the raw idea of this mechanism is a little naive and could be refined, but the outcomes you paint sound totally reasonable to me... think of this as a creative way to apply a new kind of tax to the criminally undertaxed big tech behemoths like Amazon and Google.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by warkdarrior on Friday August 20, 2021 @10:58PM (#28253726)
If you come up with a cool service on top of Amazon's API, should Amazon be allowed to use your APIs to scrape your service data and use it in their offering?
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by squeaky-clean on Saturday August 21, 2021 @01:36AM (#28254502)
If you get above <threshold> users, sure why not? It doesn't have to be free, maybe some sort of auditing service could determine a "fair" price. But it would be open without the possibility of shutting it down in the future unless maybe Amazon themselves ditches that API internally.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by kapp_in_life on Friday August 20, 2021 @08:44PM (#28253019)
You are allowed to do that(as far as I understand scraping legality), but google/amazon/facebook are also well within their rights to blacklist your IPs, or implement other methods to prevent scraping of their IP(intellectual property in this case).
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by fieldcny on Friday August 20, 2021 @07:52PM (#28252700)
If it’s so I can access my own data then yes is should be able to.

Google isn’t remotely comparable, and I believe Amazon has APIs for their store fronts / merchants (still can’t access reviews you leave)

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by captainmuon on Saturday August 21, 2021 @03:55AM (#28255081)
Amazon is infrastructure at this point. Everybody should have access to it. Jeff Bezos won capitalism, give him a medal and let him explore space.

Why do we treat government services and certain large private services separately? Why are government publications public domain, private publications not? Why does free speach apply to the government, but not to corporations? Why can't we treat amazon like a utility?

I believe the difference is because in the past people fought for these concessions from the state. They decided for example it would be sensible that the government should not restrict free speach. And before, they decided not to take feudalism as a given but to democratically elect their government. I know I'm being a bit dramatic, but there's no reason people couldn't get together and demand these kind of concessions from powerful corporations, too. Access to Amazon's product API is really the least example of what would change.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by Accujack on Friday August 20, 2021 @08:52PM (#28253069)
I'm thinking Facebook should be subject to an anti-trust investigation and breakup.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by kleer001 on Friday August 20, 2021 @07:01PM (#28252362)
> governments rarely do what's convenient for customers

or what's in the long term best interest of their citizens let alone the rest of the world. Silly humans.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by cs2733 on Friday August 20, 2021 @04:14PM (#28250877)
Companies like Facebook are as big as Nation States.

Any positives that come out of this for the author are just a Facebook PR move. If they did care about users, their support system wouldn't be so anti-user.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by kbenson on Friday August 20, 2021 @04:46PM (#28251220)
It's trite at this point that someone will respond that the users aren't the customers, they're the product, but it's trite because it's often correct, and deserves to be said, so I guess I'll be the one to say it this time.

The sad thing is that this person actually is a customer because they bought a product and pay for things on it, but Facebook still doesn't realize that, or more likely these customers are such a small amount of their revenue they just don't care (and don't think it matters for growth of this area or don't care about that growth).

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by ballenf on Friday August 20, 2021 @05:29PM (#28251625)
> this person actually is a customer

That's the reason the "you're not the customer" line is just a distraction.

It totally misses the point that Facebook doesn't have customers any more than any other first world power has. Facebook has treaties with governments and follow laws when it's less costly than breaking them.

FTC actions are like one country taking another to the WTO -- not something to ignore, but not really threatening either.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by kbenson on Friday August 20, 2021 @08:45PM (#28253021)
> That's the reason the "you're not the customer" line is just a distraction.

I don't think it is. If Facebook wasn't coming from a place such as that, then we wouldn't necessarily see them act like this. It's not just about size.

> Facebook has treaties with governments and follow laws when it's less costly than breaking them.

So do most large companies, but they don't all act the same to their customers. Apple may be guilty of other ways of mistreating their customers, but to my knowledge they're mostly innocent of this specific brand of it, and anything you want to attribute to Facebook's size that you can't attribute to any of the other tech big 5[1] should be examined for whether that's really the relevant underlying cause.

1: https://www.fastcompany.com/90651160/facebook-is-now-the-fif...

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by novok on Friday August 20, 2021 @08:11PM (#28252816)
The guy is a customer in the traditional FB way (pays for ads) and the new oculus way (buys oculus games & hardware).

FB is super annoying when you want to separate the business from any form of a personal account. Eventually you need to have some sort of personal FB account linked to a business to manage some key ad buy things AFAIK, at the small business scale at the very least.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by shkkmo on Friday August 20, 2021 @05:57PM (#28251868)
The problem is that "if you aren't a customer you are the product" is that frequently you are still a product even if you are a customer.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by potatolicious on Friday August 20, 2021 @04:24PM (#28250983)
> And Facebook refuses so much as to pick up the phone to discuss it.

It's part of the business model - each FB user generates so little revenue for the company that you can't afford to offer anything resembling "real" support channels. The company is massively profitable by sheer scale - by making a small amount of money per year off of a vast number of users.

This applies to Google as well - or really any ad-based engagement-centric business. Your individual users aren't worth enough to have human-intensive labor assigned to them, hence heavily automated support channels and little to no ability to ever have something processed by a human.

One of many reasons I pay Google to host my email rather than use a free Gmail - when you are generating a non-negligible revenue stream suddenly companies' willingness to answer emails and pick up phones increases.

When it comes to FB there's often the pithy "when you're not paying for a service you're not the customer, you're the product" - which is a simplistic take. In this case though at the very least this is true: "when you're not paying for a service your support needs are dead weight".

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by xondono on Friday August 20, 2021 @05:53PM (#28251835)
> One of many reasons I pay Google to host my email rather than use a free Gmail - when you are generating a non-negligible revenue stream suddenly companies' willingness to answer emails and pick up phones increases.

If you think that does any difference, I hope you good luck. Google is unreachable for support, even if you are a paying user.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by IntelMiner on Friday August 20, 2021 @11:04PM (#28253761)
As the Terraria developer showed with Google Stadia, even if you're actively developing software for their brand new products you'll be ignored
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by squeaky-clean on Saturday August 21, 2021 @01:47AM (#28254549)
I managed to get in touch with a Google engineer once for help with some Adwords API stuff (our company is a large adwords agency).

...They accidentally CC'd in a public mailing list into our discussion and leaked enough information that someone would be able to use the automated support system to change the company AdWords password. There was basically no way of contacting anyone further, the engineer couldn't contact anyone that could help us. We ended up making a new adwords account.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by cowturds on Saturday August 21, 2021 @02:42AM (#28254814)
I might as well been the engineer that reached out toward you. But in the end, I was let go as support is not earned any metric into performance.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by squeaky-clean on Monday August 23, 2021 @02:37PM (#28280106)
I did run into that engineer in-person at a Google event and grabbed a coffee with them. I think they're still at Google. No hard feelings but yeah getting any real support at Google is impossible and obviously not prioritized by the organization.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by cr3ative on Monday August 23, 2021 @08:14AM (#28274661)
I don't think that's true - Google One (which I subscribe to basically just to have a support fallback) offers this: https://one.google.com/about/support?hl=en_GB

"Live chat, email or call us".

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by milkytron on Friday August 20, 2021 @04:34PM (#28251093)
In this case though, the customer did buy a product, the Oculus Quest.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by novok on Friday August 20, 2021 @08:13PM (#28252828)
The guy is an ad buyer although, so they are still missing support for their traditional revenue streams for small customers. Even comcast gives you customer support if you only buy things for $20/month from them ;)
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by BbzzbB on Friday August 20, 2021 @09:14PM (#28253181)
~$30/user (on 3.5B users), not exactly small if you ask me. If you do a DCF on a $30/y coupon, even assuming it doesn't grow, you'll find that Facebook's (family of products) individual users are quite valuable.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by lookalike74 on Friday August 20, 2021 @04:44PM (#28251192)
I got Google One just for the telephone customer service option. They weren't very helpful for my needs in particular, but I think most people would appreciate the phone option for the $2+ a month it cost.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by mavhc on Friday August 20, 2021 @04:38PM (#28251138)
Facebook revenue per US/Canada user per year ~$160
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by int_19h on Friday August 20, 2021 @10:18PM (#28253498)
This is exactly why the anti-trust sledgehammer is desperately overdue for them.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by jokoon on Friday August 20, 2021 @04:04PM (#28250770)
I think they are at a point where they would rather side with a scammer since they generate more money from this situation.

I guess they have data that shows this particular kind of user will almost never buy ads ever again, so at least let a scammer do it.

You're right, this is weird, but if you look at the profit model, it makes sense, and there are no laws that would really protect the user.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by OneLeggedCat on Friday August 20, 2021 @06:54PM (#28252308)
Exactly. From the article, "Personally, I think it’s very telling that Facebook acts so swiftly to block out the original user who can stop an ad scam, and so slowly to stop a scam ad that they can still bill for."
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by jokethrowaway on Friday August 20, 2021 @04:20PM (#28250943)
Those transactions are likely to be reversed thanks to the practically unlimited chargebacks practice which is rampant in our banking system.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by nijave on Friday August 20, 2021 @06:42PM (#28252213)
Sure but then the question is "Should we leave an account with history of compromise in place that will lead to chargebacks or should we just permanently disable it"
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by shortstuffsushi on Friday August 20, 2021 @04:16PM (#28250890)
This is largely my thought too. This exact story we've seen repeated how many times now? What is the outcome? It seems the users are left in the lurch, having lost access to their accounts and any associated resources without any recourse, and that's that. The end. What will it take to have them create some mechanism for recovery?
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by lotsofpulp on Friday August 20, 2021 @04:32PM (#28251061)
>What will it take to have them create some mechanism for recovery?

People valuing it sufficiently to choose an alternative (and most likely paying for an alternative) over the benefits of free access to an established network.

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by pjc50 on Friday August 20, 2021 @04:31PM (#28251052)
Leaving aside the fact that they are profitable because of the zero cost service, like Ryanair, we should consider how many businesses only have the standard they do because of consumer action through the media.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by stjohnswarts on Friday August 20, 2021 @09:26PM (#28253236)
Facebook likes to cut down on costs by using an AI excuse to say "hey we help customers" but they don't really. If they hired enough humans to handle all the complaints/reports they get then their profit would plummet off the edge of a cliff. If this is the future of AI customer service give me those underpaid offshore services any day. At least the being laughing at me on the other end is still a human.