Hacker News Reader

Comment by TheDong | Hacker News Reader

One thing that may have prevented this hacking: facebook could have noticed that the primary email for the user was for an expired domain, and proactively notified them to remove it.

When a domain expires, there's a grace period, and just checking daily whether a user's email's domain is expired, and if so texting them or otherwise notifying them to change the email, would have been sufficient.

This wouldn't even require _that_ many checks since the total number of unique domains to check is probably low. 99% of all users will be on gmail/outlook/yahoo/etc, and all users using the same domain only require a single check a day for the domain not having lapsed.

View on HN

The whois check for a domain literally contains when it will expire. You can do this one time (combined with an MX lookup) while the email is added.

And knowing the ASN of a domain is also quite helpful. If anything changes (e.g. geolocation of ASN or different domain registrar) you can easily force the user to confirm this while they are already logged in.

Source: I am doing this for my tholian.network products.

> The whois check for a domain literally contains when it will expire. You can do this one time (combined with an MX lookup) while the email is added.

That’s not reliable. A domain can be deleted before expiration.

Sure, but that is usually by the request of the owner, if I'm not mistaken?

Better cover most of the cases than none.

All I’m saying is if you’re building such a system you should be aware of this and possibly account for it with some low frequency scanning before listed expiry. Or not, if you decide it’s not worthwhile.

Fair enough.

Could also be renewed

Alternatively you could do a whois query of the domain (and verify against cached details) before sending out the recovery email. It's probably best to do that every time the email addresses are changed or updated.

Note that some WHOIS servers (as in port 43) are hostile to automation and might block you if you’re doing it too much, although you could be paying a few cent per custom domain per month to have a service perform the data aggregation for you.

Agree, most ToS of WHOIS servers say they don't want automated queries.

In this case I think it'd be simpler to just do a DNS check, either NS alone or A/MX. Scales better. If NXDOMAIN is returned over a period of days then the domain can be flagged.

How many accounts per year do you think are hacked this way? How many accounts per year do you think are hacked in other ways? Facebook has a finite amount of engineering effort, and the effort they put in to stopping hacks probably goes toward things they expect will prevent a large amount of hacks.

I’m sorry. Meta has a finite amount of engineering? The profit margins are so thin that there is no possibility of improving service for users? That everyone is fully dedicated to new development that support for existing products can’t be spared? That Zuckerberg is so fearful of his board that he is afraid of being forced out if he lets up on the gas for just 1 sec?

Or is it that they just don’t care?

>The profit margins are so thin that there is no possibility of improving service for users?

I'm saying that there are many ways of improving service for users. If we prioritize those ways, I doubt doing checks for expiring DNS would be near the top.

Based on experience, it does not seem like they prioritize ANY improvements in customer service. And until there is a credible threat of government action I doubt they ever will

Remember that most users are not customers here, they are inventory. A bit of breakage is expected.

The advertisers are the customers.

Yes, they don't care. Why would they? That user probably doesn't generate much revenue, and losing them won't cause any major scandal in the press or anything embarrassing to top FB managers. I can't see any motivation for them to care.

It's just an expenditure that won't produce any profit. The technical term for this is "waste."

The only way this would not be waste is if fixing it would do something to reduce the amount of ill will towards facebook which is quite intangible and unlikely to add up to covering the costs. But who knows what calculations are being made, or how they may change in the future.

She's a mom of 2 who recently is living in a new place. Things like this are always overlooked. Let's just cut her some slack. I am a parent too, I know how difficult kids are. On that note, maybe there is a chance if she contacted someone from LinkedIn who works in Meta.

>Let's just cut her some slack.

TheDong isn't suggesting something she could have done. TheDong is suggesting something Facebook could have done.

Thanks for pointing that out.

>One thing that may have prevented this hacking: facebook could have noticed that the primary email for the user was for an expired domain, and proactively notified them to remove it.

Almost any website, app or online activity that requires logging uses email based authentication. Do you think all existing web sites and apps should verify the expiration of mail domains? And what about phone numbers? A user can lose his phone number, should they verify that, too?

>Do you think all existing web sites and apps should verify the expiration of mail domains?

No - it probably wouldn't be worth it. But it could absolutely be worth it (weighing bad outcomes against amount of effort needed to prevent those outcomes) for the biggest sites with billions of users.

... especially when they won't otherwise offer recourse/support in case of rare events like this. Rare events become less rare when there are billions of users.

This should be a part of the process of ALL sites that use email/domain ownership as proof of identity. There are a lot of them besides Facebook.

Yeah, it's not currently possible for phone numbers, but that's not a reason for not doing it for domains where it is possible. It's also easy to imagine a privacy-respecting public registry for phone numbers, which only reported when the ownership had changed.

> facebook could have noticed that the primary email for the user was for an expired domain, and proactively notified them to remove it.

Or just wait at least a week before emailing a password reset PIN to secondary email addresses. I reported this exact vulnerability 4 years ago:

https://news.ycombinator.com/item?id=17835127

And every small website who offer email authentication should implement all of that that and more?

Reply on news.ycombinator.com