Facebook stored usernames/passwords in plain text

[Hemi-Cuda]

Might want to update your FB password, and any site that would have used the same one


https://krebsonsecurity.com/2019/03/...ext-for-years/

[Fuzz]

I have no idea how such a huge organization can be that obviously negligent. Like not just a little bit, that's colossal. Do they not have someone in charge of security? Maybe if governments started bringing criminal charges for this kind of negligence it would stop happening.

[photon]

Originally Posted by Fuzz

I have no idea how such a huge organization can be that obviously negligent. Like not just a little bit, that's colossal. Do they not have someone in charge of security? Maybe if governments started bringing criminal charges for this kind of negligence it would stop happening.

Doesn't take much for this kind of thing to happen.. One developer logs certain information not realizing that the operations team has changed to aggregating all the logs for that and other servers into a service for that kind of thing and suddenly you're storing stuff in clear text you shouldn't be.

Shouldn't happen, but stuff like this is all to easy to occur in large systems with lots of developers and operations people all doing different things with different goals.

[Fuzz]

Why are they storing passwords plain text though? They have no reason to not have them salted and encrypted in such a way that no one could read them even if they wanted to.

[ZedMan]

I'm sure they store passwords salted and hashed (never encrypt passwords).
From the article:

Facebook is probing a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers.
(emphasis mine)

[photon]

Yeah.. while they likely store password hashes, but you still have to first accept a password as part of the process, and they must have had logging where those passwords are logged to a log file after they're accepted as input by whatever system but prior to them being hashed and stored.

[Stealth22]

Originally Posted by Fuzz

I have no idea how such a huge organization can be that obviously negligent. Like not just a little bit, that's colossal. Do they not have someone in charge of security? Maybe if governments started bringing criminal charges for this kind of negligence it would stop happening.

Right? Even if you leave the negligence part aside, to me as a developer, logging/storing the plain text password is just...stupid. There's no other way to say it.

By the way, I'd recommend LastPass to anyone who doesn't already use it. Keeps track of all your passwords, and you can easily generate a different secure password for each site.

[Shazam]

Great, now they know the password for my luggage.

[DownhillGoat]

Originally Posted by Fuzz

I have no idea how such a huge organization can be that obviously negligent. Like not just a little bit, that's colossal. Do they not have someone in charge of security? Maybe if governments started bringing criminal charges for this kind of negligence it would stop happening.

Considering the government can and has been just as negligent - I'd rather see my FB password lifted than my unencrypted hard drive go missing with my SIN number on it.

[Finger Cookin]

I solved this problem by deleting Facebook years and years ago.

[Azure]

Originally Posted by photon

Doesn't take much for this kind of thing to happen.. One developer logs certain information not realizing that the operations team has changed to aggregating all the logs for that and other servers into a service for that kind of thing and suddenly you're storing stuff in clear text you shouldn't be.

Shouldn't happen, but stuff like this is all to easy to occur in large systems with lots of developers and operations people all doing different things with different goals.

Considering how much profit Facebook generates each quarter they could easily allocate a LOT more money to security.

They don't care, and Zuckerburg thinks he is above the law.

[Hemi-Cuda]

Originally Posted by Azure

Considering how much profit Facebook generates each quarter they could easily allocate a LOT more money to security.

They don't care, and Zuckerburg thinks he is above the law.

Well he is, he's a billionaire with deep pockets to buy political favor. That's about as above the law as you can get