{"id":15121,"date":"2019-05-22T00:37:31","date_gmt":"2019-05-22T00:37:31","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/google-says-some-g-suite-user-passwords-were-stored-in-plaintext-since-2005.html"},"modified":"2019-05-22T00:37:31","modified_gmt":"2019-05-22T00:37:31","slug":"google-says-some-g-suite-user-passwords-were-stored-in-plaintext-since-2005","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/google-says-some-g-suite-user-passwords-were-stored-in-plaintext-since-2005.html","title":{"rendered":"Google says some G Suite user passwords were stored in plaintext since 2005"},"content":{"rendered":"

Google says a small number of its enterprise customers mistakenly had their passwords stored on its systems in plaintext.<\/p>\n

The search giant disclosed the exposure Tuesday but declined to say exactly how many enterprise customers were affected. \u201cWe recently notified a subset of our enterprise G Suite customers that some passwords were stored in our encrypted internal systems unhashed,\u201d said Google vice president of engineering Suzanne Frey.<\/p>\n

Passwords are typically scrambled using a hashing algorithm to prevent them from being read by humans. G Suite administrators are able to manually upload, set and recover new user passwords for company users, which helps in situations where new employees are on-boarded. But Google said it discovered in April that the way it implemented password setting and recovery for its enterprise offering in 2005 was faulty and improperly stored a copy of the password in plaintext.<\/p>\n

Google has since removed the feature.<\/p>\n

No consumer Gmail accounts were affected by the security lapse, said Frey.<\/p>\n

\u201cTo be clear, these passwords remained in our secure encrypted infrastructure,\u201d said Frey. \u201cThis issue has been fixed and we have seen no evidence of improper access to or misuse of the affected passwords.\u201d<\/p>\n

Google has more than 5 million enterprise customers<\/a> using G Suite.<\/p>\n

Google said it also discovered a second security lapse earlier this month as it was troubleshooting new G Suite customer sign-ups. The company said since January it was improperly storing \u201ca subset\u201d of unhashed G Suite passwords on its internal systems for up to two weeks. Those systems, Google said, were only accessible to a limited number of authorized Google staff, the company said.<\/p>\n

\u201cThis issue has been fixed and, again, we have seen no evidence of improper access to or misuse of the affected passwords,\u201d said Frey.<\/p>\n

Google said it\u2019s notified G Suite administrators to warn of the password security lapse, and will reset account passwords for those who have yet to change.<\/p>\n

A spokesperson confirmed Google has informed data protection regulators of the exposure.<\/p>\n

Google becomes the latest company to have admitted storing sensitive data in plaintext in the past year. Facebook said in March<\/a> that \u201chundreds of millions\u201d of Facebook and Instagram passwords were stored in plaintext. Twitter<\/a> and GitHub<\/a> also admitted similar security lapses last year.<\/p>\n

Read more:<\/strong><\/p>\n