Facebook stored passwords in plain text for hundreds of millions of users

Hundreds of millions of Facebook users’ passwords were stored in plain text, completely searchable by Facebook employees for years. Some users had their passwords stored in plain text as early as 2012, according to a senior Facebook source who spoke to KrebsOnSecurity...


Hundreds of millions of Facebook users’ passwords were stored in plain text, completely searchable by Facebook employees for years.

Some users had their passwords stored in plain text as early as 2012, according to a senior Facebook source who spoke to KrebsOnSecurity. The source, speaking on condition of anonymity, says that somewhere between 200 million and 600 million Facebook users were affected. More than 20,000 Facebook employees would have had access to these plain text passwords.

Shortly after KrebsOnSecurity published its story, Facebook posted its own statement by its vice president of engineering, security and privacy, Pedro Canahuati. He states that the company first discovered the issue during “a routine security review in January.”

The users most affected by the security lapse are those who use the social network’s “lower connectivity” client, Facebook Lite. The company estimates that hundreds of millions of Facebook Lite users and tens of millions of “other” Facebook users had their passwords stored in plain text. Tens of thousands of Instagram users also were also affected.

Facebook claims that no one outside of the company was able to view the passwords and that it has found no evidence that anyone working at the social network “abused or improperly accessed them.” According to KrebsOnSecurity’s source, around 2,000 engineers or developers queried data that contained plain text passwords approximately 9 million times.

“We have fixed these issues and as a precaution we will be notifying everyone whose passwords we have found were stored in this way,” stated Canahuati.

At this point, Facebook is no stranger to security failures. In one recent breach reported in October 2018, personal information of tens of millions of Facebook users were accessed by hackers. Just two months later, the company shared that millions of its users’ photos leaked to third-party developers who never had permission to view them in a completely separate breach.

Facebook is not forcing affected users to change their passwords at this time.

Source: Mashable



Related Posts

Man gets tens of thousands of birthday calls after sons post his phone number on billboards

Ghana may auction Eurobonds with or without final IMF review

Judge questions 1-yr delay in prosecuting man who set 11-yr-old boy ablaze

Muntari joins Spanish side Albacete on one-year deal

Woman lives with plastic pill packaging lodged in her throat for 17 days

Trade Minister, EU sign UNIDO MoU

We wish you the best – U.S. embassy to Akufo-Addo

Gyan hopes to be fit for AFCON 2019

Leave a reply
your email address will not be published

Featured Posts

Gyan hopes to be fit for AFCON 2019


Trade Minister, EU sign UNIDO MoU


Long, extended sittings 'killing us' – Minority


Nicolas Cage files for annulment 4 days after marrying girlfriend


Facebook removes more pages for misleading activity


Food poisoning hits Archbishop Porter SHS, 60 students hospitalised


We wish you the best – U.S. embassy to Akufo-Addo


Trade Minister, EU sign UNIDO MoU


Nicolas Cage files for annulment 4 days after marrying girlfriend


Facebook removes more pages for misleading activity


We wish you the best – U.S. embassy to Akufo-Addo


Facebook removes more pages for misleading activity


Food poisoning hits Archbishop Porter SHS, 60 students hospitalised


Food poisoning hits Archbishop Porter SHS, 60 students hospitalised