Facebook stored hundreds of millions of passwords unprotected

Facebook mistakenly stored “hundreds of millions” of passwords in plaintext, unprotected by any encryption, the company has admitted.

The mistake, which led to user passwords being kept in Facebook’s internal servers in an insecure way, affects “hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users”, according to the social networking site. Facebook Lite is a version of Facebook created for use in nations where mobile data is unaffordable or unavailable.

In a statement, Facebook’s vice-president for engineering, security and privacy, Pedro Canahuati, said: “We have found no evidence to date that anyone internally abused or improperly accessed” the passwords, which “were never visible to anyone outside of Facebook”. Affected users will be directly notified.

Nonetheless, the risk of misuse was high. According to security reporter Brian Krebs, who cited a “senior Facebook insider”, “access logs showed some 2,000 engineers or developers made approximately nine million internal queries for data elements that contained plaintext user passwords”.

Facebook’s data centre in Sweden. Passwords were kept on the company’s servers in an insecure way. Photograph: David Levene/The Guardian
 Facebook’s data centre in Sweden. Passwords were kept on the company’s servers in an insecure way. Photograph: David Levene/The Guardian

Best practice for password security involves a number of precautions to ensure that, even if the company is hacked, stolen passwords cannot be used. Passwords should be “hashed”, a one-way process which transforms every password into a unique “hash”, and ideally “salted”, ensuring that even two identical passwords produce different hashes. Those are the security practices that Facebook normally takes, and which were overlooked in this case.

Canahuati said Facebook has now fixed this particular issue, as well as some problems the company has discovered in other security features, such as the code by which users log in through other apps.

The information commissioner’s office warns companies: “Do not store passwords in plaintext – make sure you use a suitable hashing algorithm, or another mechanism that offers an equivalent level of protection against an attacker deriving the original password.

“You should also ensure that the architecture around your password system does not allow for any inadvertent leaking of passwords in plaintext.” The guidance refers to the exact sort of error that Facebook admitted to on Thursday.

The ICO has not issued a fine purely for storing passwords in an insecure fashion, although it has cited insecure storage as an aggravating factor when penalising more serious data protection breaches.

The Guardian

Other News

Hanoi approves controlled pilot of two technology projects

Hanoi approves controlled pilot of two technology projects

The two projects involve an intelligent autonomous transportation system developed by Phenikaa-X JSC and a technology for producing mixed rare-earth oxides with a purity of over 95% on a semi-industrial scale developed by the Mining Technology and Construction Consultancy JSC.

Banking industry in AI era: When data becomes competitive advantage

Banking industry in AI era: When data becomes competitive advantage

In just a few years, AI has evolved from an experimental technology into an “assistant” for many banks, supporting everything from customer service, credit approval, and fraud detection to risk management. However, as the technological gap between institutions narrows, a new question is emerging: What will determine banks' competitive advantage in the AI era?

Bac Ninh considers establishing AI centre of excellence

Bac Ninh considers establishing AI centre of excellence

A meeting has been held in Bac Ninh to discuss potential cooperation with Plug and Play in developing the northern province’s innovation ecosystem and establishing an artificial intelligence (AI) centre of excellence, with Standing Vice Chairman of the provincial People’s Committee Mai Son receiving a delegation from the global innovation platform.

Hanoi allows 24-month trial of autonomous vehicles at Hoa Lac

Hanoi allows 24-month trial of autonomous vehicles at Hoa Lac

The project aims to assess the safety, reliability and readiness of autonomous vehicles under real traffic conditions, as well as the effectiveness of autonomous public transport and compatibility with existing systems. Its results will contribute to developing technical standards, operating procedures and management models suited to Hanoi’s traffic conditions.

Singapore's experience suggests solutions to Vietnam's human resources challenge in AI era

Singapore's experience suggests solutions to Vietnam's human resources challenge in AI era

As Vietnam accelerates digital transformation and high-tech development, Singapore’s experience and the engagement of global technology companies demonstrate that human resources preparation must stay ahead of the curve. The ability to filter knowledge, collaborate, innovate and effectively use AI will increasingly become essential to helping workers adapt to a changing labour market and strengthening the competitiveness of Vietnam’s economy in the new era.

Protecting national security amid digital transformation, cyberspace

Protecting national security amid digital transformation, cyberspace

Cybersecurity, information security and data security risks must be identified and addressed early and from afar, with appropriate defensive measures ready to neutralise threats and protect national interests in cyberspace, said Lieutenant General Le Xuan Minh, Director of the Ministry of Public Security’s Department of Cybersecurity and Hi-tech Crime Prevention (A05).

Mekong Delta launches first robotics, AI research institute

Mekong Delta launches first robotics, AI research institute

Dr. Nguyen Van Quang, Rector of Nam Can Tho University, said the university is developing a value chain covering training, research, technology development, testing, technology transfer and commercialisation. The model is designed to link research more closely with practical needs, ensuring that technologies generate products and products create value for society.

Vietnam positioned to harness AI wave, World Bank report says

Vietnam positioned to harness AI wave, World Bank report says

The WB report identifies Vietnam as one of the few economies outside the European Union (EU) to have adopted a comprehensive AI regulatory framework as early as 2025. Vietnam applies a risk-tiered approach similar to that of the EU AI Act, imposing different obligations depending on whether an AI system poses “unacceptable,” “high,” “low” or “minimal” risks. The approach is viewed as a strategic step towards ensuring safe and transparent AI governance.

AI offers both opportunities, challenges for Vietnam's growth

AI offers both opportunities, challenges for Vietnam's growth

Dr. Ho Duc Thang, a full-time member of the National Assembly’s Committee for Cultural and Educational, said productivity is the key to sustaining double-digit economic growth, and AI has greater potential to improve productivity than any previous technology.

Top leader unveils people-centred vision for new development model

Top leader unveils people-centred vision for new development model

Vietnam's growth model, long fueled by low-cost labour, resource extraction, contract manufacturing, expanded investment, and capital accumulation, has run out of road. The country now needs a sweeping reform agenda to shift from extensive growth to a model driven by productivity, knowledge, science and technology, innovation, and digital transformation.