03/22/2019
"Facebook Left Millions of Passwords Readable by Employees" Associated Press (03/21/19)
Facebook on Thursday disclosed that for years stored hundreds of millions of user passwords in a format that was accessible to its employees. The incident involved a wide swath of its users, though Facebook said no passwords were exposed externally, and it hasn’t found evidence of the information being abused. Facebook estimated it will notify “hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users. The security lapse appears similar to others that have occurred at tech companies, including Twitter Inc., which asked 331 million users to change their passwords in May after discovering that one of its internal systems logged users’ unencrypted passwords. Password databases have become a prime target for cyber thieves, and hackers will often try a user’s stolen password to break into new sites. Most companies, including Facebook, monitor the internet for publicly released databases of passwords. Facebook Lite is a version designed for people with older phones or low-speed internet connections. It is used primarily in developing countries. Jake Williams, president of Rendition Infosec, said storing passwords in plain text is "unfortunately more common than most of the industry talks about" and tends to happen when developers are trying to rid a system of bugs. He said the Facebook blog post suggests storing passwords in plain text may have been "a sanctioned practice," although he said it's also possible a "rogue development team" was to blame.
