Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIn September 2018, attackers used a chain of three bugs in Facebook’s View As feature to steal login access tokens and take over accounts. Meta later said about 30 million people had their tokens stolen—revising its initial estimate of almost 50 million accounts. The incident was a token-theft attack, not a confirmed mass password theft.
How the View As bug let attackers into accounts
View As lets a Facebook user preview how their profile appears to another person. It was meant to be read-only, but three implementation mistakes combined to make the preview a route to an account’s access token. Meta described the chain in its September 28, 2018 security update.
- A birthday-post composer appeared in View As and incorrectly allowed a video to be posted, even though the feature should not have allowed posting.
- The video uploader, introduced in July 2017, generated an access token with permissions associated with Facebook’s mobile app.
- The token was generated for the person being viewed, rather than for the person using View As, and appeared in the page’s HTML. Attackers could extract it and use it to access the other person’s account.
An access token is a credential that lets a service recognize a logged-in user without asking for a password again. After obtaining a token for an account they could reach, attackers used the same method to pivot to connected friends’ accounts and obtain more tokens.
How many people were affected?
Meta’s figures changed as it investigated. The clearest distinction is between tokens confirmed stolen and tokens reset as a precaution:
#1 Best Overall
- A more natural connection. Smart Camera adjusts automatically so you can move freely and stay in frame, while Smart Sound ensures you can easily be heard.
- Call anyone, anywhere. Use apps like Messenger and WhatsApp to connect with friends and family—even if they don’t have a Meta Portal.
- Designed for the home. With a sleek picture frame design, quick setup and intuitive voice and touchscreen controls, Portal fits easily and seamlessly into your home.
- Privacy by design. Easily disable the camera and microphone, or block the lens with the camera cover.
| Figure | What it means |
|---|---|
| Almost 50 million accounts | Meta’s initial estimate of accounts affected by the attack, announced September 28, 2018. |
| About 30 million people | Meta’s later finding of people whose access tokens were actually stolen, announced October 12, 2018. This is the confirmed token-theft figure. |
| 40 million additional accounts | Accounts whose tokens Meta reset as a precaution because they had used View As during the preceding year. |
| About 90 million accounts | The combined total whose tokens were reset in the initial response: the initially identified group plus the precautionary group. |
The later 30-million finding is not interchangeable with the initial 50-million estimate or the 90-million reset total. The first two describe different stages of Meta’s investigation; the 90 million includes accounts reset cautiously, not just accounts confirmed to have had tokens stolen. Meta reported the revised figure in its October 12, 2018 update.
What information could attackers see?
With a stolen token, an attacker could access an account and make requests to Facebook’s APIs. Meta’s initial disclosure said attackers queried profile fields including name, gender and hometown. It did not establish that every affected account had the same information accessed.
Rank #2
- Scale up your greatest conversations. Smart video calling on your TV brings your favorite people, larger-than-life, into your living room.
- Share the room. Perfect for group calls. Meta Portal TV captures your whole room so everyone is in view without jostling for position.
- Call anyone, anywhere. Use apps like Messenger and WhatsApp to connect with friends and family—even if they don’t have a Meta Portal.
- A more natural connection. Smart Camera adjusts automatically so you can move freely and stay in frame, while Smart Sound ensures you can be heard clearly.
- Privacy by design. Easily disable the camera and microphone, or block the lens with the camera cover.
At the time of the initial disclosure, Facebook said it had no evidence that private messages or credit-card information had been accessed. That was a statement about the evidence available during the investigation, not proof that every possible kind of information was untouched. The incident should not be described as a confirmed theft of everyone’s messages, payment details or passwords.
When Facebook found and stopped the attack
- July 2017: The vulnerable code was introduced.
- September 14, 2018: Facebook observed a spike in unusual activity.
- September 25, 2018: Facebook determined the activity was an attack and identified the vulnerability.
- Within two days: Facebook closed the vulnerability, stopped the attack and reset potentially exposed tokens.
Facebook temporarily disabled View As and notified law enforcement, including the FBI. Meta later said it re-enabled an unaffected version of the feature after a security review. These dates and response details are from Meta’s October 12 account of the incident.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Feel close, wherever you roam. With the best of Meta Portal smart video calling made portable, you can take the conversation anywhere in your home.
- Designed for calls on the go. A long-lasting battery and integrated handle make it easy to move from room to room.
- Call anyone, anywhere. Use apps like Messenger and WhatsApp to connect with friends and family—even if they don’t have a Meta Portal.
- A more natural connection. Smart Camera adjusts automatically so you can move freely and stay in frame, while Smart Sound ensures you can always be heard.
- Great sound anywhere. Listen to music with a speaker that can fill any room. Doubles as a portable Bluetooth speaker around the home.
What Facebook Login users needed to do
Because Facebook reset tokens for the affected and precautionary groups, people in those groups had to log in again to Facebook and apps that used Facebook Login. Meta described that response and the third-party app impact in its October 2, 2018 Facebook Login update.
The immediate practical effect was a sign-in prompt: a third-party app could no longer rely on the invalidated Facebook token and required a fresh login. The disclosed response was token invalidation, not a universal instruction to change passwords. If a Facebook Login app stopped recognizing a session at the time, signing in again was the step relevant to this incident.
Rank #4
- Move and talk freely with Smart Camera: With Smart Camera, you don’t have to worry about being out of frame. Whether you’re moving around the kitchen, prepping dinner or chasing the kids through the living room, Smart Camera adjusts to follow the action. And as more people enter a room, Smart Camera automatically widens to keep everyone in view, so you don’t miss a moment
- Private by design: Facebook doesn't listen to, view or keep the contents of your Portal video calls. Calls on Portal are encrypted, so conversations stay between you and those you're calling. You can also completely disable the camera and microphone with a single tap, or block the camera lens with the camera cover provided
- Connect with friends, even if they don't have Portal: Easily call friends and family on Messenger — calls can be made seamlessly to and from smartphones and tablets. And you can bring up to six other people into a group call
- Alexa built-in: Portal has Alexa built-in, so you can ask a question, set a timer, add items to your shopping list, control your smart home or more. Just ask
- Experience more together: With Portal, story time will never be the same. With music, animation and augmented reality effects, Portal lets you become some of your children’s favorite characters as you read along to well-loved stories. And if friends or family also have Portal, you can listen to your favorite music together as if you were in the same room, without delays or feedback
Why three small flaws became a major breach
The weakness was not simply that View As existed or that Facebook used tokens. It was the interaction: a supposedly read-only screen exposed a posting control; an uploader minted a token with broader app permissions than the screen needed; and that token belonged to the person being previewed and was exposed in page markup. Each boundary failure made the next one exploitable.
- A preview feature should not expose a composer or action that can publish content.
- An upload component should create only the credentials needed for its intended context.
- Tokens should be issued for the correct user, narrowly scoped, and kept out of page content attackers can inspect.
The incident also shows why an access token is sensitive even though it is not a password: whoever holds a valid token may be able to act as the logged-in user until the token expires or is revoked.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- A more natural connection. Smart Camera adjusts automatically so you can move freely and stay in frame, while Smart Sound ensures you can easily be heard.
- Call anyone, anywhere. Use apps like Messenger and WhatsApp to connect with friends and family—even if they don’t have a Meta Portal.
- Designed for the home. With a sleek picture frame design, quick setup and intuitive voice and touchscreen controls, Meta Portal fits easily and seamlessly into your home.
- Privacy by design. Easily disable the camera and microphone, or block the lens with the camera cover.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
