Facebook Stored their hundreds of millions of users password in plain text instead of masking it as a human-readable format.
These millions of unencrypted plain text passwords are accessible by thousands of internal Facebook employees.
But the further investigation conducted by Facebook reveals there is no indication that any of the Facebook employees are abused these unmasked passwords.
The organization should always hash the password, a cryptographic process that helps to store the user’s sensitive information such as a password in a human-unreadable format that allows no one can read the data even if the system will be compromised.
Password in Plain Text
Facebook continuously facing the security failure incidents since last year and this case poorly developed an application that manages passwords let Facebook stored these passwords in human-readable format.
This incident mainly affected the hundreds of millions of users who have regularly accessed Facebook lite, a lightweight Facebook version for the users who all are in the regions with lower connectivity.
Other than that, tens of millions of other Facebook users and tens of thousands of Instagram users password also stored in plaintext.
Based on the source that spoke to Krebs, a security investigation told that there are nearly 200 million to 600 million users password may have been stored in human-readable plain text format.
Another shocking statement made by the Facebook insider source to
A Facebook statement says, To be clear, these passwords were never visible to anyone outside of Facebook and we have found no evidence to date that anyone internally abused or improperly accessed them.
In this case, Facebook told WIRED that “the exposed passwords weren’t all stored in one place, and that the issue didn’t result from a single bug in the platform’s password management system. Instead, the company had unintentionally and incidentally captured plaintext passwords across a variety of internal mechanisms and storage systems, like crash logs”
The issue has been fixed and as a precaution we will be notifying everyone whose passwords we have found were stored in this way. Facebook said.
Also Read:
Facebook Released New Location Privacy Control for Android Users to Stop Collecting Location Data
Facebook Down for Billions of Users Around the World – Instagram & WhatsApp Also Affected
