TechPrufer
Get started
Meta
Meta logoMeta · Feature trail

Application Security and Permissions

74 posts · Jan 2009 – Aug 2026

What this trail covers

Meta's secure-by-default frameworks continue to evolve, with a focus on leveraging generative AI to accelerate adoption and ensure consistent security enforcement across large codebases. This includes developing frameworks that mirror existing APIs, build on stable interfaces, and cover broad application user bases. SecureLinkLauncher (SLL) exemplifies this by preventing Android Intent Hijacking through fine-grained scope verification (Family, Same-key, Internal, Third-party). AI-powered tools, and now Privacy Aware Infrastructure (PAI) with Policy Zones, are being integrated to enforce complex privacy constraints like purpose limitation at scale, moving beyond traditional point-checking and data lineage methods to real-time information flow control.

All Meta trails
  1. How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability GuaranteesThis post details the technical implementation of WhatsApp's new Scam Alert feature, which uses an on-device machine learning model to detect potential scam messages. It emphasizes end-to-end encryption and verifiability guarantees, outlining design principles such as on-device processing, no automatic reporting, and user control. The technical implementation focuses on privacy-preserving analytics using confidential federated analytics pipelines built on Trusted Execution Environments (TEEs) and differentially private aggregates for telemetry. It also details verifiable model behavior through public transparency ledgers and model weight publication.
  2. Privacy-Aware Infrastructure in the AI-Native Era: An Asset Classification Case StudyThis post details Meta's hybrid pattern for privacy-aware infrastructure (PAI) asset classification at scale, focusing on the 'Understand' layer. It introduces a system that builds rich context before using LLMs to handle ambiguity and novelty, distilling stable behavior into deterministic, versioned rules for routine enforcement. The system prioritizes context over prompts, decouples evaluation from optimization, and uses a two-lane operating pattern (deterministic and LLM fallback) with offline adjudication and rule promotion. The core contribution is a practical, staged approach to classifying data assets for privacy controls, balancing reasoning under ambiguity with the need for explainable and reproducible enforcement.
  3. Labyrinth 1.1: Making End-to-End Encrypted Backups Even More ReliableLabyrinth 1.1 introduces a new sub-protocol for Messenger's end-to-end encrypted backups. This protocol allows messages to be sent directly to the recipient's encrypted backup as they are transmitted, rather than waiting for the device to come online. This enhances reliability by ensuring message survival even if a device is lost, switched, or experiences long gaps between sign-ins. The system wraps each message with an encryption key placed directly into the recipient's backup, making it unreadable by Meta.
  4. How Meta Is Strengthening End-to-End Encrypted BackupsIntroduced over-the-air fleet key distribution for Messenger's end-to-end encrypted backups, allowing clients to validate fleet public keys without app updates. This mechanism delivers fleet keys in a validation bundle signed by Cloudflare and counter-signed by Meta, with Cloudflare maintaining an audit log. This enhances transparency and allows for new HSM fleet deployments without requiring app updates. Additionally, Meta commits to publishing evidence of secure fleet deployments on the blog.
  5. Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and TakeawaysThis post details Meta's proactive strategy and framework for migrating to post-quantum cryptography (PQC). It introduces PQC Migration Levels (PQ-Enabled, PQ-Hardened, PQ-Ready, PQ-Aware, PQ-Unaware) to assess organizational readiness and manage migration complexity. The strategy involves defining prioritization criteria (High, Medium, Low priority based on attack types like SNDL and Grover's), building a cryptographic inventory through automated discovery and manual analysis, addressing external dependencies (standards, HSMs, implementations), implementing PQC components and guardrails, and finally integrating PQC components into use cases. The post highlights Meta's co-authorship of the HQC PQC algorithm and its ongoing deployment of PQ protections across internal traffic.
  7. Patch Me If You Can: AI Codemods for Secure-by-Default Android AppsThis post introduces the use of generative AI to automate the migration of existing Android code to secure-by-default frameworks. It describes a two-pronged strategy: developing secure frameworks that wrap unsafe OS APIs and leveraging AI to apply these securely across millions of lines of code with minimal developer friction. The system proposes, validates, and submits security patches.
  8. How Advanced Browsing Protection Works in MessengerIntroduces Advanced Browsing Protection (ABP) for Messenger, enhancing link safety by leveraging Private Information Retrieval (PIR) and Confidential Computing (AMD SEV-SNP). Details the technical challenges and solutions for URL prefix matching in a privacy-preserving manner, including the development of a ruleset pre-processing mechanism to balance bucket sizes and the use of AMD SEV-SNP for secure processing of hash prefixes.
  9. No Display? No Problem: Cross-Device Passkey Authentication for XR DevicesThis post details a novel approach to enabling cross-device passkey authentication for devices with inaccessible displays, such as XR devices. It bypasses the use of QR codes by leveraging a companion app and authenticated push channel to transport FIDO URLs, adapting the WebAuthn passkey flow and FIDO's CTAP hybrid protocol. The solution uses in-app notifications and deep linking to initiate the passkey authentication flow on the mobile device, which then establishes a secure channel with the inaccessible device to complete the transaction.
  10. Rust at Scale: An Added Layer of Security for WhatsAppWhatsApp has adopted Rust for its media consistency library, replacing 160,000 lines of C++ with 90,000 lines of Rust. This migration was driven by the need to mitigate memory safety vulnerabilities, as demonstrated by the Stagefright vulnerability. The Rust implementation offers performance and runtime memory usage advantages and has been rolled out to billions of users across multiple platforms. The 'Kaleidoscope' system was also developed to perform format checks and detect risk indicators in various file types.
  11. How AI Is Transforming the Adoption of Secure-by-Default Mobile FrameworksThis post details Meta's approach to designing and adopting secure-by-default frameworks, exemplified by SecureLinkLauncher (SLL) for preventing Android Intent Hijacking. It highlights the design principles of mirroring existing APIs, using stable interfaces, and maximizing user coverage. A significant contribution is the application of generative AI (Llama) and AutoPatchBench to automate the migration process by inferring correct framework scopes and generating patches, thereby accelerating adoption and ensuring consistent security enforcement at scale.
  12. Key Transparency Comes to MessengerIntroduced key transparency verification for end-to-end encrypted chats on Messenger, building upon WhatsApp's implementation. This feature provides users with an auditable record of public keys to verify that their conversations are encrypted with the correct keys and haven't been tampered with. The implementation leverages the Auditable Key Directory (AKD) library and Cloudflare's key transparency auditor. Engineering challenges addressed include handling a high volume and frequency of key updates (approx. 2-minute epoch frequency, hundreds of thousands of new keys per epoch) by optimizing AKD for smaller proof sizes and improving infrastructure resilience to outages and sequencing delays.
  13. Scaling Privacy Infrastructure for GenAI Product InnovationThis post details the scaling of Meta's Privacy Aware Infrastructure (PAI) to address the unique challenges of GenAI, focusing on data lineage and privacy controls for AI glasses. It introduces PAI's enhanced observability through automated data detection and cross-stack lineage tracking (web, logger, warehouse, inference, training), and efficient privacy controls via Policy-enforcement APIs and automated policy adherence. The contribution highlights the 'Discover' stage of PAI, explaining how cross-stack lineage is collected and linked using a common privacy library (PrivacyLib) to create an end-to-end graph for interaction data. It demonstrates how this lineage is transformed into proof for AI glasses by guiding the placement of Policy Zones, blocking boundary crossings, and continuously verifying data processing jobs.
  14. Federation Platform and Privacy Waves: How Meta distributes compliance-related tasks at scaleThis post introduces the Federation Platform and Privacy Waves program, a new system for managing compliance-related tasks at Meta's scale. It details how these tools break down complex obligations into manageable workstreams, distribute tasks to relevant teams, and ensure accountability through structured monthly batches. The post highlights the platform's success in privacy and its expansion into security and accessibility, emphasizing its role in operationalizing compliance and safeguarding user data.
  15. Policy Zones: How Meta enforces purpose limitation at scale in batch processing systemsThis post introduces and details Policy Zones, a system for enforcing purpose limitations on data in large-scale batch processing systems. It integrates with Meta's exabyte-scale data warehouse and processing systems, using runtime enforcement and SQL parsing to propagate and enforce privacy annotations across millions of daily data flows. Policy Zones leverages Information Flow Control (IFC) principles to track data flow and enforce restrictions, ensuring downstream data restrictions are at least as restrictive as upstream sources. It also introduces Governable Data Annotations (GDAs) for precise, governed annotations on datasets and a Policy Zone Manager (PZM) to handle reclassification and prevent over-labeling. The post provides a walkthrough of how Policy Zones protects messaging data, highlighting its scale and technical implementation.
  16. Introducing AutoPatchBench: A Benchmark for AI-Powered Security FixesIntroduced AutoPatchBench, a benchmark for evaluating AI program repair systems specifically for fuzzing-identified C/C++ vulnerabilities. This benchmark includes 136 real-world vulnerabilities with verified fixes sourced from the ARVO dataset, and incorporates automated verification through fuzzing and white-box differential testing. The post details the challenges of existing datasets and the selection criteria and verification process used to create AutoPatchBench.
  17. Building Private Processing for AI tools on WhatsAppIntroduced Private Processing for AI tools on WhatsApp, a new confidential computing infrastructure built on Trusted Execution Environments (TEEs). This system enables AI processing of messages in a secure and private cloud environment, ensuring that neither Meta nor WhatsApp can access user data. Key technical components include anonymous credentials for authentication, Oblivious HTTP (OHTTP) for routing and encryption via third-party relays, and Remote Attestation + Transport Layer Security (RA-TLS) sessions for secure communication between the user's device and the TEE. The system is designed with foundational requirements for confidential processing, enforceable guarantees, and verifiable transparency, along with additional layers for non-targetability and stateless processing with forward security. A detailed threat model was developed, considering assets, threat actors (insiders, third parties, malicious end users), and threat scenarios such as external exploitation of product attack surface, extraction of messages from CVMs, and interference with CVMs at boot and runtime.
  18. How Meta understands data at scaleThis post details Meta's significant investments in data understanding technologies as part of its Privacy Aware Infrastructure (PAI). It introduces a 'shift-left' approach by integrating data schematization and annotations early in product development, and a universal privacy taxonomy for standardized data privacy management. The post highlights the evolution of data understanding over the past decade, from heuristic-based classification to a more robust system involving schematization, annotation, and inventorying data assets in OneCatalog. It addresses challenges like understanding data at scale, inconsistent definitions, missing annotations, and organizational barriers, proposing solutions like shared asset schema formats, unified taxonomies, and collaborative tooling. A walkthrough of the 'Beliefs' feature in Facebook Dating illustrates the five-step approach to data understanding, emphasizing the importance of schematization using DataSchema and predicting metadata at scale through a universal privacy taxonomy and data classification.
  19. Protecting user data through source code analysis at scaleThis post details the integration of static analysis tools (Zoncolan for Hack, Pysa for Python) into Meta's workflow to proactively detect potential scraping vectors across codebases. It explains how these tools track data flow by defining sources (user-controlled parameters) and sinks (data returned to the user), identifying potential issues when data flows from source to sink. An example illustrates how a user-controlled 'count' parameter in an API endpoint can be abused by scrapers, and the recommended fix involves capping the maximum results returned to limit data extraction and trigger rate limiting systems. The post acknowledges the limitations of static analysis and emphasizes a holistic approach to combating scraping.
  20. How Meta discovers data flows via lineage at scaleThis post details how Meta leverages data lineage as a core component of its Privacy Aware Infrastructure (PAI) to enhance application security and permissions. It explains the development of techniques for collecting data flow signals (static code analysis, runtime instrumentation, data matching) and the creation of tools like Privacy Probes and Policy Zone Manager (PZM) to automate lineage tracking. The post provides a walkthrough of implementing data lineage for sensitive data like 'religion' in Facebook Dating, illustrating the process of collecting signals from web and data warehouse systems to ensure purpose limitation and compliance.
  21. How Meta built large-scale cryptographic monitoringThis post details the implementation of a large-scale cryptographic monitoring system at Meta, built upon the FBCrypto library. It addresses the challenge of logging cryptographic operations at high volume by employing a buffering and flushing strategy instead of direct logging or sampling. Optimizations include partially randomized flushing to normalize write throughput, aggregation of derived crypto operations to reduce logging volume, and the use of folly::ConcurrentHashMap for efficient multithreaded aggregation. The system provides deep visibility into cryptography usage, enabling proactive mitigation of security vulnerabilities, identification of weakened algorithms for migration, and preparation for post-quantum cryptography readiness. It leverages existing infrastructure like Scribe and Scuba for log ingestion and storage.
  22. IPLS: Privacy-preserving storage for your WhatsApp contactsIntroduced Identity Proof Linked Storage (IPLS) for WhatsApp, a novel encrypted storage system that allows users to save and automatically restore contact lists directly through WhatsApp. IPLS leverages existing technologies like key transparency (via Auditable Key Directory - AKD) and hardware security modules (HSMs) for private, tamper-resistant execution. It integrates with Cloudflare as an independent witness for AKD updates and uses HSM-based key storage for encrypted contact names, ensuring availability and privacy even if a phone is lost. This enables users to create and manage contacts within WhatsApp, sync them across linked devices, and customize contact lists for multiple accounts on the same phone.
  23. How Meta enforces purpose limitation via Privacy Aware Infrastructure at scaleThis post introduces Meta's Privacy Aware Infrastructure (PAI) initiative, specifically detailing the development and application of Policy Zones. Policy Zones is an Information Flow Control (IFC) based technology designed to enforce purpose limitation for data at scale. It moves beyond fragile point-checking and data lineage methods by enabling programmatic, real-time control over data flows during code execution. The system annotates data assets with metadata labels (e.g., BANANA_DATA) and evaluates data flows against defined rules at runtime, blocking violations. It integrates with function-based systems (web frontend, backend services) and batch-processing systems (SQL-based data warehouses, AI/analytics workloads). The post provides examples of how Policy Zones works for function calls and batch processing, and discusses its application across various Meta systems to ensure data is processed only for allowed purposes.
  24. Post-quantum readiness for TLS at MetaThis post details Meta's proactive migration to post-quantum cryptography (PQC) for TLS, addressing the 'store now, decrypt later' threat. It outlines the adoption of hybrid key exchange, combining classical algorithms with PQC (Kyber768/Kyber512), and the integration into Meta's Fizz TLS library via liboqs. Challenges addressed include large packet sizes impacting TLS resumption and TCP Fast Open, leading to the use of Kyber512 for internal communications, and a multithreading race condition in liboqs that was fixed upstream. It also discusses cross-domain resumption handshake thrash and potential solutions.
  25. Making messaging interoperability with third parties safe for users in EuropeThis post details the technical implementation of messaging interoperability for WhatsApp and Messenger to comply with the EU's Digital Markets Act (DMA). It outlines the use of the Signal Protocol for end-to-end encryption, the client/server architecture for interop, authentication mechanisms using OpenID and JWT, and the use of Noise Protocol Framework for client-server encryption. It also discusses the trade-offs and limitations of E2EE when interoperating with third parties and the need for user transparency.
  26. Building end-to-end security for MessengerThis post details the rollout of end-to-end encryption (E2EE) by default for personal conversations on Messenger. It introduces the Labyrinth encrypted storage protocol for end-to-end encrypting stored messaging history between devices and describes the core cryptographic protocol for transmitting messages between clients. Key technical challenges addressed include multi-device capability, feature support (e.g., sticker library search using OHAI and Anonymous Credentials), message history management with Labyrinth, and web support for E2EE.
  27. Enhancing the security of WhatsApp callsThis post details the technical implementation and security benefits of two new optional features in WhatsApp calls: 'Silence Unknown Callers' and 'Protect IP Address in Calls'. 'Silence Unknown Callers' uses a specialized protocol enforced by WhatsApp servers to deliver stripped-down, silenced call notifications, protecting recipients from complex call setup processing and potential zero-click attacks. This is achieved through a novel privacy token system that allows clients to locally decide trusted users and distribute tokens, enabling servers to validate call initiation without learning the exact caller-recipient relationship. 'Protect IP Address in Calls' relays calls through WhatsApp servers to hide user IP addresses from other parties, preventing the deduction of geographical location. This is achieved by shifting from peer-to-peer connections to a relay model, ensuring end-to-end encryption remains intact.
  28. Meta Quest 2: Defense through offenseThis post details the discovery of a memory corruption vulnerability in the Meta Quest 2's VR Runtime service, which allowed for arbitrary native code execution from an unprivileged application. The post outlines the VROS architecture, the VR Runtime service's role and attack surface, the Runtime IPC communication mechanism, and the specific vulnerability that enabled an 8-byte write primitive. It further explains how this primitive was used to hijack control flow by overwriting a Vulkan interface function pointer (vkGetPhysicalDeviceImageFormatProperties) to achieve arbitrary native code execution, providing actionable insights for improving Meta Quest product security.
  29. How Meta is improving password security and preserving privacyIntroduced Private Data Lookup (PDL), a privacy-enhancing technology based on Private Set Intersection, to enable privacy-preserving password prechecks and breached password checks in Enterprise Center. PDL allows users to privately query server-side data sets without revealing their data to Meta. Implemented optimizations for PDL including pre-processing of compromised password data, sharding the leaked password dataset, and compression of blinded hash values to improve performance and reduce latency and bandwidth usage.
  30. Using short-lived certificates to protect TLS secretsIntroduced short-lived certificates (SLCs) for TLS private keys on edge networks, reducing certificate validity from months/years to days (specifically 10 days exposure, daily rotation). This involved building a robust automation pipeline (ConfigBuilder) for certificate issuance and distribution, enhancing the OffloadService to handle frequent secret fetches, and implementing a staged rollout process with canaries and wider deployments to ensure reliability. Explored and rejected protocol layer revocation and remote offload due to latency and reliability concerns. Also experimented with delegated credentials but noted browser adoption limitations.
  31. The malware threat landscape: NodeStealer, DuckTail, and moreThis post details the technical analysis and disruption of NodeStealer, a novel JavaScript-based malware that targets Windows browsers to steal cookies, usernames, and passwords for compromising accounts on platforms like Facebook, Gmail, and Outlook. It also discusses the adversarial adaptation of the Ducktail malware and the trend of malware lures following popular topics like generative AI (e.g., ChatGPT). The post provides threat indicators and insights into how these malware families operate, including their distribution methods and evasion tactics, to inform industry-wide security efforts.
  32. Deploying key transparency at WhatsAppIntroduced a new key transparency feature for WhatsApp to automatically verify end-to-end encrypted connections. This is achieved by maintaining an append-only Auditable Key Directory (AKD) of public keys mapped to user accounts, with changes recorded in a publicly available, privacy-preserving audit record. An open-source Rust library (AKD crate) was developed to support this, enabling clients to validate key authenticity and anyone to verify audit proofs. The system addresses the challenges of manual security code verification in 1:1 and group communications by providing an automated, scalable, and auditable mechanism.
  33. How Device Verification protects your WhatsApp accountIntroduced Device Verification, a new security feature for WhatsApp that prevents account takeover (ATO) attacks by detecting and blocking unauthorized connections. This is achieved by leveraging a security-token, nonce, and authentication-challenge mechanism to validate client connections to WhatsApp servers, ensuring that only legitimate devices can re-establish trusted connections and retrieve messages. The feature aims to protect users from malware that steals authentication keys from unofficial WhatsApp clients.
  34. Open-sourcing Anonymous Credential ServiceThis post introduces and open-sources the Anonymous Credential Service (ACS), a highly available multitenant service for de-identified authentication. It details the underlying anonymous credential protocol based on VOPRFs and blind signatures, explaining the two-phase process of token issuance and redemption. Key technical challenges and solutions are discussed, including token redemption counting, key rotation strategies using attribute-based key derivation functions (KDFs) for transparency, and deployment at scale. The post also outlines the components of the ACS C library and provides a conceptual example of its use in a real system for scenarios like de-identified logging.
  35. Using Hermes’s Quicksort to run Doom: A tale of JavaScript exploitationThis post details the discovery and exploitation of an out-of-bounds (OOB) read vulnerability in Hermes's Quicksort implementation. The vulnerability arises from the interaction between a stable sort implementation that uses an index vector and a custom comparison function that modifies the array during sorting. By extending the array and carefully controlling the comparison function's return values, an attacker can cause the sorting algorithm to access indices beyond the bounds of the index vector, leading to an OOB read. Further investigation revealed that this OOB read could be escalated to arbitrary code execution by manipulating swaps within the Quicksort algorithm, specifically by underflowing the 'j' index and defining a custom getter for the out-of-bounds access. The post demonstrates the exploit by running the game Doom within Hermes.
  36. How Meta and the security industry collaborate to secure the internetThis post details Meta's collaboration with the security industry to secure the internet, focusing on bug hunting methodologies and information sharing. It highlights the use of automated static analysis tools like Zoncolan for internal bug detection, and the work of Red Team X in identifying and reporting vulnerabilities in third-party hardware and software (e.g., Schneider Electric, Airspan, Apple, EternalTerminal). The post also emphasizes the contributions of bug bounty researchers, showcasing significant finds in Meta's Facebook API and Instagram endpoints. The overarching theme is the continuous effort to improve security through proactive identification, responsible disclosure, and collaborative efforts.
  37. How Meta enables de-identified authentication at scaleIntroduced Anonymous Credential Service (ACS) as a new privacy-enhancing technology (PET) to enable de-identified authentication at source, moving from reactive data minimization to proactive de-identification. Detailed the protocol leveraging anonymous credentials, VOPRFs, and blind signatures, involving token issuance and de-identified authentication phases. Highlighted real-world use cases in WhatsApp telemetry and federated learning, and discussed the ACS architecture, scaling lessons learned (credential reuse limits, traffic dithering, global rate limiting), and self-service onboarding improvements.
  38. Code Verify: An open source browser extension for verifying code authenticity on the webIntroduced Code Verify, an open-source browser extension that verifies the authenticity of web code served to users. This extension works in partnership with Cloudflare to provide independent, third-party, transparent verification of code for services like WhatsApp Web, Messenger, and Instagram Web. It expands on subresource integrity by checking resources on the entire webpage and notifies users of any inconsistencies, aiming to provide at-risk users with peace of mind.
  39. Facebook engineers receive 2021 IEEE Computer Society Cybersecurity Award for static analysis toolsThis post details the development and deployment of static analysis tools (Infer, Zoncolan, Pysa, Mariana Trench) for finding and preventing security and privacy bugs at scale across multiple programming languages (Hack, Python, Java) and platforms (server-side, Android). It highlights the award received for these tools and their open-sourcing to benefit the wider industry.
  40. Open-sourcing Mariana Trench: Analyzing Android and Java app security in depthThis post introduces Mariana Trench (MT), an open-sourced tool for static and dynamic analysis of Android and Java applications. MT focuses on analyzing data flows from sources to sinks to identify security and privacy vulnerabilities. It uses abstract interpretation to model Java methods and allows security engineers to define rules for specific data flows. The post also highlights the companion tool SAPP (Static Analysis Post Processor) for triaging MT's results.
  41. How WhatsApp is enabling end-to-end encrypted backupsThis post introduces end-to-end encryption (E2EE) for WhatsApp backups, a significant enhancement to application security and privacy. It details the technical implementation, including the generation of unique encryption keys, the use of a password-protected Backup Key Vault built on hardware security modules (HSMs) for secure key storage and retrieval, and the encryption of backup data using symmetric encryption. The system is designed for high availability and reliability, with geographically distributed HSMs to prevent data loss during outages. The client-server authentication protocol and the role of the ChatD service in handling client connections are also described.
  42. Enforcing encryption at scaleThis post details the development and deployment of SSLWall, a system designed to enforce transit encryption policies across Meta's internal network. SSLWall utilizes eBPF (tc-bpf, kprobes) and a management daemon to inspect and block non-SSL connections at the host level, ensuring application-level TLS. It addresses challenges like HTTP CONNECT and STARTTLS, and includes a passive monitoring mode. For services that cannot be easily modified, Transparent TLS (TTLS) is introduced, which uses eBPF to transparently redirect connections to a local proxy for encryption without application changes. Key technical challenges included TCP Fast Open (TFO) interaction and BPF program size limits.
  43. DIT — enabling de-identified data collection on WhatsAppIntroduced De-identified Telemetry (DIT), a new system for collecting usage, reliability, and performance data on WhatsApp in a privacy-protective manner. DIT utilizes an Anonymous Credential System (ACS) built on Verifiable Oblivious Pseudorandom Functions (VOPRFs) and HMAC to authenticate data without the server learning the origin, thereby minimizing metadata tied to specific users. The system involves a two-step workflow: clients obtain anonymous tokens via VOPRFs and then use these tokens with HMAC to upload logs over unauthenticated connections. Practical considerations for scaling DIT include curve choice (Curve25519), unlinkability guarantees via pseudonymous identifiers, re-identification risk mitigation, rate limiting through key rotation, and communication cost optimization by reusing tokens and co-locating ACS servers.
  44. DELF: Safeguarding deletion correctness in online social networksIntroduced DELF, a new framework for safeguarding data deletion correctness in online social networks. DELF enables developers to implement deletion with minimal effort through annotations rather than code, and incorporates multiple correctness validation techniques (static validation, dynamic validation heuristics, privilege escalation checks, data type validation) to prevent data retention or accidental deletion of wrong data. DELF has been deployed at Facebook, supporting billions of deletions daily by immediately hiding target objects, hiding dependent data, asynchronously traversing the data graph for point deletes, and maintaining a restoration log for recovery.
  45. Pysa: An open source static analysis tool to detect and prevent security issues in Python codeIntroduced Pysa, an open-source static analysis tool for Python, built on top of the Pyre type checker. Pysa detects security and privacy issues by analyzing data flows, identifying sources and sinks to prevent issues like XSS, SQL injection, and improper user data disclosure. It has been applied to Instagram's Python codebase, providing rapid feedback to developers and security engineers. Pysa's open-source release includes definitions for taint analysis, enabling its use with common Python frameworks like Django and Tornado. The post also details Pysa's working mechanism, its handling of false positives and negatives through sanitizers and features, and its limitations related to the problem space, resource constraints, and Python's dynamic nature.
  46. Scalable data classification for security and privacyIntroduced a scalable data classification system using multiple data signals, a scalable system architecture, and machine learning to detect semantic types within Facebook at scale. This system handles both persisted and non-persisted data, employing Bernoulli sampling, feature extraction, and a prediction service for offline data stores. For online data, it provides a real-time API for classification predictions. The system integrates heuristic rules and a modular PyTorch-based ML model for unstructured data, aiming to improve accuracy and enable automated policy enforcement.
  47. Private matching for compute: New solutions to the problem of enabling compute on private set intersectionsIntroduced two new cryptographic protocols, Private-ID and PS3I, for private matching for compute. Private-ID performs an outer join and reveals only the size of the intersection using elliptic curve cryptography. PS3I performs an inner join and outputs encrypted matching records using elliptic curve cryptography and Paillier encryption. These algorithms enable secure data alignment for downstream computations within privacy-enhancing technologies like multiparty computation, with performance demonstrated for datasets up to 100 million records within an hour.
  48. Fighting Abuse @Scale 2019 recapThis post details the "Fighting Abuse @Scale 2019" conference, highlighting technical discussions on state-of-the-art technologies to fight fraud, spam, and abuse. Key contributions include: research on detecting and thwarting targeted spyware abuse using server fingerprinting and internet scanning; building and scaling human review systems with considerations for quality, cost, and measurement; a deep entity classification (DEC) framework for abusive account detection using multi-stage, multi-task learning; the use of unsupervised learning (outlier detection, behavioral clustering) for detecting fake/compromised accounts and automation; temporal interaction embeddings (TIEs) to capture user behavior and interaction sequences for abuse detection; and a collaboration between Facebook and Google to identify and remove terrorist content. It also covers strategies for detecting and mitigating noncommercial engagement fraud and International Revenue Share Fraud (IRSF) using heuristic-based detection and ML-based phone reputation systems, as well as preventing payment fraud with a combination of human and machine intelligence.
  49. Data Transfer Project: Enabling portability of photos and videos between servicesIntroduced a tool for direct photo and video transfer between Facebook and Google Photos, built on the open-source Data Transfer Project framework. This framework provides shared data models, adapters for authentication and data transformation, and a task management system. Facebook's implementation includes custom extensions for security (OAuth, password re-entry, email notifications), reliability (rate limiting, custom retry strategies), and integration with internal infrastructure like TAO for job storage, Scribe for logging, and Tupperware for deployment.
  50. Delegated credentials: Improving the security of TLS certificatesIntroduced and detailed the concept of delegated credentials as an extension to the TLS protocol. This allows servers to generate short-lived credentials signed by their leaf certificate, enabling significantly shorter certificate lifetimes (hours instead of months) without compromising reliability. This provides an additional layer of defense-in-depth against compromised certificates and allows servers to experiment with new public key algorithms before CA support.
  51. Fighting fraud using partially blind signaturesThis post introduces the concept of blind signatures as a cryptographic technique to enhance privacy in event reporting while still combating fraud. It details how blind signatures can be used to create unlinkable conversion reports by allowing a signer to sign a blinded version of data without seeing the original data. The post also discusses the challenges of linkability across requests and proposes using partially blind signatures with unique blinding factors for each step in a user journey. It suggests that browsers or operating systems could facilitate this process to further enhance privacy and security by generating nonces and blinding factors on-device and handling signature requests out-of-band.
  52. Zoncolan: How Facebook uses static analysis to detect and prevent security issuesThis post introduces Zoncolan, a static analysis tool developed by Facebook to detect and prevent security and privacy issues in its large Hack codebase. Zoncolan uses abstract interpretation to track user-controlled input from sources to sinks, identifying potentially dangerous data flows. It allows security engineers to quickly verify findings, codify rules to prevent future occurrences, and serves as documentation for issue classes. The tool analyzes the entire codebase in under 30 minutes and has prevented thousands of potential security issues, with a significant portion flagged directly to code authors before landing.
  53. Building Facebook’s service encryption infrastructureThis post details Meta's migration of its internal data center encryption infrastructure from Kerberos to TLS mutual authentication with X.509 certificates. It outlines the security and operability trade-offs considered, the design principles for the new TLS-based system (including certificate provisioning via an internal Certificate Authority and Tupperware integration), and the benefits of using TLS for improved reliability, debugging, and reduced KDC load compared to the previous Kerberos implementation.
  54. Scalable and secure access with SSHThis post details Meta's implementation of signed SSH certificates with principals for scalable and secure access to thousands of servers. It explains how this approach overcomes the limitations of traditional password-based and public-key authentication by establishing a single point of trust via a certificate authority (CA). The post outlines the architecture, including the use of bastion hosts, centralized logging for accountability, and the configuration of security domains. It provides practical examples of setting up a CA, generating certificates, and configuring SSH servers to trust them and enforce principal-based authorization, thereby enhancing both security and reliability.
  55. In pursuit of secure open source softwareThis post details Meta's security practices for the open-source osquery project, emphasizing constant vigilance in code review, full-pipeline awareness of build and distribution infrastructure security, integration with the bug bounty program, and third-party security assessments. It highlights proactive threat modeling, secure coding practices (e.g., memory allocation, safe string operations), and the importance of securing the build pipeline itself. The post also encourages community involvement through bug hunting and ethical vulnerability reporting.
  56. Hardware and firmware attacks: Defending, detecting, and respondingThis post details the evolving landscape of hardware and firmware attacks and introduces osquery as a tool for defense and detection. It highlights the addition of hardware monitoring to osquery, enabling security teams to gain insights into system behavior, detect compromises, and manage vulnerabilities. The post discusses specific attack vectors like drive firmware attacks, EFI RATs, and the challenges of securing firmware due to its early execution and black-box nature. It proposes defense strategies including tracking kernel modules, auditing bootloaders, and leveraging osquery for collecting hardware-related signals and event-based data.
  57. Security @Scale 2015: Engineering SecurityThis post details the "Security @Scale 2015" conference, highlighting engineering security efforts at Facebook, HubSpot, Akamai, and Brightcove. Key contributions include the development of the Security Infrastructure team at Facebook to build tools for secure development and threat detection, the use of automation and tooling to make security easier for engineers, and the creation of Invariant Detector to automatically enforce permission checks and protect information. Other contributions discussed include making security usable at HubSpot through authentication improvements, learning from other disciplines for safety at scale, contributing to Elliptic Curve Cryptography standards, building open-source security software like osquery, automating mobile malware identification, visualizing cybersecurity data at scale, building secure servers from the ground up, and using pen testing and tooling throughout the SDLC.
  58. Osquery: Introducing query packsThis post introduces 'query packs' for osquery, a host instrumentation platform. Query packs allow for the grouping of osquery queries by function or problem domain, making them easier to distribute, update, and manage. The post highlights the release of internal Facebook query packs for incident response, vulnerability management, and OS X attacks, aiming to improve security monitoring, intrusion detection, and compliance efforts. It also encourages community contributions to expand the query pack ecosystem.
  59. Fighting spam with HaskellThis post details the redesign of Facebook's spam detection system, Sigma, which now utilizes Haskell. It highlights the migration from an in-house language (FXL) to Haskell for improved performance, expressivity, and safety. Key contributions include the development of the Haxl framework for automatic data fetching concurrency and the implementation of hot-swapping for compiled code to enable rapid policy deployment. The post also quantifies performance gains and discusses resource limit management within the Haskell-based Sigma system.
  60. Embracing open source securityThis post introduces osquery as an open-source framework for low-level operating system monitoring, highlighting its potential to drive innovation in security through open collaboration. It emphasizes the 'defender's dilemma' and the need for better information sharing among security professionals. The post details how osquery's development on GitHub, with public issues and community contributions, fosters a collaborative environment for adding new features and capabilities, citing examples of community contributions like visibility into encrypted hard drives and Yara pattern matching support.
  61. Security @Scale 2014 RecapThis post recaps the second Security @Scale conference, highlighting discussions on scaling security solutions across companies like GitHub, HackerOne, Square, Twitter, and Facebook. Key themes included bug bounty programs (Mutiny on the Bounty), scaling vulnerability management and access control (Human Botnet), scalable rule engines for anti-abuse (Better Large Scale Rule Engines with Haxl), transport-layer security at scale (SSL++), host intrusion detection with osquery, incident response tooling (Homebrew Incident Response), and ChatOps for incident response (Building Your Own DFIR Sidekick). The conference aimed to foster open discussion and learn from engineering solutions for large-scale security challenges.
  62. Introducing Conceal: Efficient storage encryption for AndroidIntroduced Conceal, a set of Java APIs for efficient and lightweight storage encryption on Android. Conceal abstracts cryptographic choices with sensible defaults, uses AES-GCM for authenticated encryption, and reduces the size of OpenSSL dependencies to 85KB. It provides an easy-to-use API for encrypting and decrypting data streams, with a focus on performance and responsible memory usage.
  63. Secure browsing by defaultThis post details the migration of Facebook to HTTPS by default for all users, a significant security enhancement. It outlines the technical challenges and solutions implemented, including the use of the 'secure' attribute for authentication cookies, an insecure indicator cookie to manage session ambiguity, the upgrade of third-party platform applications to support HTTPS, strategies for controlling referrer headers, and a two-part migration process for existing sessions. Performance considerations, such as leveraging edge networks and abbreviated handshakes, are also discussed, along with future plans for enhanced security measures like 2048-bit RSA keys, Elliptic Curve Cryptography, ECDHE, Certificate Pinning, and HSTS.
  64. Celebrating a year of fighting email phishing with DMARCThis post details Facebook's adoption and advocacy for the DMARC protocol, a key advancement in email security for thwarting phishing attacks. It highlights Facebook's early adoption of an early DMARC protocol in 2011, their hosting of an interoperability event to test and iterate on the protocol, and the significant impact of DMARC in protecting a large percentage of consumer mailboxes. The post also touches on the inherent complexity of email as a technology and the collaborative effort involved in evolving its security standards.
  65. Fighting spam with pure functionsThis post introduces FXL (Feature eXtraction Language), a domain-specific language developed to combat evolving spam threats on Facebook. FXL is described as a narrowly-optimized subset of Standard ML, designed for efficient data fetching across the graph. Its key innovation lies in its pure function execution model, which allows for automatic optimization through batching of data fetches and memoization, leading to significant performance improvements in spam detection compared to naive execution models. This directly contributes to the 'combating evolving spam and abuse' aspect of the application security and permissions feature thread.
  66. Interning at Facebook: Building the new mobile advertising interfaceThis post details the development of the first mobile advertising interface for Facebook, specifically for the Pages Manager iOS app. It highlights the integration of 'Promoted Posts' functionality into a mobile context, requiring a performant client-side UI, scalable API endpoints, and internationalization considerations. The project involved collaboration with platform, internationalization, and payments teams, and utilized BoltJS for UI development. It also showcases the design of a streamlined mobile ad management interface with insights, emphasizing user control and impact visibility.
  67. A faster, better link shimIntroduced a new link shim implementation that pre-checks all links on a page for maliciousness before sending them to the browser, rather than checking only clicked links after a delay. This change leverages the 'meta referrer' feature in modern browsers to restrict the amount of source URL information shared with external sites, improving both performance (saving ~1 second per click) and privacy.
  68. DMARC: Building Open-Source Email Authentication TechnologiesThis post details the development and open-sourcing of DMARC (Domain-based Message Authentication, Reporting & Conformance), an email authentication protocol designed to combat domain spoofing and phishing. It explains how DMARC builds upon existing technologies like DKIM and SPF to provide aggregated, anonymized reports to domain owners, enabling them to audit their infrastructure and eventually request mailbox providers to reject unauthenticated email. The post highlights DMARC's flexibility, gradual rollout options, and its adoption as an open specification under the Open Web Foundation Agreements.
  69. My First Year Fighting SpamThis post details the author's first year on the Site Integrity Recon & Response (SI-RAR) team, focusing on combating spam and abuse. It highlights the development and iteration of real-time classification systems to address evolving threats like fake accounts (created to promote external services) and social engineering attacks (self-XSS). The post emphasizes the importance of monitoring, automation, and the need for security to be designed into products rather than being an afterthought. It also touches on the shift from self-XSS to malicious browser extensions as an attack vector.
  70. Introducing Login ApprovalsIntroduced Login Approvals, an opt-in two-factor authentication system that uses SMS-based codes sent to a user's mobile phone for login from unrecognized devices. The system allows users to save trusted devices to bypass future challenges and provides a mechanism for password reset if a phone is lost. The design choice of SMS was driven by a focus on impact and usability to reach the widest user base.
  71. Protecting Privacy with ReferrersIntroduced a technical solution to remove user IDs from referrer links, preventing advertisers from inferring user IDs when users click on ads. This involved developing a cross-browser compatible redirector mechanism that successfully redirects users while obscuring the source page, detailing various HTTP redirect methods (302, Refresh, Meta Refresh) and JavaScript-based redirects (document.location.replace(), anchor click(), 2-way shimmed anchor click) and their browser-specific behaviors. A fallback 'Refresh:1;URL=http://B.com' header was implemented for non-JavaScript environments.
  72. Behind the scenes with the new Facebook features in Apple’s iPhoto ’09This post details the technical implementation of integrating Facebook features with Apple's iPhoto '09, specifically focusing on bi-directional syncing of name tags and photos. It highlights enhancements to Facebook's APIs to support this integration, including determining when name tags are added on Facebook, keeping them in sync with iPhoto, and providing familiar Facebook privacy controls. This represents an early example of extending Facebook's platform capabilities to third-party applications through its APIs.