Apple's Beats brand in April unveiled the Powerbeats Pro, a redesigned wire-free version of its popular fitness-oriented Powerbeats earbuds.
Facebook Stored Hundreds of Millions Passwords in Plain Text, Thousands of Employees Had Access
Facebook today announced that during a routine security review it discovered "some user passwords" were stored in a readable format within its internal data storage systems, accessible by employees.
As it turns out, "some user passwords" actually means hundreds of millions of passwords. A Facebook insider told KrebsOnSecurity that between 200 and 600 million Facebook users may have had their account passwords stored in plain text in a database accessible to 20,000 Facebook employees. Some Instagram passwords were also included, and Facebook claims many of the passwords came from Facebook Lite users.
Facebook says that there's no "evidence to date" that anyone within Facebook abused or improperly accessed the passwords, but KrebsOnSecurity's source says 2,000 engineers or developers made around nine million internal queries for data elements that contained plain text user passwords.
Facebook employees reportedly built applications that logged unencrypted password data, which is how the passwords were exposed. Facebook hasn't determined exactly how many passwords were stored in plain text, nor how long they were visible.
Facebook plans to notify users whose passwords were improperly stored, and the company says that it has been looking at the ways certain categories of information, such as access tokens, are stored, and correcting problems as they're found.
"There is nothing more important to us than protecting people's information, and we will continue making improvements as part of our ongoing security efforts at Facebook," reads Facebook's blog post.
Facebook and Instagram users who are concerned about their account security should change their passwords, using unique passwords that are different from passwords used on other sites. Facebook also recommends users enable two-factor authentication.
As it turns out, "some user passwords" actually means hundreds of millions of passwords. A Facebook insider told KrebsOnSecurity that between 200 and 600 million Facebook users may have had their account passwords stored in plain text in a database accessible to 20,000 Facebook employees. Some Instagram passwords were also included, and Facebook claims many of the passwords came from Facebook Lite users.
Facebook says that there's no "evidence to date" that anyone within Facebook abused or improperly accessed the passwords, but KrebsOnSecurity's source says 2,000 engineers or developers made around nine million internal queries for data elements that contained plain text user passwords.
Facebook employees reportedly built applications that logged unencrypted password data, which is how the passwords were exposed. Facebook hasn't determined exactly how many passwords were stored in plain text, nor how long they were visible.
Facebook plans to notify users whose passwords were improperly stored, and the company says that it has been looking at the ways certain categories of information, such as access tokens, are stored, and correcting problems as they're found.
"There is nothing more important to us than protecting people's information, and we will continue making improvements as part of our ongoing security efforts at Facebook," reads Facebook's blog post.
Facebook and Instagram users who are concerned about their account security should change their passwords, using unique passwords that are different from passwords used on other sites. Facebook also recommends users enable two-factor authentication.
Tag: Facebook
[ 242 comments ]
Top Rated Comments
(View all)
25 weeks ago
While many are saying "is anyone surprised" I actually am at this.
This is one of the largest corporations in the world, whose sole business is its internet applications, and they ignored one of the most basic security expectations of hashing a password?
That is absolutely surprising and shameful and there is no excuse from them that is acceptable.
This is one of the largest corporations in the world, whose sole business is its internet applications, and they ignored one of the most basic security expectations of hashing a password?
That is absolutely surprising and shameful and there is no excuse from them that is acceptable.
25 weeks ago
Disgusting.
Use privacy enhancing tech or pay the price, in future privacy will be currency.
* GPG
* Veracrypt
* Monero
* VPN
* DuckDuckGo
* Pi.hole
Use privacy enhancing tech or pay the price, in future privacy will be currency.
* GPG
* Veracrypt
* Monero
* VPN
* DuckDuckGo
* Pi.hole
25 weeks ago
Every turd knows you salt the password and hash it and never ever store anything other than the hash. The password should never even have been transmitted to Facebook, but that’s a whole other story.
These guys should be shut down.
These guys should be shut down.
25 weeks ago
I dont feel bad for Zuckerberg for a second over the autobahn speed dumpster fire car crash that is Facebook that none of us can look away from.
Karma is so frigging beautiful. And to think, the demise of Zuck/FB is only in its earliest phase. Popcorn.gif
Good luck with that new privacy-centric platform pitch too, credible Lizardman! ;)
He'll be lucky to go the way of Tom; irrelevant. In more likelihood, jail time and litigation issues / scandals piling up until his old age. He certainly will not have gotten the last laugh, proverbially speaking.
I think in the end, Tom wasn't just everyone's friend on MySpace, he was indirectly everyone's friend IRL.
The platform caving on itself was a great 'avante-garde' gift to humanity; Nobel Peace Prize worthy imo!
And while I engage in debate often in polarizing pol threads, I think we *all* can rally behind the fact both sides are equally furious (for different reasons) at Facebook... Maybe thats the sort of common ground unity we need?
Karma is so frigging beautiful. And to think, the demise of Zuck/FB is only in its earliest phase. Popcorn.gif
Good luck with that new privacy-centric platform pitch too, credible Lizardman! ;)
He'll be lucky to go the way of Tom; irrelevant. In more likelihood, jail time and litigation issues / scandals piling up until his old age. He certainly will not have gotten the last laugh, proverbially speaking.
I think in the end, Tom wasn't just everyone's friend on MySpace, he was indirectly everyone's friend IRL.
The platform caving on itself was a great 'avante-garde' gift to humanity; Nobel Peace Prize worthy imo!
And while I engage in debate often in polarizing pol threads, I think we *all* can rally behind the fact both sides are equally furious (for different reasons) at Facebook... Maybe thats the sort of common ground unity we need?
[ Read All Comments ]
Apple's biggest product unveiling of the year is now in our rear-view mirror, with the company taking the wraps off of new iPhone, Apple Watch, and iPad models while also prepping for the launch...
On the same day that iPhone 11, iPhone 11 Pro, and iPhone 11 Pro Max pre-orders began, some customers are already beginning to see their order statuses shift from "processing" to...
Struggling movie ticket subscription MoviePass is finally shutting down after months of questionable policy changes and what seems like a never ending stream of negative press due to an inability to...
For this week's giveaway, we've teamed up with Jackery to offer MacRumors readers a chance to win a Jackery Explorer 500 Portable Power Station and a Jackery Solar Saga 100W Solar Panel.
...
The iPhone 11, iPhone 11 Pro, and iPhone 11 Pro Max are now available for pre-order on Apple.com and cellular carriers as of this morning. As usual, most carriers are offering some perks if you...
The Academy Software Foundation, a collaborative effort to advance open source software development in the motion picture and media industries, today announced that Apple has joined the foundation as...
Spotify will require family plan members to provide their location data "from time to time" to prove they're all living under the same roof, in an effort to curb subscribers who abuse the...
If you're planning on trading in your old iPhone for a new one, there are some steps you'll want to take beforehand to ensure it's de-linked from your accessories and accounts and that...
