Application Security and Permissions

6/26/2026

Introduces a hybrid pattern for asset classification within privacy-aware infrastructure (PAI) to handle the complexities of AI-native products. This pattern leverages LLMs for ambiguity and novelty, distills stable behavior into deterministic, versioned rules for enforcement, and separates human-reviewed labels from model-generated recommendations. The post details the operational concerns of PAI (Understand, Discover, Enforce, Demonstrate) and the challenges of asset classification, proposing a three-principle approach: context over prompts, decoupled evaluation from optimization, and distilling stable behavior into deterministic rules. It outlines a seven-stage practical process, including defining a stable contract, building a context mesh, and a two-lane operating pattern for deterministic and LLM-based decision-making.

5/11/2026

Introduces Labyrinth 1.1, a new sub-protocol for Messenger's end-to-end encrypted backups. This version enhances reliability by enabling messages to be backed up as they are sent, rather than waiting for the device to come online. This addresses scenarios like device loss, device switching, and long gaps between sign-ins, ensuring message history is preserved and restorable.

5/1/2026

Introduced over-the-air fleet key distribution for Messenger's end-to-end encrypted backups, enabling new HSM fleet deployments without app updates. This mechanism uses signed validation bundles from Cloudflare and Meta to cryptographically prove the authenticity of fleet public keys. Also committed to publishing evidence of secure HSM fleet deployments to enhance transparency.

4/16/2026

This post details Meta's proactive migration to post-quantum cryptography (PQC) to address the threat posed by quantum computers. It introduces the concept of 'PQC Migration Levels' (PQ-Enabled, PQ-Hardened, PQ-Ready, PQ-Aware, PQ-Unaware) to help organizations manage migration complexity. The post outlines Meta's PQC strategy, including prioritization criteria (High, Medium, Low priority based on attack types like SNDL and Grover's), building a cryptographic inventory through automated discovery and manual analysis, addressing external dependencies, implementing PQC components and guardrails, and integrating PQC components into use cases. It highlights Meta's involvement in developing PQC standards like HQC and shares lessons learned to guide the broader community.

3/13/2026

This post details the development and application of AI-powered codemods to automate the migration of existing Android code to secure-by-default frameworks. It highlights the challenges of large-scale code updates for security-related API changes and the two-pronged strategy of designing secure frameworks and using generative AI for automated migration.

3/9/2026

Introduces Advanced Browsing Protection (ABP) for Messenger, enhancing link safety by leveraging Private Information Retrieval (PIR) and Confidential Computing (AMD SEV-SNP). Details the technical challenges and solutions for URL prefix matching in a privacy-preserving manner, including the development of a ruleset pre-processing mechanism to balance bucket sizes and the use of AMD SEV-SNP for secure processing of hash prefixes.

2/4/2026

Introduced a novel approach to cross-device passkey authentication for XR devices with inaccessible displays, bypassing QR codes. This solution leverages a companion app (Meta Horizon app) and push notifications to securely transport FIDO URLs, enabling passkey registration and authentication without an on-device display, while adhering to trust and proximity requirements.

1/27/2026

This post details WhatsApp's adoption and large-scale rollout of Rust for media handling to enhance security against malware threats. It describes the motivation stemming from the 2015 Stagefright vulnerability, the parallel development of a Rust version of the 'wamedia' library, the challenges overcome (binary size, build system support), and the performance/memory usage advantages observed. The post also introduces 'Kaleidoscope,' an ensemble of checks for file type conformity, risk indicators, and masquerading files. It highlights this as the largest known deployment of Rust code to diverse end-user platforms and products, emphasizing Rust's production-readiness and client-side value proposition. The post also reiterates WhatsApp's broader security investments and its strategy of prioritizing memory-safe languages for new code.

12/15/2025

This post details the development and adoption of secure-by-default mobile frameworks at Meta, focusing on how generative AI is used to accelerate their implementation. It introduces the SecureLinkLauncher (SLL) framework for preventing Android Intent hijacking, explaining its design principles, API mirroring, and fine-grained intent scoping (Family, Same-key, Internal, Third-party). The post also describes the AI-driven prompt creation and generation process using Llama to suggest patches for migrating call sites to these secure frameworks.

11/20/2025

Introduced key transparency verification for end-to-end encrypted chats on Messenger, building upon WhatsApp's implementation. Leverages the Auditable Key Directory (AKD) library and Cloudflare's key transparency auditor. Addressed engineering challenges related to high volume and frequency of key updates by optimizing algorithmic efficiency for smaller proof sizes and improving infrastructure resilience to outages and sequencing delays. This allows users to automatically verify the authenticity of their contacts' encryption keys for one-on-one chats.

10/23/2025

This post details the scaling of Meta's Privacy Aware Infrastructure (PAI) to address the unique challenges of GenAI, specifically focusing on data lineage and privacy controls for AI glasses. It introduces cross-stack lineage collection (web, logger, warehouse, inference, training) and the use of a common privacy library (PrivacyLib) to capture read/write operations. The post explains how this lineage data is transformed into actionable proofs for privacy protection by guiding the placement of Policy Zones and verifying data processing jobs.

8/11/2025

This post introduces the Federation Platform and Privacy Waves program, a new system for managing compliance-related tasks at Meta's scale. It details how these tools break down complex obligations into manageable workstreams, distribute tasks to relevant teams, and ensure accountability through structured monthly batches. The post highlights the platform's success in privacy and its expansion into security and accessibility, emphasizing its role in operationalizing compliance and safeguarding user data.

7/24/2025

Introduced Policy Zones, a system for enforcing purpose limitations on data in large-scale batch processing systems. Policy Zones integrates with Meta's exabyte-scale data warehouse and processing systems, using runtime enforcement and SQL parsing to propagate and enforce privacy annotations across millions of daily data flows, performing trillions of user consent checks per hour. It leverages Information Flow Control (IFC) principles and provides tools for engineers to automatically track and protect data flows by enforcing flow restrictions at runtime. Key components include the Policy Zone Manager (PZM) for reclassification and Governable Data Annotations (GDAs) for precise, governed annotations on datasets.

4/29/2025

Introduces AutoPatchBench, a benchmark for evaluating AI program repair systems specifically for fuzzing-identified vulnerabilities. It includes 136 C/C++ vulnerabilities with verified fixes from the ARVO dataset, along with a rigorous automated verification process involving fuzzing and white-box differential testing. This aims to standardize the evaluation of AI-driven security fixes and accelerate progress in automated vulnerability repair.

4/29/2025

Introduced Private Processing for AI tools on WhatsApp, a new confidential computing infrastructure built on Trusted Execution Environments (TEEs). This system enables AI processing of messages in a secure and private cloud environment, ensuring that neither Meta nor WhatsApp can access user data. Key technical components include anonymous credentials for authentication, Oblivious HTTP (OHTTP) for routing and encryption via third-party relays, and Remote Attestation + Transport Layer Security (RA-TLS) sessions for secure communication between the user's device and the TEE. The system is designed with foundational requirements for confidential processing, enforceable guarantees, and verifiable transparency, along with additional layers for non-targetability and stateless processing with forward security. A detailed threat model was developed, considering assets, threat actors (insiders, third parties, malicious end users), and threat scenarios such as external exploitation of product attack surface, extraction of messages from CVMs, and interference with CVMs at boot and runtime.

4/28/2025

This post details Meta's significant investments in data understanding technologies as part of its Privacy Aware Infrastructure (PAI). It introduces a 'shift-left' approach by integrating data schematization and annotations early in product development, and a universal privacy taxonomy for standardized data privacy management. The post highlights the evolution of data understanding over the past decade, from heuristic-based classification to a more robust system involving schematization, annotation, and inventorying data assets in OneCatalog. It addresses challenges like understanding data at scale, inconsistent definitions, missing annotations, and organizational barriers, proposing solutions like shared asset schema formats, unified taxonomies, and collaborative tooling. A walkthrough of the 'Beliefs' feature in Facebook Dating illustrates the five-step approach to data understanding, emphasizing the importance of schematization using DataSchema and predicting metadata at scale through a universal privacy taxonomy and data classification.

2/18/2025

Introduced static analysis tools (Zoncolan for Hack, Pysa for Python) to proactively detect and prevent data scraping vectors by analyzing data flow from user-controlled sources to sinks. This allows for early remediation of potential scraping issues before code is deployed to production.

2/13/2025

This post details the expansion of Meta's bug bounty program in 2024, highlighting over $2.3 million in bounties awarded and a total of over $20 million since 2011. It emphasizes collaboration with security researchers on GenAI, AR/VR, and ads tools, including specific scope for LLM reports (e.g., model inversion, extraction attacks) and new payout guidelines for PII in ads audience tools. It also mentions security research into mixed reality hardware (Quest 3, Ray-Ban Meta glasses) and community engagement through events like the Meta Bug Bounty Researcher Conference.

1/23/2025

This post details how Meta leverages data lineage as a core component of its Privacy Aware Infrastructure (PAI) to enhance application security and permissions. It explains the development of techniques for collecting data flow signals (static code analysis, runtime instrumentation, data matching) and the creation of tools like Privacy Probes and Policy Zone Manager (PZM) to automate lineage tracking. The post provides a walkthrough of implementing data lineage for sensitive data like 'religion' in Facebook Dating, illustrating the process of collecting signals from web and data warehouse systems to ensure purpose limitation and compliance.

11/12/2024

Introduced a large-scale cryptographic monitoring system for FBCrypto, Meta's managed cryptographic library. This system uses a buffering and flushing strategy to aggregate cryptographic events without sampling, minimizing performance impact. Optimizations include partially randomized flushing for uniform write throughput and aggregation of derived crypto operations under parent keys. The monitoring provides deep visibility into cryptography usage, enabling proactive mitigation of security vulnerabilities, setting cryptographic maturity standards, and supporting PQC migration.

10/22/2024

Introduced Identity Proof Linked Storage (IPLS), a novel system for WhatsApp that allows users to store contact names in an encrypted way. IPLS leverages client-generated encryption keys, authentication based on primary device identity, and integrates with WhatsApp's existing Auditable Key Directory (AKD) and Hardware Security Modules (HSM). The system uses AKD to map phone numbers to identity keys and partners with Cloudflare as a witness for AKD updates. Contact names are encrypted with a device-generated symmetric key and stored in HSM-based Key Vaults, enabling secure restoration on new devices.

8/28/2024

This post announces Meta's readiness for post-quantum cryptography, highlighting ongoing work to secure systems against future quantum attacks. It references engineers leading this effort and points to a related blog post detailing TLS PQR at Meta, indicating a proactive migration and development in cryptographic security.

8/27/2024

Introduced Policy Zones as an Information Flow Control (IFC) based technology to enforce purpose limitation at scale. Policy Zones encapsulates, evaluates, and propagates privacy constraints for data in transit and at rest, integrating with systems like HHVM, Presto, and Spark. It enables granular, real-time control over data flows by annotating data assets and enforcing rules based on context, moving beyond traditional point-checking and data lineage methods. The Privacy Aware Infrastructure (PAI) initiative expands on this by embedding first-class privacy support into Meta's infrastructure.

5/22/2024

This post details Meta's migration to post-quantum cryptography (PQC) for TLS, focusing on protecting internal communication traffic against 'store now, decrypt later' attacks. It introduces the use of hybrid key exchange combining classical and PQC algorithms (Kyber768/Kyber512 with X25519) via the Fizz TLS library and liboqs. Key technical challenges discussed include managing large packet sizes for TLS resumption and TCP Fast Open, leading to the adoption of Kyber512 for certain internal communications, and resolving a multithreading race condition in liboqs. It also touches upon cross-domain resumption handshake thrash.

12/7/2023

This post details the technical implementation and challenges of enabling end-to-end encryption (E2EE) by default for Messenger personal conversations. It introduces the Labyrinth encrypted storage protocol for E2EE message history and discusses the cryptographic protocol for message transmission. Key technical challenges addressed include multi-device capability, feature support (e.g., using OHAI and Anonymous Credentials for sticker library searches), message history management with Labyrinth, and web support for E2EE.

11/8/2023

Introduced 'Silence Unknown Callers' feature for WhatsApp calls, which silences calls from unknown numbers and protects users from cyber attacks by using a specialized protocol enforced by servers to reduce the attack surface. Developed a new technology called privacy tokens to enable server-side silencing without compromising end-to-end encryption or user privacy. Implemented 'Protect IP Address in Calls' feature, relaying calls through WhatsApp servers to hide user IP addresses and general geographical location from other call participants, enhancing privacy.

9/12/2023

This post details the discovery and exploitation of a memory corruption vulnerability in Meta Quest 2's VR Runtime service. The vulnerability, triggered by an unprivileged application via Runtime IPC, allowed for arbitrary 8-byte corruptions at arbitrary offsets within a statically-sized array. The exploit chain successfully turned this into arbitrary native code execution by overwriting a function pointer within the Vulkan loader, demonstrating a method to escalate privileges on the device and informing security improvements for Meta Quest products.

8/8/2023

Introduced Private Data Lookup (PDL), a system based on Private Set Intersection (PSI) for privacy-preserving password prechecks. PDL allows users to privately query a server-side dataset of compromised passwords without revealing their attempted passwords to Meta. Optimized the initial implementation by pre-processing compromised password data, sharding the dataset, and compressing blinded hash values to reduce latency and bandwidth usage. This enables stronger password security by proactively checking against breached passwords while minimizing data collection.

8/7/2023

Introduced short-lived certificates (SLCs) for TLS private keys on edge networks, reducing certificate validity from months/years to days (specifically 10 days exposure, daily rotation). This involved building a robust automation pipeline (ConfigBuilder) for certificate issuance and distribution, enhancing the OffloadService to handle frequent secret fetches, and implementing a staged rollout process with canaries and wider deployments to ensure reliability. Explored and rejected protocol layer revocation and remote offload due to latency and reliability concerns. Also experimented with delegated credentials but noted browser adoption limitations.

5/3/2023

This post details the technical analysis of the NodeStealer malware, a custom-built strain written in JavaScript and executed using Node.js, compiled into a Windows executable. It highlights the malware's tactics for disguise (e.g., mimicking PDF/XLSX files), its file metadata manipulation, and its packaging using the 'pkg' tool from NPM. The post also discusses the broader threat landscape, including the evolution of Ducktail malware and the use of generative AI lures by other malware families, emphasizing adversarial adaptation and the need for continuous detection and disruption efforts.

4/13/2023

Introduced a new cryptographic security feature for WhatsApp based on key transparency, enabling automatic verification of secure connections. Developed and open-sourced the Auditable Key Directory (AKD) library in Rust, which forms the foundation for this feature. The AKD maintains an append-only directory of public keys mapped to user accounts and generates publicly auditable change logs, strengthening end-to-end encryption guarantees by allowing clients to automatically validate encryption keys and providing a transparent, verifiable record of key changes. This system complements existing manual security code verification by offering an automated, scalable solution, particularly beneficial for large groups or frequent key changes.

4/13/2023

Introduced Device Verification for WhatsApp, a new security feature to prevent account takeover attacks facilitated by malware. This feature leverages a security-token, nonce, and authentication-challenge to verify client connections to WhatsApp servers, blocking connections originating from outside the user's device that attempt to impersonate the user by stealing authentication keys. This protects against threats from unofficial WhatsApp clients containing malware.

12/12/2022

Introduced the Anonymous Credential Service (ACS) as a highly available multitenant service for de-identified authentication. Detailed the two-phase protocol (token issuance and token redemption) based on VOPRFs and blind signatures. Discussed challenges in scaling the protocol, including token redemption counting, key rotation strategies, and the implementation of key transparency using attribute-based VOPRFs and key derivation functions. Provided an overview of the ACS library components and a demonstration of its use in a real system.

7/20/2022

This post details the discovery and exploitation of an out-of-bounds (OOB) read vulnerability in Hermes's Quicksort implementation. The vulnerability arises from the interaction between a stable sort implementation that uses an index vector and a custom comparison function that modifies the array during sorting. By extending the array and carefully controlling the comparison function's return values, an attacker can cause the sorting algorithm to access indices beyond the bounds of the index vector, leading to an OOB read. Further investigation revealed that this OOB read could be escalated to arbitrary code execution by manipulating swaps within the Quicksort algorithm, specifically by underflowing the 'j' index and defining a custom getter for the out-of-bounds access. The post demonstrates the exploit by running the game Doom within Hermes.

7/20/2022

This post details Meta's collaboration with the security industry to enhance internet security. It highlights the use of static analysis tools like Zoncolan for bug detection in internal code (e.g., Messenger backend), the work of Red Team X in identifying and reporting vulnerabilities in third-party hardware and software (e.g., Schneider Electric PLCs, Airspan eNodeBs, Apple's Big Sur, EternalTerminal), and the contributions of bug bounty researchers in finding complex issues in Meta's platforms (e.g., Facebook API, Instagram). The post emphasizes the importance of information sharing and responsible disclosure in advancing industry-wide security.

3/30/2022

Introduced Anonymous Credential Service (ACS) as a new privacy-enhancing technology (PET) to enable de-identified authentication at source, moving from reactive data minimization to proactive de-identification. Detailed the protocol leveraging anonymous credentials, VOPRFs, and blind signatures, involving token issuance and de-identified authentication phases. Highlighted real-world use cases in WhatsApp telemetry and federated learning, and discussed the ACS architecture, scaling lessons learned (credential reuse limits, traffic dithering, global rate limiting), and self-service onboarding improvements.

3/10/2022

Introduced Code Verify, an open-source browser extension that automatically verifies the authenticity of web code served to users. This enhances security for web applications like WhatsApp Web, Messenger, and Instagram Web by comparing the code running in the browser against a cryptographic hash source of truth verified by Meta and published via a partnership with Cloudflare. The extension provides real-time alerts (green, orange, or red) to users if inconsistencies are detected, ensuring the code hasn't been tampered with. The open-sourcing of Code Verify aims to encourage adoption by other services and foster community contributions.

10/20/2021

This post details the development and deployment of static analysis tools (Infer, Zoncolan, Pysa, Mariana Trench) for security bug detection across multiple programming languages (Hack, Python, Java/Android). It highlights the investment in these systems to scale security reviews, the feedback loop with security engineers, and the open-sourcing of Pysa and Mariana Trench. It also positions these tools within a broader defense-in-depth strategy including runtime analysis, code reviews, and bug bounty programs.

9/29/2021

This post introduces Mariana Trench (MT), an open-sourced tool for static and dynamic analysis of Android and Java applications to detect security and privacy bugs. MT analyzes data flows by defining sources and sinks and uses abstract interpretation to model Java methods. It prioritizes finding potential issues, even with false positives, and integrates with pull request workflows. A companion tool, Static Analysis Post Processor (SAPP), is also discussed for triaging MT's output.

9/10/2021

Introduced end-to-end encrypted (E2EE) backups for WhatsApp, developing a new system for encryption key storage that works with both iOS and Android. This system generates a unique, randomly generated encryption key for backups, which users can secure manually or with a password. When a password is used, the key is stored in an HSM-based Backup Key Vault, which enforces password verification attempts and renders the key inaccessible after a limited number of unsuccessful attempts. The HSM-based Backup Key Vault is geographically distributed across multiple data centers for high availability and reliability.

7/12/2021

This post details the design and implementation of SSLWall, a system developed to enforce transit encryption policies across Meta's network. It leverages eBPF, kprobes, and tc-bpf to inspect and block non-SSL connections at the kernel level without application modifications. The post also introduces Transparent TLS (TTLS) to handle edge cases and legacy applications, using eBPF to redirect connections to a local proxy. Key technical challenges and design decisions, including handling TCP Fast Open and BPF program size limits, are discussed.

4/16/2021

Introduced De-identified Telemetry (DIT), a new system for collecting usage, reliability, and performance data on WhatsApp in a privacy-protective manner. DIT utilizes an Anonymous Credential System (ACS) built on Verifiable Oblivious Pseudorandom Functions (VOPRFs) and HMAC to authenticate data without the server learning the origin, thereby minimizing metadata tied to specific users. The system involves a two-step workflow: clients obtain anonymous tokens via VOPRFs and then use these tokens with HMAC to upload logs over unauthenticated connections. Practical considerations for scaling DIT include curve choice (Curve25519), unlinkability guarantees via pseudonymous identifiers, re-identification risk mitigation, rate limiting through key rotation, and communication cost optimization by reusing tokens and co-locating ACS servers.

8/12/2020

Introduced DELF, a framework for safeguarding data deletion correctness in online social networks. DELF enables developers to implement deletion logic via annotations rather than repetitive code, supporting billions of deletions daily. It employs correctness validation techniques, including static and dynamic checks, to prevent data retention or accidental deletion. DELF also handles asynchronous graph traversal for deletion, maintains a restoration log for undo operations, and automatically retries deletions, surfacing persistent errors to developers.

8/7/2020

Introduced Pysa, an open-source static analysis tool for Python, built on Pyre. Pysa detects security and privacy issues by analyzing data flows from sources to sinks, identifying vulnerabilities like XSS and SQL injection. It was inspired by Zoncolan and has been applied to Instagram's Python codebase, providing rapid analysis of proposed code changes. The post details Pysa's mechanism, its handling of false positives/negatives with sanitizers and features, and its limitations, particularly concerning dynamic Python features and non-data-flow security issues.

7/21/2020

Introduced a scalable data classification system that uses multiple data signals, a scalable system architecture, and machine learning to detect semantic types within Facebook at scale. The system handles both persistent data (via Bernoulli sampling, feature extraction, and ML classification) and online data (via a real-time prediction API). It incorporates a modular PyTorch-based ML model for unstructured data classification and aims to provide flexibility for adding new data type detections with low latency and tight memory constraints.

7/10/2020

Introduced two new cryptographic protocols, Private-ID and PS3I, for private matching for compute. Private-ID performs an outer join and reveals only the size of the intersection using elliptic curve cryptography. PS3I performs an inner join and outputs encrypted matching records using elliptic curve cryptography and Paillier encryption. These algorithms enable secure data alignment for downstream computations within privacy-enhancing technologies like multiparty computation, with performance demonstrated for datasets up to 100 million records within an hour.

12/13/2019

This post details technical approaches to fighting abuse at scale, including deep entity classification (DEC) using multi-stage, multi-task learning and social graph embeddings to detect fake accounts; unsupervised learning for detecting fake/compromised accounts and abusive automation; temporal interaction embeddings (TIEs) to capture user behavior sequences for integrity issue detection; and collaborative efforts between sharing and hosting platforms to identify and remove terrorist content. It also covers building and scaling human review systems for content labeling and enforcement, and detecting payment and revenue share fraud using machine learning and heuristic-based algorithms.

11/1/2019

Introduced the concept and implementation of delegated credentials as an extension to the TLS protocol. This allows servers to generate short-lived credentials signed by their leaf certificate, enabling significantly reduced certificate lifetimes (hours instead of months/years) without impacting reliability. This mitigates risks associated with compromised certificates by limiting their validity period and reduces reliance on traditional, less effective revocation mechanisms like OCSP. The implementation is integrated into Fizz (TLS 1.3) and a test endpoint is provided.

10/16/2019

Introduced the concept of partially blind signatures as a cryptographic technique to combat fraud in event reporting while preserving user privacy. The post details how blind signatures can obscure individual requests by having signers not see the original data, and how using different blinding factors for each step in a user journey prevents linkability across requests. It also suggests that browsers or operating systems could facilitate this process to enhance security and privacy by managing nonces and blinding factors on-device and handling signature requests out-of-band.

8/15/2019

Introduced Zoncolan, a static analysis tool that uses abstract interpretation to automatically detect security and privacy issues in Facebook's Hack codebase. Zoncolan analyzes code to identify potentially dangerous data flows from user-controlled inputs (sources) to sensitive operations (sinks), preventing thousands of potential security issues by analyzing the entire codebase in under 30 minutes and codifying rules to prevent future occurrences.

5/29/2019

This post details Meta's migration of its internal data center service encryption from Kerberos to TLS. Key technical contributions include the design and implementation of a TLS-based mutual authentication system using X.509 certificates, the integration with an internal Certificate Authority (ICA) for provisioning host and identity certificates during container setup, and strategies for managing trade-offs between security and operability at scale. Specific improvements include fetching certificates at container setup time to prevent request errors, using session tickets for connection resumption to reduce CPU usage, and robust rotation of TLS certificates for perfect forward secrecy.

11/18/2016

This post details the Spam Fighting @Scale 2016 conference, highlighting key technical and strategic approaches to combating spam and abuse across various technology companies. It emphasizes the importance of effective measurement (user feedback, weighted sampling), treating spam fighting as an engineering problem with economic considerations (disrupting payment providers), the acceptance of imperfect but cost-raising defenses, the prevalence of fake accounts, the utility of clustering for abuse detection, aligning incentives, and the possibility of fighting spam without content access (e.g., for end-to-end encrypted platforms). Specific talks covered Netflix's defense against account takeover and payment fraud, Facebook's weighted sampling for spam prevalence, LinkedIn's clustering for fake account detection, WhatsApp's success in reducing spam with end-to-end encryption, Airbnb's detection of fake inventory using ML and image similarity, and Facebook's organizational and technical strategies for anti-spam by design.

9/12/2016

This post details Meta's implementation of signed SSH certificates with principals for scalable and secure access to production systems. It explains how this approach addresses the limitations of traditional password-based and public-key authentication in large-scale environments by leveraging certificate authorities (CAs) for authentication and authorization. The post outlines the design principles, including separating authentication and authorization, using local accounts for root logins with certificate-based authorization, and implementing security domains. It also provides a practical guide on setting up a rudimentary CA and signing certificates with principals, demonstrating how to configure SSH servers to trust these certificates and enforce access control based on principals.

2/10/2016

This post details Meta's security practices for the open-source osquery project, emphasizing constant vigilance through developer security questioning, full-pipeline awareness including build and packaging infrastructure security, integration with the bug bounty program, and third-party security assessments. It highlights the importance of a proactive, offensive mindset in secure software development and the value of community involvement in identifying and fixing vulnerabilities.

1/30/2016

This post details the evolving landscape of hardware and firmware attacks and introduces osquery as a tool for defense and detection. It highlights the addition of hardware monitoring to osquery, enabling security teams to gain insights into system behavior, detect compromises, and manage vulnerabilities. The post discusses specific attack vectors like drive firmware attacks, EFI RATs, and the challenges of securing firmware due to its early execution and black-box nature. It proposes defense strategies including tracking kernel modules, auditing bootloaders, and leveraging osquery for collecting hardware-related signals and event-based data.

11/16/2015

This post details advancements in engineering security at Facebook, including the development of the Security Infrastructure team to make secure options easier for engineers, the creation of tools like osquery for intrusion detection and response, and the Invariant Detector for automated permission checks and threat detection. It also highlights contributions to security standards like Elliptic Curve Cryptography and discusses strategies for visualizing cybersecurity data at scale, building trusted computing infrastructure, and adopting a hacker mindset for security testing.

7/20/2015

This post introduces 'query packs' for osquery, a host instrumentation platform. Query packs allow for the grouping of osquery queries by function or problem domain, making them easier to distribute, update, and manage. The post highlights the release of internal Facebook query packs for incident response, vulnerability management, and OS X attacks, aiming to improve security monitoring, intrusion detection, and compliance efforts. It also encourages community contributions to expand the query pack ecosystem.

6/26/2015

This post details the redesign of Facebook's spam detection system, Sigma, which now utilizes Haskell. It highlights the migration from an in-house language (FXL) to Haskell for improved performance, expressivity, and safety. Key contributions include the development of the Haxl framework for automatic data fetching concurrency and the implementation of hot-swapping for compiled code to enable rapid policy deployment. The post also quantifies performance gains and discusses resource limit management within the Haskell-based Sigma system.

6/3/2015

This post introduces osquery as an open-source framework for low-level operating system monitoring, highlighting its potential to improve industry-wide security through collaboration and information sharing. It details the 'defender's dilemma' and the need for open innovation in security, drawing parallels to advancements in the databasing industry. The post emphasizes the collaborative development model of osquery on GitHub, where user contributions shape new features, citing examples of community-driven enhancements like encrypted hard drive visibility and Yara pattern matching support.

5/15/2015

This post details the Spam Fighting @Scale conference, highlighting the collaborative efforts and shared techniques among various tech companies (Facebook, Pinterest, Dropbox, Yelp, LinkedIn) to combat spam and abusive content at scale. It emphasizes key considerations such as flexible aggregation, latency, understanding spam requirements, product changes over classifiers, human factors, economic impact on spammers, and knowledge sharing. Specific technical discussions included event-based processing, aggregation techniques (counter-based and cluster-based), Haxl for data access, and the development and use of ThreatExchange for threat intelligence sharing. The post also touches upon lessons learned from dealing with malicious apps, clickjacking, and OAuth abuse, and LinkedIn's approach to spam detection in small-text fields.

11/5/2014

This post is a recap of the Security @Scale 2014 conference, highlighting discussions and presentations on scaling security solutions for large online services. Key technical contributions and discussions included: Square's scaling of vulnerability management, access control, and security monitoring with tools like Report Card, Doorman, and Sting; Facebook's Site Integrity team's work on scalable spam fighting using Haxl for efficient rule engines; Twitter's 'all TSL everything' initiative to transition to HTTPS and their use of secure headers; Facebook's open-sourcing of osquery for host intrusion detection using SQL queries; Facebook's homebrew incident response strategy and Network Security Monitoring platform; and GitHub's use of ChatOps with Hubot for incident response.

2/4/2014

Introduced Conceal, a set of Java APIs for efficient and secure storage encryption on Android. Conceal addresses the privacy limitations of Android's SD card storage by encrypting private data. It prioritizes efficiency and lightweight design by using specific cryptographic algorithms from OpenSSL, reducing its size to 85KB. Conceal abstracts complex cryptographic choices, defaults to AES-GCM for authenticated encryption, and handles security details like Android's random number generator weaknesses and key management. It provides a simple API for encrypting/decrypting data streams and includes benchmarks for performance analysis.

7/31/2013

This post details the migration of Facebook to using HTTPS by default for all users, a significant step in enhancing application security and data privacy. It outlines the technical challenges and solutions implemented, including the secure attribute for authentication cookies, an insecure indicator cookie, ensuring third-party platform applications support HTTPS, controlling referrer headers, and strategies for in-flight session upgrades. Performance considerations for HTTPS, such as leveraging edge networks and reducing full TLS handshakes through abbreviated handshakes and session resumption, are also discussed. Future plans include adopting 2048-bit RSA keys, Elliptic Curve Cryptography, ECDHE for perfect forward secrecy, certificate pinning, and HSTS.

2/6/2013

This post details Facebook's adoption and contribution to the DMARC protocol for fighting email phishing. It highlights the company's early adoption of an early DMARC protocol in 2011, their hosting of an interoperability event to test and iterate on the protocol and its implementations, and the positive impact of DMARC in protecting a significant portion of global mailboxes and Facebook's user base. The post also touches on the complexity of email technology and the engineering agility required to implement such security measures.

1/24/2013

This post introduces FXL (Feature eXtraction Language), a domain-specific language developed to combat evolving spam threats on Facebook. FXL is described as a narrowly-optimized subset of Standard ML, designed for efficient data fetching across the graph. Its key innovation lies in its pure function execution model, which allows for automatic optimization through batching of data fetches and memoization, leading to significant performance improvements in spam detection compared to naive execution models. This directly contributes to the 'combating evolving spam and abuse' aspect of the application security and permissions feature thread.

10/11/2012

This post details the development of the first mobile advertising interface for Facebook, specifically for the Pages Manager iOS app. It highlights the integration of 'Promoted Posts' functionality into a mobile context, requiring a performant client-side UI, scalable API endpoints, and internationalization considerations. The project involved collaboration with platform, internationalization, and payments teams, and utilized BoltJS for UI development. It also showcases the design of a streamlined mobile ad management interface with insights, emphasizing user control and impact visibility.

9/14/2012

Introduced a new link shim implementation that pre-checks all links on a page for maliciousness before sending them to the browser, rather than checking only clicked links after a delay. This change leverages the 'meta referrer' feature in modern browsers to restrict the amount of source URL information shared with external sites, improving both performance (saving ~1 second per click) and privacy.

2/1/2012

This post details the development and open-sourcing of DMARC (Domain-based Message Authentication, Reporting & Conformance) as a major anti-phishing effort. It explains DMARC's technical mechanism, which builds on SPF and DKIM to allow domain owners to receive reports on email authentication, audit their infrastructure, and request mailbox providers to reject unauthenticated email. The post highlights DMARC's flexibility through configurable percentages and subdomain support, and its adoption as an open specification under the Open Web Foundation Agreements. Facebook was an early adopter, publishing the first DMARC DNS records.

1/27/2012

This post details the author's first year on the Site Integrity Recon & Response (SI-RAR) team, focusing on the technical challenges and systems developed to combat emerging spam threats. It describes the evolution of attacks, including fake account creation with sophisticated evasion tactics, social engineering attacks like self-XSS that exploit user behavior rather than code vulnerabilities, and the shift to malicious browser extensions. The post highlights the importance of real-time classification systems, data-driven monitoring of negative interactions, and the continuous arms race nature of spam fighting, emphasizing the need for proactive defense and rapid iteration.

5/12/2011

Introduced Login Approvals, an opt-in two-factor authentication system that requires users to enter a code sent via SMS to their mobile phone when logging in from a new or unrecognized computer. This feature aims to provide enhanced account security by adding an extra layer of verification beyond just a password. The post discusses the trade-off between security and usability, opting for SMS as the second factor to maximize user adoption.

5/25/2010

Introduced a technical solution to remove user IDs from referrer links, preventing advertisers from inferring user IDs when users click on ads. This involved developing a cross-browser compatible redirector mechanism that successfully redirects users while obscuring the source page, detailing various HTTP redirect methods (302, Refresh, Meta Refresh) and JavaScript-based redirects (document.location.replace(), anchor click(), 2-way shimmed anchor click) and their browser-specific behaviors. A fallback 'Refresh:1;URL=http://B.com' header was implemented for non-JavaScript environments.

1/30/2009

This post details the technical implementation of integrating Facebook features with Apple's iPhoto '09, specifically focusing on bi-directional syncing of name tags and photos. It highlights enhancements to Facebook's APIs to support this integration, including determining when name tags are added on Facebook, keeping them in sync with iPhoto, and providing familiar Facebook privacy controls. This represents an early example of extending Facebook's platform capabilities to third-party applications through its APIs.