So I'm sitting on the couch around 6pm, checking Facebook on my phone like I do a hundred times a day for no good reason, and it just... boots me out. Full logout, back to the little blue login screen. I figure whatever, fat-fingered something, log back in. Then I go to check it on my laptop ten minutes later and same thing there too. Password prompt, like I'd never logged in before.
First thought, obviously, is that someone got into my account. That specific stomach-drop feeling where you start mentally listing which of your other accounts share that password (dont answer that, we've all done it, don't @ me). I actually went and changed my Facebook password before I even bothered googling what was going on, which in hindsight was probably the exact opposite order of operations I should've used.
Turns out it wasn't just me. Facebook put out a statement today saying they'd found a security issue affecting something like 50 million accounts, and as a precaution they force-logged-out around 90 million people total, mine apparently included, to reset everyone's access tokens. Ninety million. Thats not a rounding error, thats basically the population of Germany getting kicked off Facebook on a random Friday afternoon.
The bug itself is the kind of thing that makes sense once you read it and makes you go "how did nobody catch this sooner." It's tied to that "View As" feature, the one where you can preview what your profile looks like to a stranger, or an ex, or your mom, whoever. Apparently there was a flaw where that feature interacted badly with the video uploader tool for birthday posts (I am not making that combination up), and attackers figured out a way to use it to grab actual access tokens, which are basically the digital keys that let an app or browser stay logged into your account without asking for your password every time. Get someone's token and you don't need their password at all, you just are them, at least as far as Facebook's servers are concerned.
They're saying they don't know yet exactly what the attackers did with the access once they had it, which is not exactly the sentence you want to hear from a company holding this much of your personal information. Investigation's apparently still going, so I assume we'll get another update in a few days once they've figured out how bad it actually is.
Can we talk for a second about how this is the same year as Cambridge Analytica? Like we are not even eight months out from Zuckerberg sitting in front of Congress for two days answering questions about data privacy, and now there's a second, completely separate incident where tens of millions of accounts got their access tokens potentially handed to strangers. I don't think Facebook is secretly evil or whatever, I just think a company this size, holding this much data on this many people, should not be having a year like this. One breach is bad luck. Two in the same calendar year starts looking like a pattern.
Small tangent because I can't help myself: yesterday the SEC filed a lawsuit against Elon Musk over that "funding secured" tweet from back in August, the one about taking Tesla private at $420 a share. I have genuinely no idea how that one shakes out, but between that and the Facebook thing, its been a rough week for very large men who are supposed to be in charge of very large companies.
Practically speaking, if you got logged out today too, don't panic, just log back in and maybe actually use a real password this time instead of whatever you've been recycling since 2013. I'd also turn on two-factor if you haven't, it takes like four minutes and it means a stolen password alone isn't enough to get someone in. I say this as someone who avoided setting it up for years because I found the extra step annoying, and yeah, it is a little annoying, but so is the feeling of watching your own account log you out with no explanation on a random Friday night.
Anyway. Password's changed, 2FA's finally on, and I'm going to go be paranoid about something else now. There's always something.