{"id":14514,"date":"2019-03-21T19:45:30","date_gmt":"2019-03-21T19:45:30","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/facebook-admits-it-stored-hundreds-of-millions-of-account-passwords-in-plaintext.html"},"modified":"2019-03-21T19:45:30","modified_gmt":"2019-03-21T19:45:30","slug":"facebook-admits-it-stored-hundreds-of-millions-of-account-passwords-in-plaintext","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/facebook-admits-it-stored-hundreds-of-millions-of-account-passwords-in-plaintext.html","title":{"rendered":"Facebook admits it stored \u2018hundreds of millions\u2019 of account passwords in plaintext"},"content":{"rendered":"

Flip the \u201cdays since last Facebook <\/a> security incident\u201d back to zero.<\/p>\n

Facebook confirmed Thursday in a blog post<\/a>, prompted by a report<\/a> by cybersecurity reporter Brian Krebs, that it stored \u201chundreds of millions\u201d of account passwords in plaintext for years.<\/p>\n

The discovery was made in January, said Facebook\u2019s Pedro Canahuati, as part of a routine security review. None of the passwords were visible to anyone outside Facebook, he said. Facebook admitted the security lapse months later, after Krebs said logs were accessible to some 2,000 engineers and developers.<\/p>\n

Krebs said the bug dated back to 2012.<\/p>\n

\u201cThis caught our attention because our login systems are designed to mask passwords using techniques that make them unreadable,\u201d said <\/span>Canahuati. \u201cWe have found no evidence to date that anyone internally abused or improperly accessed them,\u201d but did not say how the company made that conclusion.<\/span><\/p>\n

Facebook said it will notify \u201chundreds of millions of Facebook Lite users,\u201d a lighter version of Facebook for users where internet speeds are slow and bandwidth is expensive, and \u201ctens of millions of other Facebook users.\u201d The company also said \u201ctens of thousands of Instagram <\/a> users\u201d will be notified of the exposure.<\/p>\n

Krebs said as many as 600 million users could be affected \u2014 about one-fifth of the company\u2019s 2.7 billion users, but Facebook has yet to confirm the figure.<\/p>\n

Facebook also didn\u2019t say how the bug came to be. Storing passwords in readable plaintext is an insecure way of storing passwords. Companies, like Facebook, hash and salt passwords \u2014 two ways of further scrambling passwords \u2014 to store passwords securely. That allows companies to verify a user\u2019s password without knowing what it is.<\/span><\/p>\n

Twitter<\/a> and GitHub<\/a> were hit by similar but independent bugs last year. Both companies said passwords were stored in plaintext and not scrambled.<\/p>\n

It\u2019s the latest in a string of embarrassing security issues at the company, prompting congressional inquiries<\/a> and government investigations<\/a>. It was reported last week<\/a> that Facebook\u2019s deals that allowed other tech companies to access account data without consent was under criminal investigation.<\/p>\n

It\u2019s not known why Facebook took months to confirm the incident, or if the company informed state or international regulators per U.S. breach notification and European data protection laws. We asked Facebook but a spokesperson\u00a0did not immediately comment beyond the blog post.<\/span><\/p>\n

The Irish data protection office, which covers Facebook\u2019s European operations, said the company \u201cinformed us of this issue\u201d and the regulator is \u201ccurrently seeking further information.\u201d<\/p>\n

\n

Privacy complaints received by tech giants\u2019 favorite EU watchdog up more than 2x since GDPR<\/a><\/p>\n<\/blockquote>\n

\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunch\/social\/~3\/lHwORIxzZTk\/<\/p>","protected":false},"excerpt":{"rendered":"

Flip the \u201cdays since last Facebook security incident\u201d back to zero. Facebook confirmed Thursday in a blog post, prompted by a report by cybersecurity reporter Brian Krebs, that it stored <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-14514","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t