Facebook says it stored millions of passwords in plain text

kvue ^ | Mar. 21, 2019 | Barbara Ortutay

[bgill]

Facebook said Thursday that it stored millions of its users' passwords in plain text for years. The acknowledgement from the social media giant came after a security researcher posted about the issue online. "Security rule 101 dictates that under no circumstances passwords should be stored in plain text, and at all times must be encrypted," said cybersecurity expert Andrei Barysevich of Recorded Future. "There is no valid reason why anyone in an organization, especially the size of Facebook, needs to have access to users' passwords in plain text." Facebook said there is no evidence its employees abused access to this data. But thousands of employees could have searched them. The company said the passwords were stored on internal company servers, where no outsiders could access them. But the incident reveals a huge oversight for the company amid a slew of bruises and stumbles in the last couple of years. The security blog KrebsOnSecurity said some 600 million Facebook users may have had their passwords stored in plain text.

[bgill]

Reason #958,201 not to use FB.

[rktman]

Dammit. Oh, wait. I don’t do that. Yawn............

[proxy_user]

This is quite surprising. Nearly any commercial LDAP or other security access system stores only the hash of the password. Did Facebook use home-made security? For their size, you would certainly think they’d just buy a suitable commercial product.

When I worked, I was involved with the single sign-on system in a large bank, where we had 250,000 employees with logins. We used the Novell eDirectory LDAP to store the credentials.

[Doogle]

.....another example of Zuckerberg screwing over the American people.

[a fool in paradise]

CEO is a lamebrain

[Nailbiter]

CEO is a lamebrain

CEO is pawn of 3 letter fed dept

[shelterguy]

I hope my fake identity hasn’t been compromised

[ImJustAnotherOkie]

Look out your window.

[Larry Lucido]

So do I.

And: Bosco.

[shelterguy]

I hear the black helicopters now. I’m heading to the bunker.

[jimmygrace]

Vicious inmates are running that assylum, waiting for a chance to screw over anyone who disagrees with their politics.

[perfect_rovian_storm]

You’re comparing apples and oranges. Yes, Facebook had/has custom in-house security, not some commercially available LDAP product. FR is the same way and so is any other website you interact with on a daily basis.

[Garth Tater]

"The company said the passwords were stored on internal company servers, where no outsiders could access them."

"The company" knows as well as everybody else that more info is stolen by those sitting inside the firewalls than those sitting outside.

[dayglored]

Facebook compromises 600,000,000 users' passwords ... PING!

You can find all the Windows Ping list threads with FR search: just search on keyword "windowspinglist".

[cgbg]

I think you just cracked the CEO’s password—don’t tell anyone—C..I...A....or it could be N...S...A if the first one does not work. ;-)

[cgbg]

I was watching a CSPAN hearing while Marriott and Equifax CEO’s tap-danced around the cyber-security issue. They ignored the potential insider threat—and the Congress-critters questioning them were clueless as well.

You are correct—most data breaches are not hacks at all.

They are inside jobs.

The first suspects should always be employees with access to the hardware and software.

[discostu]

Everybody has stored user data in plain text at some point. Encryption is a pain. Especially when the encryption level you’re using goes out of vogue, so you have to go bigger but in the case of upgrades you still have to read the old stuff and slowly replace it. Ugh. We all know it’s wrong, but it’s fast and easy.

[discostu]

They aren’t on LDAP. It’s just a SQL database.

[zeugma]

There is no valid reason why anyone in an organization, especially the size of Facebook, needs to have access to users' passwords in plain text."

Worth repeating. This is sheer lunacy. You always store encrypted and validate against a hash.

[Tolerance Sucks Rocks]