Hacker News Reader

Comment by mpeg | Hacker News Reader

Wow that's terrible, I guess it means they stored their access tokens with no encryption.

Personally feeling slightly smug now, I actually applied for a job there not too long ago and got a half hearted rejection without any feedback (or the courage to actually reject me). I have direct experience in doing security for a Facebook SPMD - we never got successfully hacked, and yet we ran scenarios like this in our mind all the time.

View on HN

Maybe I am misunderstanding, but how is it possible to encrypt the access token? Doesn't the server need it in plaintext to make requests?

If the web server is making API calls, encryption could still protect you from some SQL injection attacks, even if the decryption key for all tokens was in the web app code.

With a system of this scale, the web server will probably be making no API calls, as everything might be sent via some distributed system.

There are, anyway, many solutions to store the keys, a key vault that is separate from both database and application/web servers would be ideal.

There's not much to do if an attacker gains control of every machine, so the general idea is to keep every attack vector as isolated as possible.

Remember encryption is not the same as hashing :) With encryption you can reverse the process, as long as you have the encryption key(s). With hashing, you can't.

I realize, but whatever server is making the API calls needs unrestricted access to the key and the encrypted tokens. So if server is compromised, the access tokens are necessarily compromised too, aren't they?

> I guess it means they stored their access tokens with no encryption

Or the encryption key was on a system the hacker may have accessed.

Yeah, same thing. I remember a large retailer I did some pentesting for a long time ago, they kept the encryption key for credit card numbers in the same table as the card numbers. Doh.

Reply on news.ycombinator.com