Facebook has just admitted that hundreds of millions of user passwords were accessible to its employees. As many as 600 million passwords were stored in plain text and searchable by over 20,000 employees. Facebook has, however, declined to confirm a number.
The social media network said it has resolved the issue and will inform everyone whose passwords it found stored in plain text instead of encrypting them
Security company Sophos recommends that users consider changing their passwords and turn on two-factor authentication (2FA.)
Paul Ducklin, senior technologist, Sophos commented: “It’s perfectly possible that no passwords at all fell into the hands of any crooks as a result of this. But if any passwords did get into the wrong hands (and you can bet your boots that the crooks are trawling through any old data they might have right now, to see if there is anything they missed before), then you can expect them to be abused. Hashed passwords still need to be cracked before they can be used; plaintext passwords are the real deal without any further hacking or cracking needed.
“Given that the wrongly-stored passwords weren’t easily accessible in one database, or deliberately stored for routine use during logins, we don’t think this breach alone is enough reason to terminate your account. On the other hand, it’s a pretty poor look for Facebook, and it might be enough, amongst all the other privacy concerns that have dogged Facebook in recent years, to convince you to take that final step. In short, you have to decide for yourself.”