Facebook says millions had phone numbers, search history and location stolen(washingtonpost.com)
washingtonpost.com
Facebook says millions had phone numbers, search history and location stolen
https://www.washingtonpost.com/technology/2018/10/12/facebook-says-fewer-users-were-affected-by-data-breach-more-information-was-taken
43 comments
Is this the search history that appears in the activity tab? So, if you keep that clear, nothing could have leaked, right?
Are all these the same hack? I’m losing track.
Good thing I never gave them my phone
And that I got tracking and location blockers specifically for fb
And that I got tracking and location blockers specifically for fb
[deleted]
> User messages could have been exposed in one specific use case, officials said. If an affected user had been the administrator of a Facebook page, and the page had received a message from another user, that message may have been compromised, Facebook said.
Isn't this a common use case? Are we administrator to our own FB account?
Isn't this a common use case? Are we administrator to our own FB account?
A Facebook page is different from a Facebook profile in the way it's presented so most likely the messages are made available through different mechanisms. I guess they are suggesting the particular hack didn't directly give the attackers full access to the users' profile pages (including messages) but when it comes to Facebook pages the messages are directly exposed.
With FB and Google getting free passes (as in no penalty that hurts) after this kind of incident I don't see them doing much else beyond the minimal diligence.
With FB and Google getting free passes (as in no penalty that hurts) after this kind of incident I don't see them doing much else beyond the minimal diligence.
All the time. I often get vendor support through Facebook because there’s no hold time.
Emails go into the ether with lots of vendors.
the vendor cares more about people that could bash them to all their friends without typing a new URL.
Recent examples: i’ve Dealt with an airline and a post service over Facebook messenger, complete with ticket information, name, phone numbers and addresses.
Emails go into the ether with lots of vendors.
the vendor cares more about people that could bash them to all their friends without typing a new URL.
Recent examples: i’ve Dealt with an airline and a post service over Facebook messenger, complete with ticket information, name, phone numbers and addresses.
More Facebook user data leaked or "stolen"? Must be a Monday.
Here we go... the slow trickle of them saying every few days that the data breach is MUCH worse than what they had said days ago. Boil the frog.
1 month from now, compare what they've said to what they said this week.
1 month from now, compare what they've said to what they said this week.
Among other interesting things, this was initially sold as an attack that enabled 'View As' for attackers who shouldn't have had access to it. It's been described like another issue in the same vein as Cambridge Analytica and Google+.
I don't doubt that setting was involved, but it's obvious by now that this wasn't equivalent to the others - there's no "View As" which will show you someone's search and location history. This isn't just a public/private breakdown but an actual breach of Facebook's internal-only data, and unlike the prior stories this ought to seriously challenge people's reliance on features like Facebook-based app sign-ins.
I don't doubt that setting was involved, but it's obvious by now that this wasn't equivalent to the others - there's no "View As" which will show you someone's search and location history. This isn't just a public/private breakdown but an actual breach of Facebook's internal-only data, and unlike the prior stories this ought to seriously challenge people's reliance on features like Facebook-based app sign-ins.
> there's no "View As" which will show you someone's search and location history
Not in the UI, no. But once you have the token, which is what this was, then you can request that from many of the UI API interfaces facebook provides.
When this first leaked, anyone who worked with auth systems immediately assumed it was a game over scenario.
Not in the UI, no. But once you have the token, which is what this was, then you can request that from many of the UI API interfaces facebook provides.
When this first leaked, anyone who worked with auth systems immediately assumed it was a game over scenario.
Interesting, thanks.
I had only followed general-consumption reports here, and hadn't seen that the attack involved obtaining a token that allowed the attacker to authenticate as the user, and I didn't realize that the API included support for pulling search history data. Given that, I understand much better why this was a disaster from the beginning, and why people are so mistrustful of the rolling "and also this..." disclosures.
I had only followed general-consumption reports here, and hadn't seen that the attack involved obtaining a token that allowed the attacker to authenticate as the user, and I didn't realize that the API included support for pulling search history data. Given that, I understand much better why this was a disaster from the beginning, and why people are so mistrustful of the rolling "and also this..." disclosures.
I’m not sure this is entirely true. The hack was reported to have exploited a flaw in the View As feature to retrieve user access tokens. With an access token, a user can view their own location history. This isn’t internal-only data, but it is supposed to be private to the user.
Except they're going backwards this time.
First they said, "exposure of information from nearly 50 million of its users" and now it's "directly affected 29 million people on the social network".
John Gruber claimed the same thing a couple weeks ago:
https://daringfireball.net/linked/2018/09/28/facebook-hack
Surprisingly quiet this time since it doesn't fit the narrative he wanted.
First they said, "exposure of information from nearly 50 million of its users" and now it's "directly affected 29 million people on the social network".
John Gruber claimed the same thing a couple weeks ago:
https://daringfireball.net/linked/2018/09/28/facebook-hack
Surprisingly quiet this time since it doesn't fit the narrative he wanted.
It’s a cumulative thing.
Each time you load the page, it’s a separate publication about a different 50 million /s.
Each time you load the page, it’s a separate publication about a different 50 million /s.
You’re joking, but I came here to ask “which breach is this one referring to”, and was going to suggest assigning them each a serial number. It’s just getting too hard to track, and FB sure isn’t going to go out of its way to make the numbers comprehensible.
Great that Facebook stores these things, otherwise it could not have been stolen.
People put their phone number and location on Facebook for public display. It seems hard to blame Facebook for storing them.
Seems pretty easy to blame them to me.
...and what about search history? I don't use Facebook but do people also put their search history on display there?
I imagine search history data is used to facilitate and optimize repeat searches, e.g. repeatedly looking up your secret crush or exes.
It does actually... there used to be a way to pull out what people facebook "ranked" highest for you above others. That's why search isn't always alphabetical when you use it, it sorts the list by a preference score they generate based on how you interact with profiles
The search box in the UI is populated with your last dozen-or-so searches. You can access that data about yourself, so presumably if someone has the ability to "view as" you, they can see it.
This isn’t just public phone numbers. This is also private numbers that should have only been used for 2FA. (If that wasn’t bad enough already...)
Well, Facebook also has to store those, in order for 2FA to work. The point is, Facebook collected all of the data that was leaked for legitimate purposes, and the OP who implied they should just not have collected it is wrong.
Facebook should have also designed their auth system more carefully, but that's a separate issue.
Facebook should have also designed their auth system more carefully, but that's a separate issue.
> Facebook should have also designed their auth system more carefully, but that's a separate issue.
It's not a separate issue, though. One of the main ways they could have been more careful in designing their auth system was by choosing mechanisms that didn't create "legitimate purposes" for additional data collection in the first place.
This is a recurring theme in every data breach story that comes up. Every thread has someone correctly making the point that the company's business model requires them to store the leaked data, but this is not an excuse. Pick a more ethical business model.
It's not a separate issue, though. One of the main ways they could have been more careful in designing their auth system was by choosing mechanisms that didn't create "legitimate purposes" for additional data collection in the first place.
This is a recurring theme in every data breach story that comes up. Every thread has someone correctly making the point that the company's business model requires them to store the leaked data, but this is not an excuse. Pick a more ethical business model.
> Every thread has someone correctly making the point that the company's business model requires them to store the leaked data, but this is not an excuse. Pick a more ethical business model.
The two points in this thread are:
- The company's customers specifically demand that the company store the leaked data, and they personally provide it in the expectation that it will be (1) stored and (2) released to other users.
- You can't send 2FA codes to a phone number without knowing that phone number.
What would a "more ethical business model" do to address either of those points?
The two points in this thread are:
- The company's customers specifically demand that the company store the leaked data, and they personally provide it in the expectation that it will be (1) stored and (2) released to other users.
- You can't send 2FA codes to a phone number without knowing that phone number.
What would a "more ethical business model" do to address either of those points?
As to the first point, the headline is "Facebook says millions had phone numbers, search history and location stolen". 2FA phone numbers have to be stored, but they should _never_ under _any_ circumstances be released to other users. Search histories, too, are useful to the user that generated them but shouldn't ever need to be exposed to third parties. Location data can be transient or short lived and still meet most of the technical requirements for the customer-facing features that use them, so I'm not sure there's a good rationale to permanently store it in the first place.
And for where better professional ethics could have made a difference, let's walk backwards through the decision tree for 2FA:
* The implementer of this feature could have used the profile phone #, and the copy could have made it clear that the feature required a phone number on the profile to function.
* The implementer could have chosen to treat the phone number as secure authentication data and taken pains to store it in a manner that was opaque to the rest of the application, say encrypted at rest with a key that's only available inside the auth subsystem.
* The designer of this feature could have insisted on using an authentication app instead of SMS.
* The designer of the authentication workflow could have supported oAuth logins through a third party with good 2FA support, reducing demand for Facebook to support 2FA internally.
* New accounts could spawn with the most restrictive permission settings and require users to affirmatively opt-in to sharing everything they want to, lowering the damage to the median user from an account being compromised and thereby also reducing customer demand for Facebook to support 2FA.
* Facebook could have chosen, early and often, to push for open integration with third parties, building a market segment where they were only one social networking portal among many and no single company had anything close to a complete social graph. In such a world 2FA for Facebook accounts might seem no more urgent than 2FA for, say, Hacker News accounts.
The common thread, at all levels, is that Facebook consistently prioritizes growing faster, collecting more data, and becoming more central to the functioning of the internet over what I would feel comfortable describing as the user's best interests.
I run a website with a few tens of thousands of user records, which means I have been entrusted as a secret keeper for some amount of private information by tens of thousands of people. That's a very tangible burden on me, a weight of responsibility that as part of my job I have to carry. It's also a liability for my employer in the event of a data breach. That means our incentive structure pushes us to store as little data as we can get away with and to expose that data to our infrastructure in the most technically restrictive manner we can get away with.
Facebook chose to build a business around treating other people's secrets as an asset, rather than a liability. That incentivizes them to hoard data and to be cavalier about how they capitalize on it, and lo and behold they routinely behave in accordance with those incentives. When I say a "more ethical business model", this is what I mean. An ethical business is, in practice, one where the incentives of the company and the incentives of its users are not in fundamental tension with one another.
And for where better professional ethics could have made a difference, let's walk backwards through the decision tree for 2FA:
* The implementer of this feature could have used the profile phone #, and the copy could have made it clear that the feature required a phone number on the profile to function.
* The implementer could have chosen to treat the phone number as secure authentication data and taken pains to store it in a manner that was opaque to the rest of the application, say encrypted at rest with a key that's only available inside the auth subsystem.
* The designer of this feature could have insisted on using an authentication app instead of SMS.
* The designer of the authentication workflow could have supported oAuth logins through a third party with good 2FA support, reducing demand for Facebook to support 2FA internally.
* New accounts could spawn with the most restrictive permission settings and require users to affirmatively opt-in to sharing everything they want to, lowering the damage to the median user from an account being compromised and thereby also reducing customer demand for Facebook to support 2FA.
* Facebook could have chosen, early and often, to push for open integration with third parties, building a market segment where they were only one social networking portal among many and no single company had anything close to a complete social graph. In such a world 2FA for Facebook accounts might seem no more urgent than 2FA for, say, Hacker News accounts.
The common thread, at all levels, is that Facebook consistently prioritizes growing faster, collecting more data, and becoming more central to the functioning of the internet over what I would feel comfortable describing as the user's best interests.
I run a website with a few tens of thousands of user records, which means I have been entrusted as a secret keeper for some amount of private information by tens of thousands of people. That's a very tangible burden on me, a weight of responsibility that as part of my job I have to carry. It's also a liability for my employer in the event of a data breach. That means our incentive structure pushes us to store as little data as we can get away with and to expose that data to our infrastructure in the most technically restrictive manner we can get away with.
Facebook chose to build a business around treating other people's secrets as an asset, rather than a liability. That incentivizes them to hoard data and to be cavalier about how they capitalize on it, and lo and behold they routinely behave in accordance with those incentives. When I say a "more ethical business model", this is what I mean. An ethical business is, in practice, one where the incentives of the company and the incentives of its users are not in fundamental tension with one another.
New accounts do spawn with the most restrictive settings possible -- they cannot disclose any of your information because they don't have it. You must already affirmatively opt in to Facebook displaying any part of your profile.
Why is it that all of the times Facebook claims a "hack" it's really Facebook giving away or selling user data via an API, getting caught and than claiming it as a "hack" to avoid responsibility?
This story looks like the exception, though?
The app piggybacking and the initial "View As" stories constituted Facebook handing out data sloppily. But location records, search history, and TFA-only phone numbers are internally held data Facebook wasn't showing to anyone. This moves things from "faulty visibility settings" and "shady data sales", which we've seen before, to "outright security breach".
The app piggybacking and the initial "View As" stories constituted Facebook handing out data sloppily. But location records, search history, and TFA-only phone numbers are internally held data Facebook wasn't showing to anyone. This moves things from "faulty visibility settings" and "shady data sales", which we've seen before, to "outright security breach".
Recent search history is accessible in the UI when you click on the search box. Assuming someone could see "what FB looks like from your perspective", they'd be able to access the last dozen-or-so searches.
I think you answered your own question. They wish to avoid responsibility.
Where does FB say it sells your data? Was there a news article about it?
I see this repeated about other tech companies as well but I can never find where they say they sell my data. It seems weird companies would sell their most valuable asset, rendering themselves moot.
My understanding is these companies allow advertisers to target users, but never sell the data.
I see this repeated about other tech companies as well but I can never find where they say they sell my data. It seems weird companies would sell their most valuable asset, rendering themselves moot.
My understanding is these companies allow advertisers to target users, but never sell the data.
search history is the most problematic, IMO, shows intent. But combine all three and you have a problem.
I think we need a new internet rule /law:
if it's online, it will hacked /stolen soon or later.
So they should not save most of the stuff.
I think we need a new internet rule /law:
if it's online, it will hacked /stolen soon or later.
So they should not save most of the stuff.
Isn’t that what GDPR aims to do?
[deleted]
Hmm, Facebook has said that I was not included in this latest data breach, but on the other hand, the amount of spam that I've received in the email address that Facebook knows about has skyrocketed in the last few days... Correlation doesn't necessarily imply causation, and there's a million and one ways that spammers could get that address, but it certainly is curious.
Looks like the first huge GDPR fine the EU will be able to get.
Imagine if "page views" of your friends profiles were leaked...
LOL Then we could no longer pretend that Facebook doesn't still exist because of e-stalking unrequited loves and exes.