• HiddenLayer555@lemmy.ml
    link
    fedilink
    English
    arrow-up
    30
    arrow-down
    1
    ·
    2 months ago

    Does anyone remember an article/interview a while back where Mark Fuckerberg shamelessly admitted that he chose not to hash passwords in the original Facebook codebase specifically because he wanted to be able to log into his users’ other accounts that use the same password? I swear I remember reading something like this but now I can’t find it.

    • delirious_owl@discuss.online
      link
      fedilink
      arrow-up
      7
      arrow-down
      4
      ·
      edit-2
      2 months ago

      Usually these services have god mode where they can see a UI from a given user. They don’t need the password.

      This sounds like a rumor spread by someone who doesn’t understand tech

      • FrederikNJS@lemm.ee
        link
        fedilink
        arrow-up
        9
        ·
        edit-2
        2 months ago

        The OP made the argument that Zuckerberg wanted to know their passwords, such that if the users reused the same passwords elsewhere, then he would be able to log in there and check out their accounts.

        For example he could have seen a profile he was interested in, nabbed their password and looked into their email.

        Not that he wouldn’t have godmode on their Facebook account, and needed their password to access their account, because of course he could have just accessed those accounts without needing the password.

        I have not heard this rumor before, though I wouldn’t be completely surprised if it was true.

        • delirious_owl@discuss.online
          link
          fedilink
          arrow-up
          2
          ·
          2 months ago

          Well, Facebook did have an auth method that involved promoting you for your password so that they could log into your email and get an OTP iirc

          It wasn’t zuckerberg doing something in secret. It was an explicit protocol that was terrible. They got called out and stopped it. Kinda like early days of open graph.

  • fl42v@lemmy.ml
    link
    fedilink
    arrow-up
    28
    arrow-down
    1
    ·
    2 months ago

    instead of in an encrypted format on its internal systems.

    Riiight, like that’s any better. Jokes aside, it’s hard to imagine what kind of “mistake” results in storing plain text instead of hashing, unless the mistake was in choosing whoever made the security assessment

    • masterspace@lemmy.ca
      link
      fedilink
      English
      arrow-up
      19
      ·
      2 months ago

      There was a previous article on this with more explanation that I’m struggling to find.

      The gist was that they do hash all passwords stored, the problem was that there was a mistake made with the internal tool they use to do that hashing which led to the passwords inadvertently going into some log system.

      • BearOfaTime@lemm.ee
        link
        fedilink
        arrow-up
        5
        arrow-down
        6
        ·
        2 months ago

        “mistake”

        I call BS. The reviews I’ve gone through for trivial stuff would’ve exposed this.

        This was intentional.

        • HiddenLayer555@lemmy.ml
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          2
          ·
          2 months ago

          Hanlon’s Razor revised: Never attribute to malice what can be attributed to incompetence, except where there is an established pattern of malice.

          • BearOfaTime@lemm.ee
            link
            fedilink
            arrow-up
            1
            ·
            2 months ago

            Then incompetence at a level that’s incomprehensible.

            A code review certainly exposed this, and some manager signed off on the risk.

            Again, changes I make are trivial in comparison, and our code/risk reviews would’ve exposed this in no time.

        • masterspace@lemmy.ca
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          1
          ·
          2 months ago

          Yeah, cause trivial systems are a lot easier to parse and review. At a base level that’s nonsense logic.

          • BearOfaTime@lemm.ee
            link
            fedilink
            arrow-up
            1
            arrow-down
            1
            ·
            2 months ago

            My point being the extensiveness of a review process.

            The more important a system, the more people it impacts, etc, the more extensive the review process.

            Someone chose to ignore this risk. That’s intentional.

            • masterspace@lemmy.ca
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 months ago

              You quite frankly, don’t know what happened and if you’re confident it’s intentional, all that says is that you’re a grump who likes to complain.

          • BearOfaTime@lemm.ee
            link
            fedilink
            arrow-up
            1
            ·
            2 months ago

            I generally agree.

            But any decent code review process would’ve exposed this, or at least a data surveillance system that checks this stuff. I’ve received a few notifications about my logs storing inappropriate data, as a result of a scanning system.

            Some manager knew about this during a code review, and signed off on the risk because it was only in-house.

  • cron@feddit.org
    link
    fedilink
    arrow-up
    13
    ·
    2 months ago

    This is not about facebook not hashing credentials, it is that they appeared in internal logs.

    Facebook is probing a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers.

    Source: Krebs on Security

    • HiddenLayer555@lemmy.ml
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      2
      ·
      2 months ago

      that logged unencrypted password data

      Why the fuck would you need to log a password ever? This is absolutely malice and not incompetence.

      • bjorney@lemmy.ca
        link
        fedilink
        arrow-up
        8
        ·
        2 months ago

        You are acting like someone checked off a “log passwords” box, as if that’s a thing that even exists

        Someone configured a logger to write HTTP bodies and headers, not realizing they needed to build a custom handler to iterate through every body and header anonymizing any fields that may plausibly contain sensitive information. It’s something that literally every dev has done at some point before they knew better.

        • HiddenLayer555@lemmy.ml
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          1
          ·
          edit-2
          2 months ago

          It’s something that literally every dev has done at some point before they knew better.

          If you’re working for a multinational tech company handling sensitive user data and still make this mistake, then you are being malicious in your incompetence. This is something that would cause you to lose a significant amount of marks on a first year college programming project, let alone a production system used by literally billions of people.

        • Possibly linux@lemmy.zip
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          3
          ·
          2 months ago

          You should never be sending passwords to a server. That is really bad practice. The right answer is to use cryptography to verify the client knows the password.

          • bjorney@lemmy.ca
            link
            fedilink
            arrow-up
            2
            ·
            2 months ago

            Client side verification is just security by obscurity, which gains you very little.

            If someone is capable of MITM attacking a user and fetching a password mid-transit to the server over HTTPS, they are surely capable of popping open devtools and reverse engineering your cryptographic code to either a) uncover the original password, or b) just using the encrypted credentials directly to authenticate with your server without ever having known the password in the first place

            • Possibly linux@lemmy.zip
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 months ago

              That assumes that an adversary has control of the browser. The big reason you don’t want to send passwords over https is that some organizations have custom certs setup. It is better to just not send the password at all.

              • bjorney@lemmy.ca
                link
                fedilink
                arrow-up
                1
                ·
                2 months ago

                That assumes that an adversary has control of the browser

                No it doesn’t, if they intercept an encrypted password over HTTPS they can resend the request from their own browser to get access to your account

                The big reason you don’t want to send passwords over https is that some organizations have custom certs setup

                What is the problem with that? The password is secure and only shared between you and the site you are intending to communicate with. Even if you sent an encrypted password, they wrote the client side code used to generate it, so they can revert it back to its plaintext state server side anyways

                It is better to just not send the password at all.

                How would you verify it then?

                If not sending plaintext passwords was best practice then why do no sites follow this? You are literally posting to a site (Lemmy) that sends plaintext passwords in its request bodies to log-in

      • cron@feddit.org
        link
        fedilink
        arrow-up
        5
        ·
        edit-2
        2 months ago

        Just one open source example … freeradius has an option to log passwords:

        log {
            destination = files
            auth = no
            auth_badpass = no
            auth_goodpass = no
        }
        

        Or another example: The apache web server has a module that dumps all POST data, with passwords, in plain text:

        mod_dumpio allows for the logging of all input received by Apache and/or all output sent by Apache to be logged (dumped) to the error.log file. The data logging is done right after SSL decoding (for input) and right before SSL encoding (for output). As can be expected, this can produce extreme volumes of data, and should only be used when debugging problems.

        I don’t agree that this is “absolutely malice”, it could also be stupidity and forgetfulness.

    • sqgl@beehaw.orgOP
      link
      fedilink
      arrow-up
      4
      ·
      2 months ago

      I think it is just Ireland though (which is why I added Ireland to the title).

    • onlooker@lemmy.ml
      link
      fedilink
      arrow-up
      3
      ·
      2 months ago

      Seriously. Didn’t they make billions last year? That number should be much, much higher for Zuck & Co. to actually start giving a fuck.

    • FrederikNJS@lemm.ee
      link
      fedilink
      arrow-up
      3
      ·
      2 months ago

      The author of the article is clearly just confusing “encryption”, “cryptography” and “hashing”. Reading the full article makes it clear that the intention was to salt and hash the passwords, not encrypting them.