People seem to be angry with Zuckerberg and Facebook these days

#DumpFacebook … Suckerturd is hiring 11 more lobbyists and spent $3.3 Million in the first qtr to lobby Congress! Wake the hell up people! https://t.co/NzuVxqJ8VB

— Doug❌🇺🇸 (@Bootz_Adams) April 25, 2018

Video: What No One Is Telling You About Facebook. This Is The End For Zuckerberg!

I’m not a “white nationalist” but i am a “Canadian nationalist” who happens to be white. I can’t imagine why #Facebook is having so much trouble distinguishing between nationalism and supremacy, or how praising/loving one’s country could be confused with hate.#DumpFacebook pic.twitter.com/OrqqtlFm6Q

— Michele Patriot 🍁 #PPC2019 (@CanadianPatri15) March 28, 2019

If you’re still on Facebook you’re lazy and or ignorant. Pure and simple.

The only reason Facebook is soo f the little piddly shit it is doing is because Zuckerberg sees dwindling dollars.

He’s using you. #dumpfacebook

— Xultar (@Xultar) March 28, 2019

Here is a powerful, honest meme that shows why the powerful, globalist Zionists want to shut down non-violent free speech. Thousands of groups work proudly for their interests, and no group does it more than the Zionist advocates of the ISRAELI ETHNOSTATE ! Retweet IT! pic.twitter.com/olRQm4M2RN

— David Duke (@DrDavidDuke) March 28, 2019

Faceberg (((FaceBook))) has just announced it will ban all “white nationalist” posts, photos. Ethnic Nationalism is now forbidden, will Faceberg ban all sites supporting the ethnostate of Israel, and Jewish nationalist and “internationalist” orgs? https://t.co/o07N4GmzbE

— David Duke (@DrDavidDuke) March 27, 2019

Preface – Bill Owen – TechNewsBlog.net

A Zionist at Newsweek launched a broadside against me and for the Faceberg ban on White people daring to rationally and nonviolently defend their fundamental human rights, such as the survival of their heritage and rights in their own nations! pic.twitter.com/iUn3E3ROZe

— David Duke (@DrDavidDuke) March 28, 2019

Facebook declares no free speech for white people.

Consider how white nationalism is banned, whereas jewish nationalism (zionism) is not only praised and promoted, but any criticism of it will also get you banned for “anti-semitism.”

That is what real privilege looks like. pic.twitter.com/JDQE8dsyEE

— Will Westcott (@westland_will) March 27, 2019

Note: This preface is in no way a part of this article by Michael Heller. I wanted to note that I will definitely be submitting
a Commentary next week on Mark Zuckerberg, Chairman and CEB (Chief Executive Bozo) of Facebook, and other loose cannon corporate executives. Examples of free-wheeling approaches to business and privacy, seen in the technology sector, will be covered. Personal observations as well as links to some very enlightening and very good articles on the subject will be included. I have culled through and distilled down quite a bit of material, and the review should bring a lot of the varied information info focus. For the time being, see additional links at the bottom of this posting concerning recent Facebook “activities”.
________________________________________________________________________________________________
–Begin article by Michael Heller

Facebook learned three months ago that hundreds of millions of passwords were stored internally in plaintext, but it didn’t disclose the issue or notify users until the news leaked.

By Michael Heller, Senior Reporter – Tech Target   22 Mar 2019

Hundreds of millions of Facebook passwords were exposed within the company, sparking a debate among infosec experts over whether it was a simple mistake or an example of bad-faith actions by the company.

Facebook Thursday admitted that hundreds of millions of user passwords were stored in plaintext within the company’s network.

“As part of a routine security review in January, we found that some user passwords were being stored in a readable format within our internal data storage systems,” wrote Pedro Canahuati, vice president of engineering, security and privacy at Facebook, in a blog post. “To be clear, these passwords were never visible to anyone outside of Facebook and we have found no evidence to date that anyone internally abused or improperly accessed them. We estimate that we will notify hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users.”

The Facebook disclosure came on the heels of a report by infosec journalist Brian Krebs that said “between 200 million and 600 million Facebook users may have had their account passwords stored in plain text and searchable by more than 20,000 Facebook employees,” and, in some cases, the plaintext passwords were exposed as far back as 2012.

Some experts, like Troy Hunt, security researcher and founder of Have I Been Pwned, said there doesn’t appear to be much risk to users at this point.

“Frankly, without evidence of exposure of the captured passwords, the risk of this is low,” Hunt said via email. “Something else would have had to have gone badly wrong for this to have had any impact (i.e. captured data exposed to an unauthorised party).”

Alec Muffett, an infosec consultant and former Facebook software engineer, tweeted in defense of Facebook’s password security.

“Facebook’s password hashing is state of the art — as I presented on FB’s behalf at #Passwordcon in 2014 — so password security is taken EXTREMELY seriously, and this is clearly a goof,” Muffett tweeted. “Facebook do have frameworks, generally very-well-policed frameworks, for preventing sensitive stuff from being logged. The reported incident sounds bad & should clearly not have happened, so I am baselessly going to presume some failure-to-check in the logging mechanism.”

Others, like Joseph Perry, director of research at infosec training and development firm Cybrary, said we must consider the length of time the passwords were exposed and the scale of the problem.

“The passwords being stored in plaintext is absurd on an almost cosmic scale, but the real issue at hand is the fact that it took this long to discover. A database of millions of passwords is not a small thing,” Perry said. “This wasn’t some database admin who just screwed up a configuration and forgot about it. This data set existed for years without anyone raising red flags. Facebook’s security measures and internal controls are insufficient to prevent what is fundamentally a terrifying breach of trust.”

Rebecca Herold, CEO of Privacy Professor, said even internally exposed Facebook passwords are a significant problem, and that it is “an indicator that there could be some other significant security vulnerabilities within the Facebook environment.”

“Throughout the many risk assessments I’ve performed, wherever there were problems with the security of passwords, there were usually significant other security problems, as well,” Herold wrote in an email. “Facebook would be wise, if they are confident of their information security practices, to have an objective third party perform a risk assessment and communicate the overall results publicly. Otherwise, it seems they are trying to hide their security problems.”

Possible insider threats

Another point of debate surrounding the issue is the potential risk of an insider threat inappropriately using the plaintext Facebook passwords. Facebook hasn’t had any known insider threats in the past, but Perry noted that might not mean much.

“It’s true that Facebook has no serious history of insider threats; but on the other [hand], one of the reasons insider threat is such a danger is because it’s prohibitively difficult to detect,” Perry said. “That sounds tinfoil hat, but the entire point of defense in depth is to handle the fundamental fact that we simply can’t identify all potential threats. The lack of [an] identified insider threat doesn’t in any way discount the danger inherent to this access.”

Herold agreed, saying that “any organization with more than one employee has an internal threat issue,” and adding that the issue could extend beyond Facebook employees.

“Remember, they are a largely unregulated entity. They aren’t required to report when their own employees do bad things, unless it falls under the definitions of the various applicable breach notice laws, and other applicable laws, of which few are currently covering employees’ access to personal data,” Herold wrote.

“Actually, all those third parties that Facebook has notoriously given access to user profiles, accounts, posts, etc. is a type of insider threat. The threat of 1) lack of acceptable controls on their third parties, and 2) as business partners, those entities are insiders, who had extensive access to far more than they ever should.”

The timing of the Facebook disclosure

Making the situation more complex, Facebook admitted in its blog post that it first discovered the plaintext passwords “as part of a routine security review in January,” meaning the company knew about the exposure for three months before disclosing it. Additionally, Facebook said it “will be notifying everyone whose passwords we have found were stored in this way,” implying the company has not yet started notifying affected users.

Hunt said although it may not reflect well on Facebook, he understands the decision to not disclose or notify users right away.

“I can imagine why they perhaps didn’t think this was worth initially disclosing because there hasn’t been any impact to customers. On the other hand, it’s the sort of thing that if leaked would make them look rather foolish so with the benefit of hindsight, they probably should have gotten on the front foot with this like Twitter and GitHub did last year,” Hunt said. “Notifying all impacted users feels very much like one of those ‘abundance of caution’ things. If there was no actual impact on customers, I can understand why they may have chosen not to disclose, it’s just not particularly good optics, as they’d say.”

Herold said Facebook’s decision to not notify users was “disappointing, but not surprising.” The delay in Facebook’s disclosure was another example of the company “not making any security concerns public until they are forced to do so,” she said.

“If I was a shareholder, I’d be very concerned about the opaque manner in which Facebook communicates their cybersecurity practices,” Herold said. “If they have sat on knowing about this security risk for the past three months, then they certainly won’t rush to communicate more than they are compelled to do. And, since, from what has been reported, the cleartext passwords in storage does not meet the requirements for breach notifications for most (all?) breach notice laws, they are likely trying to decide how to communicate the information, with as little reputational impact as possible.”

Perry called this another example of Facebook’s “history of bad-faith and insufficient transparency.”

“The fact that they’ve concealed this breach for months is yet another straw on the back of an already broken camel,” Perry said. “This is yet another case of bad faith from a tech giant which relies upon functional monopoly in order to avoid legitimate consequences.”

–End article by Michael Heller
________________________________________________________________________________________________
Additional related Facebook articles to review prior to Commentary/articles being posted next week:

Facebook’s Arrogance Crisis: Can Mark Zuckerberg Claw Back Control? | Opinion (Submitted on April 11, 2018 by Alex Pentland and David Shrier the day after the Senate Commerce, Science and Transportation Committee and Senate Judiciary Committee joint hearing about Facebook on Capitol Hill, on April 10).

One from “Across the pond”:
Yes, Mark Zuckerberg Is a “Digital Gangster” Who Violates Your Privacy, but Here’s Why You Still Won’t Quit Facebook (Submitted on Feb 18, 2019 by Ben Brown)

 

________________________________________________________________________________________________ Preface – Bill Owen – TechNewsBlog.net Note: This preface is in no way a part of this ar…

Source: Hundreds of millions of Facebook passwords exposed internally | TechNewsBlog.net