Facebook Stored millions of user passwords in a pain text format

Facebook has been in the news from the last couple of quarters, mostly for unwanted reasons. Facebook has again made into headlines, by storing millions of user passwords in a plain text format.

Krebs on Security exposed the vulnerability. Usually, passwords are stored in an encrypted format, which makes it impossible for others to access sensitive data. In this case, a select number of user passwords were stored in a readable format.

According to the Krebs report, at least 200 to 600 million users are affected. Facebook in a blog spot has clarified that the company has fixed the issue, and has sent a mail for the affected regarding the same. Facebook also guarantees that no one outside or inside Facebook has accessed this data.

Pedro Canahuati, VP Engineering, Security and Privacy said

As part of a routine security review in January, we found that some user passwords were being stored in a readable format within our internal data storage systems. This caught our attention because our login systems are designed to mask passwords using techniques that make them unreadable. We have fixed these issues and as a precaution, we will be notifying everyone whose passwords we have found were stored in this way.

To be clear, these passwords were never visible to anyone outside of Facebook and we have found no evidence to date that anyone internally abused or improperly accessed them. We estimate that we will notify hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users. Facebook Lite is a version of Facebook predominantly used by people in regions with lower connectivity.

In the course of our review, we have been looking at the ways we store certain other categories of information - like access tokens - and have fixed problems as we've discovered them. There is nothing more important to us than protecting people's information, and we will continue making improvements as part of our ongoing security efforts at Facebook.

Source