Hijacking a Facebook Account with SMS

Re:Hijacking a Facebook Account with SMS by nly on Wednesday June 26, 2013 @07:20PM (#5949763)

This is mindbogglingly bad. How did they manage to introduce a dependence on unauthenticated client-side state for such a critical operation in a relatively new feature?

If they weren't willing to hit the database to recall the profile_id for the reset operation, it makes me wonder whether the confirmation codes are in fact deterministic, rather than randomly generated.

[ Parent | on HN ]

Re:Hijacking a Facebook Account with SMS by GuiA on Wednesday June 26, 2013 @07:42PM (#5949840)

Probably some old code that was written in haste back in the day, and that never got touched because it got the job done.

[ Parent | on HN ]

Re:Hijacking a Facebook Account with SMS by zeckalpha on Wednesday June 26, 2013 @09:22PM (#5950145)

Sounds like Facebook.

[ Parent | on HN ]

Re:Hijacking a Facebook Account with SMS by wikwocket on Wednesday June 26, 2013 @10:21PM (#5950384)

Are you kidding? Sounds like every company everywhere.

[ Parent | on HN ]

Re:Hijacking a Facebook Account with SMS by hobs on Wednesday June 26, 2013 @11:14PM (#5950551)

Yuuuuup. People think FB is free of these problems because they have written some highly performant code and have a shit ton of money. Nope, money doesnt cure laziness and definitely doesnt cure "it works so why fix it".

[ Parent | on HN ]

Re:Hijacking a Facebook Account with SMS by chrismarlow9 on Wednesday June 26, 2013 @11:42PM (#5950633)

Pretty much, it's expected when you're small for security to take a backseat to convenience. However, when you reach the point of billions of users, every line of code should be reviewed and there's no excuse for something this simple to slip by.

[ Parent | on HN ]

Re:Hijacking a Facebook Account with SMS by prostoalex on Thursday June 27, 2013 @01:34PM (#5953549)

Confirmation by SMS is not a relatively new feature.

[ Parent | on HN ]