Slashdot Mirror
For Years, Hundreds of Millions of Facebook Users Had Their Account Passwords Stored in Plain Text and Searchable By Thousands of Facebook Employees (krebsonsecurity.com)
Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees -- in some cases going back to 2012, KrebsOnSecurity reported Thursday. From the report: Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data. Facebook is probing the causes of a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers. That's according to a senior Facebook employee who is familiar with the investigation and who spoke on condition of anonymity because they were not authorized to speak to the press. The Facebook source said the investigation so far indicates between 200 million and 600 million Facebook users may have had their account passwords stored in plain text and searchable by more than 20,000 Facebook employees. The source said Facebook is still trying to determine how many passwords were exposed and for how long, but so far the inquiry has uncovered archives with plain text user passwords in them dating back to 2012. Facebook has responded.
Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data.
The CEO himself admitted to using this data to hack users' email.
The incompetence of these people is astonishing.
"First they came for the slanderers and i said nothing."
When he was Harvard, Zuckerborg went thru his classmates email accounts using their Facebook passwords. He knew that most users would reuse the same passwords for all of their accounts.
For the past several weeks I (along with many other people) have been getting these scam emails saying that my password is a certain word and they're obviously logged into my account because they're sending me email from my own email address. (Which is stupid -- sender address has been trivial to spoof since email was invented, and that was neither the password for my email account nor ever the password to log into my workstation.). The spam then threatens to send all my contacts photos from my webcam (I don't have one) of me, um, enjoying myself to pr0n.
The password they always say they've captured was my very first facebook password. It's rather unique and I recognized it immediately.
So this pr0n scam... Is it an outsider scooping cleartext passwords and using them for spam, or is it someone at Facebook running a side business? Inquiring minds want to know.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.