Petr Škuta Facebook announced today that a security review revealed serious flaws in password storage. This was in the database without encryption and accessible to employees.
In the official report, "a few passwords" turned out to be millions. An internal source from Facebook revealed to the KrebsOnSecurity server that it was something between 200 and 600 million user passwords. It was stored in plain text only, without any encryption.
It could be interest you
Amaya Toman In other words, any of the company's 20 employees could have access to the passwords of the user accounts by simply querying the database. Moreover, according to the information, it was not only the social network Facebook as such, but also Instagram. A significant number of these passwords came from users of Facebook Lite, a very popular client for slower Android smartphones.
However, Facebook adds in the same breath that there is no evidence that any of the employees misused the passwords in any way. However, an anonymous employee told KrebsOnSecurity that over two thousand engineers and developers worked with the given database and performed around nine million database queries on the password table in question.
Facebook recommends changing your password for Instagram as well
In the end, the whole incident came about because Facebook had an application internally programmed that intercepted unencrypted passwords. So far, however, it has not been possible to track down the exact number of passwords stored in such a dangerous manner, nor the time for which they were stored in the database in this way.
Facebook intends to gradually contact all users who may be exposed to a security risk. The company also intends to examine the way it stores other sensitive data, such as login tokens, in order to prevent a similar situation in the future.
It could be interest you
Dan Pražák Users of both affected social networks, i.e. Facebook and Instagram, should change their passwords. Especially if they used the same password for other services as well, because it is possible that sooner or later the entire archive with unencrypted passwords will get on the Internet. Facebook itself also recommends turning on two-step verification to help authorize access to your profile.
Source: MacRumors
