Slashdot Mirror
How Facebook Responded To Tunisian Hacks
jamie writes "Facebook's security team opens up, shedding light on a revolution that could become a parable for Internet activism. Quoting: 'After more than ten days of intensive investigation and study, Facebook's security team realized something very, very bad was going on. The country's Internet service providers were running a malicious piece of code that was recording users' login information when they went to sites like Facebook. By January 5, it was clear that an entire country's worth of passwords were in the process of being stolen right in the midst of the greatest political upheaval in two decades. Sullivan and his team decided they needed a country-level solution — and fast. Though Sullivan said Facebook has encountered a wide variety of security problems and been involved in various political situations, they'd never seen anything like what was happening in Tunisia.'"
Really is annoying that Facebook defaults to http
When Facebook does something right, they should be commended. They easily could have shrugged their shoulders and said, "Not our problem!"
Gamingmuseum.com: Give your 3D accelerator a rest.
Article Summary: They switched facebook to use https in Tunisia.
I wish facebook would consider just switching all traffic to https.
So Facebook's sales guy called the President of Tunisia and said "Dude, you have to pay for all that user data just like everyone else does. What makes you think you're special?"
I believe the ISP changed the facebook login page to execute additional javascript to grab the entered password before it was sent off, encrypted, to the fb server. But then again I didn't RTFA...
Facebook doesn't want anyone accessing their customers' personal information unless Facebook is being compensated.
#DeleteChrome
A valid point -- end-to-end encryption in both directions is required. Meaning the calls to always use https actually make sense.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Anyone who logged in during the period of time where passwords were being captured was presented with photos and asked to pick the ones featuring their friends. Then they were asked to choose a new password.
Once again, our friends at the EFF are ahead of the curve. Their HTTPS Everywhere extension, released a few months ago, probably would have beaten this attack by Tunisian security services, or at least made their jobs much harder.
Here's the extension: https://www.eff.org/https-everywhere
Work that donate button a little while you're there.
In theory, only one end needs to authenticate the other.
In practice, the website depends on the client to do a good job of this. So if you're running MS Windows, the Tunisan government can put a trusted root certificate in your computer with the endorsement of Microsoft. So even running https everywhere will not save Facebook from Microsoft.
Try it yourself. If you have access to a Windows machine, visit http://bit.ly/eWYRbA in IE then check your personal cert store for Agence Nationale de Certification Electronique.
If you think this is a big deal, retweet it or spread the word in other ways. I'm at a loss to explain why people aren't realizing the magnitude of this.
Of course, what's even better is that it's a CODE SIGNING cert. ;-) Now that's what I call pwned!
Or just find a CA that is either sympathetic to your cause or subject to your coercion.
read and weep. A list this long and spread through so many different countries is not the way to run a tight ship security wise.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
FWIW, since Chrome on Windows re-uses some (maybe all?) of IE's networking layer, you can use Chrome instead of IE to reproduce this. There is a caveat - you need the "Update Root Certificates" program which was included in Windows XP SP2.
This page has a nice writeup of the problem and mentions that Vista or higher behave differently (not really better, just differently).