Meta fined $101 million by Ireland for storing hundreds of millions of passwords in plaintext
Meta fined $101 million for storing hundreds of millions of passwords in plaintext
instead of in an encrypted format on its internal systems.
Riiight, like that's any better. Jokes aside, it's hard to imagine what kind of "mistake" results in storing plain text instead of hashing, unless the mistake was in choosing whoever made the security assessment
There was a previous article on this with more explanation that I'm struggling to find.
The gist was that they do hash all passwords stored, the problem was that there was a mistake made with the internal tool they use to do that hashing which led to the passwords inadvertently going into some log system.
Christ, the hell I would've gotten, in the 90's, if I'd done something like this.
This is not about facebook not hashing credentials, it is that they appeared in internal logs.
Facebook is probing a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers.
Source: Krebs on Security
that logged unencrypted password data
Why the fuck would you need to log a password ever? This is absolutely malice and not incompetence.
You are acting like someone checked off a "log passwords" box, as if that's a thing that even exists
Someone configured a logger to write HTTP bodies and headers, not realizing they needed to build a custom handler to iterate through every body and header anonymizing any fields that may plausibly contain sensitive information. It's something that literally every dev has done at some point before they knew better.
Just one open source example ... freeradius has an option to log passwords:
log {
destination = files
auth = no
auth_badpass = no
auth_goodpass = no
}
Or another example: The apache web server has a module that dumps all POST data, with passwords, in plain text:
mod_dumpioallows for the logging of all input received by Apache and/or all output sent by Apache to be logged (dumped) to the error.log file. The data logging is done right after SSL decoding (for input) and right before SSL encoding (for output). As can be expected, this can produce extreme volumes of data, and should only be used when debugging problems.
I don't agree that this is "absolutely malice", it could also be stupidity and forgetfulness.
101 million is too small for such an epic error.
I think it is just Ireland though (which is why I added Ireland to the title).
Seriously. Didn't they make billions last year? That number should be much, much higher for Zuck & Co. to actually start giving a fuck.
I think the PR fall out could be much worse. Time to get them on the news
Google did it too for a decade
Any kind of encryption requires storing the key in plain text. Still nice to see Meta being fined though.
The author of the article is clearly just confusing "encryption", "cryptography" and "hashing". Reading the full article makes it clear that the intention was to salt and hash the passwords, not encrypting them.
Does anyone remember an article/interview a while back where Mark Fuckerberg shamelessly admitted that he chose not to hash passwords in the original Facebook codebase specifically because he wanted to be able to log into his users' other accounts that use the same password? I swear I remember reading something like this but now I can't find it.
Your memory is not far off. Mark used failed logins to access other people's emails:
https://www.businessinsider.com/how-mark-zuckerberg-hacked-into-the-harvard-crimson-2010-3
I cant say if he intentionally saved passwords unencrypted, but he certainly saved login attempts
Usually these services have god mode where they can see a UI from a given user. They don't need the password.
This sounds like a rumor spread by someone who doesn't understand tech
The OP made the argument that Zuckerberg wanted to know their passwords, such that if the users reused the same passwords elsewhere, then he would be able to log in there and check out their accounts.
For example he could have seen a profile he was interested in, nabbed their password and looked into their email.
Not that he wouldn't have godmode on their Facebook account, and needed their password to access their account, because of course he could have just accessed those accounts without needing the password.
I have not heard this rumor before, though I wouldn't be completely surprised if it was true.
Yes, he wanted to stop bad press ironically