It&#x27;s not the main point of the post,  which is Facebook&#x27;s response to the researcher,  but I&#x27;m really surprised that they&#x27;re storing unencrypted secret keys and source code on S3. They trust Amazon a lot and have no fear that somebody could eavesdrop Amazon servers (if I were a black hat I&#x27;d go for the accounts of the big guys, not for the one of a random guy)<p><a href="http:&#x2F;&#x2F;www.exfiltrated.com&#x2F;research-Instagram-RCE.php#One_Key" rel="nofollow">http:&#x2F;&#x2F;www.exfiltrated.com&#x2F;research-Instagram-RCE.php#One_Ke...</a><p>I wonder what any claim of protecting user&#x27;s privacy is worth when they leave their credentials unprotected in that way.<p><a href="https:&#x2F;&#x2F;www.instagram.com&#x2F;about&#x2F;legal&#x2F;privacy&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.instagram.com&#x2F;about&#x2F;legal&#x2F;privacy&#x2F;</a><p>&quot;We use commercially reasonable safeguards to help keep the information collected through the Service secure [...]&quot;<p>Ops.<p>I can imagine why they didn&#x27;t appreciate the efforts of the researcher. Hopefully they&#x27;ll change their current practices.