Millions of Facebook passwords were stored in plain text
Facebook said Thursday it had left “hundreds of millions” of users’ passwords exposed in plain text, potentially visible to the company’s employees, marking another major privacy and security headache for a tech giant already under fire for mishandling people’s personal information.
Facebook said it believed the passwords were not visible to anyone outside of the company, and had no evidence its employees “internally abused or improperly accessed them” — but said it would notify users of Facebook as well as its photo-sharing site, Instagram, that they had been affected.
The incident was first revealed by the Krebs on Security blog, which estimated the total number of affected users ranged between 200 million and 600 million — though Facebook declined to confirm the estimate.
Still, the revelation adds to a litany of recent privacy and security mishaps at Facebook, some of which have triggered investigations in the United States and European Union and could carry the risk of steep fines and other punishments.
Like most companies, Facebook said it stores passwords in a way that’s supposed to make them unreadable using a technique called hashing. But a security review in January, detailed in a blog post Thursday, found they actually were stored in a readable format, a problem Facebook said it has since fixed.
Most affected were uses of Facebook Lite, the company said, a stripped-down version of the social network that’s largely in use in countries with lower internet connection speeds.
“This caught our attention because our login systems are designed to mask passwords using techniques that make them unreadable,” Pedro Canahuati, the company’s vice president of Engineering, Security and Privacy, said in a blog post. “We have fixed these issues and as a precaution we will be notifying everyone whose passwords we have found were stored in this way.”
During its review, Canahuati said that Facebook also looked at its other security practices, including its use of so-called “access tokens,” which is how thirdparty apps identify a Facebook user and can access one’s profile information.
He said Facebook had “fixed problems as we’ve discovered them,” but the company didn’t immediately comment on other security mishaps it identified.
In September, Facebook acknowledged hackers had stolen information that may have allowed them to access 50 million user accounts.