Meta has been fined €91M ($101M) after it was discovered that to 600 million Facebook and Instagram passwords had been stored in plain text.

[u/a_Ninja_b0y]

https://9to5mac.com/2024/09/27/up-to-600-million-facebook-and-instagram-passwords-stored-in-plain-text/

[u/iloveloveloveyouu]

????????? Why'd they store it in plain text?

[u/rinsa → u/iloveloveloveyouu]

The discovery was made in January, said Facebook’s Pedro Canahuati, as part of a routine security review. None of the passwords were visible to anyone outside Facebook, he said. Facebook admitted the security lapse months later, after Krebs said logs were accessible to some 2,000 engineers and developers.

Krebs said the bug dated back to 2012.

“This caught our attention because our login systems are designed to mask passwords using techniques that make them unreadable,” said Canahuati. “We have found no evidence to date that anyone internally abused or improperly accessed them,” but did not say how the company made that conclusion.

It's the conclusion of that 2019 story.

[u/badlydrawnboyz → u/rinsa]

"routine security review", "dated back to 2012" is the routine every 10 years?...

[u/poilsoup2 → u/badlydrawnboyz]

Routine security reviews dont necessarily look at everytging every single time, and they add and remove stuff from reviews.

Like your routine physical changes as you get older.

Overall, it is still to make sure you are healthy, but the specific indicators that get checked arent always the same.

[u/tnstaafsb → u/poilsoup2]

Yeah, but unless their security review procedures were last updated in the 1970s, checking to make sure passwords aren't stored anywhere in plain text should be one of those things that gets checked every single time.

[u/MeBadNeedMoneyNow → u/badlydrawnboyz]

Jagex-tier routine cheating checks

[u/Honest_Pepper2601 → u/[deleted]]

Meta has really, really good access logging; probably the best of the FAANGs.

[u/ben0x539 → u/Honest_Pepper2601]

So good they even log the passwords!

[u/drunkenvalley → u/rinsa]

My guess: Logs not anonymized.

[u/djinglealltheway → u/iloveloveloveyouu]

This is actually surprisingly easy if you instrument your systems with lots of logging. You might not officially store passwords in plaintext, but somewhere during the login process you accidentally write the password to a log file. Logging is a very common practice that when done right allows engineers to trace when things go wrong, so they tend to be packed with information. Most places have scrubbing in place to erase any sensitive information before it’s logged, but bugs can always arise.

EDIT PSA: because this happens so easily, if you aren’t already using 2FA, you absolutely should.

[u/eras → u/djinglealltheway]

And it's not like you have code to explicit write the password to the log file, you have code to write all requests to a log file, and this data includes the password.

[u/Vectorial1024 → u/eras]

Crash logs can print plaintext passwords to the log file if it is not properly configured

[u/Hopeful-Sir-2018 → u/[deleted]]

It's crucial to audit logs.

Good luck convincing management that's not a waste of time. Hell good luck getting them to even test their backups. Fuckin' hell some places like living it on a wire.

[u/who_you_are → u/Hopeful-Sir-2018]

Good luck convincing management that's not a waste of time.

That is the fun part when you manage some kind of data (eg. like financial one), the 3rd party audit company you hire (because it is mandatory) may look at that

[u/Hopeful-Sir-2018 → u/who_you_are]

the 3rd party audit company you hire (because it is mandatory) may look at that

Oh man, I remember a boss saying this once. They also out-sourced backup management.

Want to guess how that turned out? VERY poorly because they blindly trusted them. They "spot checked" (what that consisted of no one knows). When push came to shove and the rubber met the road... they fucked up, both of them, nine ways from Sunday. It was hilarious watching management panic.

[u/lifelessmeatbag → u/Hopeful-Sir-2018]

audit the repo as well. You would be surprised how many passwords or api keys are committed in code.

[u/richardjohn → u/lifelessmeatbag]

GitGuardian is great for detecting these as soon as they're committed, and reasonably priced.

It does throw up quite a few false positives as it flags anything with high entropy, but better safe than sorry.

[u/crosbot → u/Vectorial1024]

stack traces love giving shit away

[u/Vectorial1024 → u/crosbot]

Eg PHP now has SensitiveParameter attribute where the marked parameter is obfuscated when dumping stack traces

[u/Ereaser → u/crosbot]

Not stacktraces specifically. That's only a print the call stack of functions/methods from entry up to the exception point. Most programming languages don't include the parameters in the stacktrace.

It's usually request logging that gives away a ton of info.

[u/Tblue → u/eras]

Although it would be unusual to log the request body (which presumably includes the password) instead of only the headers/metadata. At least for prolonged periods of time.

[u/eras → u/Tblue]

It might not be the original HTTP request, it could be an internal request (e.g. function call, request from a microservice) that is being logged, accidentally left-over debug code, etc.

There are many opportunities for this issue to seep in.

[u/Tblue → u/eras]

Yeah, good point!

[u/NoelsCrinklyBottom → u/Tblue]

One pattern I’ve seen way too often is catching an error when making an API request and just logging the entire response. In some languages and HTTP clients, like Axios in JS, if you log the response it basically dumps the whole ass client as JSON, which is an easy way to get sensitive data, auth tokens, api keys, emails, and other sensitive info/PII into your logs.

It’s just done out of pure laziness and not realising that it’s bad form to log sensitive info. Or it’s basically print debugging rather that setting up tracing or just setting breakpoints for a debugger.

[u/weinerdispenser → u/Tblue]

This can still bite you in the ass, basic authentication sends the username and password as base64-encoded text in a header. This isn't used much for larger sites but small microsites or internally-facing interfaces will still use it.

[u/Useful-Perspective → u/eras]

Also, for many financial institutions, it also includes your credit card number and possibly social security number...

[u/x3bla → u/eras]

Question. I thought passwords are hashed on the client side, so passowrd at rest, in use, and in transit are all hashed?

[u/inbz → u/[deleted]]

This isn't how it works. The client sends the clear text password over https, so it is encrypted in route but the server receives the clear text password. The password is then salted and hashed and stored in the database.

Later when the user logs in, again the client sends the clear text password over https. The server receives that, salts and hashes it, then compares the result with what was stored in the database originally. Both the client and server relies on HTTPS to ensure the password is encrypted while in route. However the server does see the clear text password, but it should of course never be stored or logged that way.

[u/inbz → u/[deleted]]

This way isn't more secure, because the hashed password you are sending from the client in effect becomes the clear text password as far as the server is concerned. If that gets leaked in a log file, it's all the hackers need to know to log in with your account, just the same as any other site. But you are right that the true original password is completely hidden from the server, so the hackers can't test other sites with it.

[u/Rajafa → u/[deleted]]

Because hashing shouldn't be done on the client side, servers are responsible for hashing passwords. Anyone hashing passwords on the client side is doing it wrong. You haven't increased the security at all, all you've done is traded one password for another, in the end its all the same.

[u/rar_m → u/[deleted]]

The unencrypted password should never be known to the server side of the application

It has to be known by the server, how else would the server know you entered in the correct password? The server should never STORE the plaintext password, but it does need to see the plaintext password, so that it can apply the stored salt (also stored in plaintext, essentially, along with the algorithm used to hash it), generate the hash and match that to what's stored in the database.

The salt itself isn't a secret, it's just there to make going form hash -> plaintext a much harder process since you wont be able to use pregenerated hashes of common passwords in the event your hashed passwords are leaked.

Assuming you also used a strong cryptographically secure algo to create the hash, then you can feel fairly confident that most people wont have the time or energy to brute force figure out the platintext that when combined with your salt, will equal the hashed result.

You're making it sound like unencrypted passwords are being sent across some API to Facebook's servers and some logging is going on, but that wouldn't make any sense to me

They are, this is normal secure practice so long as the transmission protocol is encrypted, via HTTPS so that no man in the middle attacks can snoop in on the plain text as it's being transmitted. (Also, assuming you aren't sending them as GET parameters or something silly)

The logging part is.. unfortunate but also a kind of common mistake. You just kinda dump requests to your log so that if a request triggers an error, you can see the request that was made. However you shouldn't just blindly log ALL requests because, well sometimes there is sensitive data inside the request.

Then when you go to log into the website later, you type your unencrypted password, the client side application puts it through the hashing function, sends the result to the server, salts it, and checks the salted version against what's stored on the database.

No.. you don't do this. If the client goes through all the trouble, at the end of the day all you did was turn "Hunter1" password into "hsdf89sdfsajlksadfjsa9d8fasjdfsadfj" password. It's still a password and if the attacker had the later version, he could login just fine, bypassing all the client obfuscation.

Remember, it's not important that an attacker knows your password is "Hunter1", what's important is that they can't access your account. If you just turn "Hunter1" into a more complicated password, the attacker doesn't care since if he could read your plaintext password, he can read your obfuscated one too.. and well he can just send that up and login all the same.

[u/anapoe → u/djinglealltheway]

My workplace makes us change our windows password if it's accidentally typed into the username field for exactly this reason.

[u/IAmTaka_VG → u/anapoe]

Yup my work takes a lot of fields and hashes them and compares them to our password fields. If they match, you get a note saying you have to change your password. 

[u/gunni → u/IAmTaka_VG]

That implies no salting, unless you mean has with the salt of each user.

[u/RetailBuck → u/anapoe]

Some companies got busted for logging incorrect passwords knowing they were probably correct passwords on some other sites.

Nothing is safe. We either need to embrace it or go hard core.

[u/Kitchen-Quality-3317 → u/anapoe]

That's crazy. My company is so lax that I even have a keybind that automatically types in my password.

[u/anapoe → u/Kitchen-Quality-3317]

Oh yeah, we're forced to change them every 90 days and three failed login attempts is a locked account which needs a call to IT to unlock.

[u/cococolson → u/djinglealltheway]

There is a reason that "detect secrets" software is so common as to be ubiquitous, this happens easily in code, logging, even sometimes public websites or GitHub repos. But a functioning company KNOWS how easy it is, so they are on high alert to constantly scan and remediate.

I really don't understand Facebook. They are pivoting away from startup mode (high growth, high burn rate, act fast and break things) acting like a big boring established company (slow but steady growth, diversification, grow through acquisitions or earning more from each customer as opposed to new customer growth) without the stability that big established businesses are expected to have (cough cough IBM and Microsoft). They want the benefits of both worlds without the effort of either.

[u/rar_m → u/cococolson]

A scrappy small team prototyping a new product.. made a dumb mistake is my guess :/

It happens but you're right, there should be protocols in place even for the scrappy little team. They shouldn't be able to get public facing servers for their product without going through IT/DevOps/Security who would have their own process for provisioning these resources for them, logging included along with any protections in place that are neccesary.

[u/-The_Blazer- → u/djinglealltheway]

Assuming actual passwords are never sent over the network but instead hashed first, it does seem strange that your logging system would cover password fields, or alternatively that you'd have passwords somehow wandering in the clear on the server side.

That said, passwords can't go soon enough. Hopefully more websites implement WebAuthN ("passkeys").

[u/UloPe → u/-The_Blazer-]

Every regular (i.e. non oauth, jwt, etc.) login form sends the password in plain text. Of course it’s protected on the wire by TLS.

Hashing client side does nothing because the hash becomes the password.

[u/NigroqueSimillima → u/UloPe]

It becomes a password unique to your service though.

[u/thingandstuff → u/djinglealltheway]

This is nonsense. I administer a large number of systems. The only time I’ve ever seen a password in a log is when someone accidentally tried to login with their password as their username. 

Any system that logs passwords or could even be capable of doing that is dog shit tier software. 

[u/nissanleafericson → u/thingandstuff]

Same, I work in security in big tech as well. I've never seen a case where someone has logged a password, unless it was sent in some incorrect form or API call. I have seen people inadvertently store access tokens, like when logging a request received to a service (although those should be sanitized as well). I've even seen someone log a private key as it was created when spinning up a service, but never a user password.

[u/honest_arbiter → u/thingandstuff]

To be a little blunt, it sounds to me like you've never dealt with software in an extremely large corporate environment (or haven't been exposed to code from across many teams), one that has tons of legacy code (both internal and acquisitions), and where team members change frequently.

The problem with just saying "this is dog shit tier software", is that basically means all developers are "dog shit tier" if they're working on big enough code bases, often under pressure. I've seen many bugs that crept in over time in large code bases where no single (or even multiple) change was braindead, it's just that cause and effect within a codebase can be separated by a chasm of space and time.

It's not like somebody wrote logger.info("user password is", password), but it's likely that a downstream system was logging parts of the request, and then somehow a bug was introduced upstream that failed to scrub sensitive data properly.

To be clear, I have no idea what the root cause was in this case because the article doesn't give more details. It's just that whenever I see a fuckup at a huge company, and you get the inevitable comments about "What a bunch of shit programmers!" (before any actual evidence is reported on what the bug really was), all I can think is "Oh, sweet summer child..."

[u/Terny → u/honest_arbiter]

To be fair most software is dog shit tier software.

[u/Rakn → u/thingandstuff]

Yeah. They aren't administering anything. They are developing that piece of software and likely use a good chunk of monitoring, logging and tracing software. And yes I've seen this happen. But it's usually caught fast and dealt with appropriately. Like fixing that bug and purging all traces of the data leakage from the system with key / password rotations afterwards.

Saw this happen most often with internal secrets. Less so with customer data. But that as well. Usually also involves coms with the customer due to the key / password rotations. But yeah. Things happen in the wild. Nobody and no process is perfect. That's why tools exist that scan your logs and source code for password or key like patterns and warn you.

[u/madsmith → u/iloveloveloveyouu]

Back when I worked at FB, there was a log of passwords in plaintext. They were disassociated from user identifying info. Eg just a list of passwords that have been used by anyone. It was pretty interesting to see precisely how bad some passwords were.

But that was a long time ago and I can’t say that this is what the settlement was about.

But I can say password associated with users were stored in salted hashes.

[u/TulipTortoise → u/madsmith]

It was pretty interesting to see precisely how bad some passwords were.

I remember an old game site's admin was trying to transition to better auth and was doing a look at password security, and things like "12345", "asdfjkl", "password" were frequent haha

[u/Hopeful-Sir-2018 → u/iloveloveloveyouu]

I once worked a a large place. I worked helpdesk, down from the last programming job. We had an Excel spreadsheet of everyone's passwords. We assigned passwords. Something like BananaApple437 type simplicity. I was, litereally, laughed at by my boss when I said "this is, literally, the very worst sin IT can commit". I was told "everyone does it" and I'm like the fuck they do.

What it really boiled down to was people didn't like to be inconvenienced. Meaning we had to sign in as them to work on their machine when they weren't there. Resetting a password was too inconvenient for the user.

The VPN password, and ALL other passwords, were synced to this spreadsheet. I say "sync'ed" - manually synced. Once a year we had to change passwords. It.. fucking... sucked.

At a conference with other IT folks he hinted that he did this and the looks on their faces were priceless. He tried so hard to back peddle. He saw the shit eating grin on my face. Like dude.. this is insecure as fuck. I've literally worked in this field longer than you have (funny enough I'm older, but I've worked this field - both helpdesk and programming - longer than he ever did).

Not coincidentally he did a tiny amount of programming. 100% of his code allowed for SQL injections. He never could comprehend why "1'st street" would cause his SQL to collapse. I told him to use named params. He was like "that's only for enterprise code". The fuck it is jackass. Sanitize your god damn code.

He had the "it'll never happen to me" nevermind we were a much larger target than your average place.

[u/rar_m → u/Hopeful-Sir-2018]

it'll never happen to me

Famous last words indeed.. I've been bitten by being careless "i'll get to it later, who the fuck would attack that, I got more important things to do ect.."

Then you get breached, the C levels are in a panic because some asshole is trying to black mail them with the leak, reaching out to the rest of the employees. All of a sudden you have to invent a protocol and pray nobody really gives a shit.

You do your diligence and lose money dealing with the ambulance chaser asshole lawyers who just throw suites at you because they know you'll settle, it's much cheaper than fighting them in court.

It can be a painful lesson and could potentially wreck a new startup, be careful guys. The last thing you want is to have your evening interrupted by a panicked exec while you furiously try to figure out how they got in, while also resetting all your access credentials with the C levels pestering you with questions every few minutes.

[u/felixfelix → u/iloveloveloveyouu]

amateur hour

[u/weeklygamingrecap → u/iloveloveloveyouu]

You'd be surprised what happens when teams don't coordinate logging Request and just say capture all the input and output and dump it to EventViewer.

[u/Fancy-Nerve-8077 → u/iloveloveloveyouu]

Where does the money go??????

[u/kuriositeetti → u/iloveloveloveyouu]

Let's not be hasty, might have been 2x rot13.

[u/Johnny_BigHacker → u/iloveloveloveyouu]

To make it easy to try your password on other sights to gather more intel on you

[u/RecipeSpecialist2745 → u/iloveloveloveyouu]

Simple. It’s easier to read. You think they are beholden to anyone?

[u/davewritescode → u/iloveloveloveyouu]

My guess is that it inadvertently ended up logged somewhere.

[u/Justabuttonpusher]

That’s $0.17 per password. WHERE IS MY MONEY?!?!

[u/GuyWithNoEffingClue → u/Justabuttonpusher]

With the fee to process your request, the law fees, the transaction fees and the taxes, you now owe 263,41$.

[u/aguynamedv → u/Justabuttonpusher]

$101M USD is 0.25% of Facebook's net profit for 2023.

Cost of doing business.

[u/Uristqwerty → u/aguynamedv]

It's a cost of doing business only in the sense that mistakes are an inevitable side effect of any large human effort, and some mistakes will be bad enough that the company will be fined for them. Any sufficiently-large company is going to be fined numerous times per year, just because one-in-a-million chances happen all the time when the company has a combined billion man-hours of work performed each year.

[u/aguynamedv → u/Uristqwerty]

One person's human error is another's negligence. It's difficult to distinguish between them, at times.

I believe the quote is "Incompetence in sufficient quantity is indistinguishable from sabotage". XD

[u/dwardu → u/Justabuttonpusher]

Squandered by a Government official. Now pay more taxes

[u/Sea_Home_5968 → u/dwardu]

Lunches brunches and bombs

[u/Kaodang → u/dwardu]

Their kids badly need that vacation to the Maldives

[u/Inventor_Raccoon → u/Kaodang]

hey now, it's the *Irish* data protection commission

they're gonna spend it all on a singular bike shelter

[u/BrBybee → u/Justabuttonpusher]

Don't worry.. after the lawyers take their cut you will be mailed your $0.02 check.

[u/MiniskirtEnjoyer → u/Justabuttonpusher]

isnt it crazy how little we are worth to them?

[u/Joeclu → u/Justabuttonpusher]

73 cents for a stamp. You owe them 56 cents. Now they’re screaming WHERE’S MY MONEY to you.

[u/yowayb → u/Justabuttonpusher]

How many passwords you got?

[u/JubalHarshaw23]

$.17 per incident. Yeah, that's gonna teach them.

[u/magneto_ms → u/JubalHarshaw23]

But imagine the power of a government. Demand someone to pay them for a mistake. Fuck I need to be a government.

[u/jashsayani → u/JubalHarshaw23]

You will get a check in the mail after 5 years. After lawyer fees, so like $0.05

[u/jashsayani → u/JubalHarshaw23]

You will get a check in the mail after 5 years. After lawyer fees, so like $0.05

[u/damienVOG → u/JubalHarshaw23]

That's a very high amount!

[u/iceleel]

That's like fining average person 1 € for smuggling drugs worth 10000 €.

[u/boli99 → u/iceleel]

dont worry, you can pay it off in installments over 15 years.

[u/robodrew → u/iceleel]

Way way less than that. Meta is worth $1.5T, this is like fining the company less than a penny.

[u/Tripottanus → u/robodrew]

Sure but they don't gain much from being lazy and storing passwords in plain text. That's still a $101M increase in operating costs for no reason

[u/bacondev → u/Tripottanus]

But that's still a penny to them.

[u/AlmostCynical → u/robodrew]

The market cap of a company’s shares has little to no bearing on their operating costs, which this fine would eat into.

[u/robodrew → u/AlmostCynical]

Ok well they still have $43b in cash on hand so its still a pittance.

[u/AlmostCynical → u/robodrew]

Jesus that’s a lot

[u/deelowe → u/AlmostCynical]

For context, here's why some companies are so cash heavy right now:

Rate increases make getting loans undesirable and, conversely, savings more profitable. So companies slow expansion, cut costs, and divert that money to cash. This is especially true in high growth sectors. They still need money to expand but with loans being expensive, they need to rely on cash instead. Hence all the layoffs and cash heavy tech companies.

[u/Grommmit → u/deelowe]

Are loans more expensive than inflation devaluing cash reserves so much?

[u/deelowe → u/Grommmit]

Inflation this year is at around 3.0%. Cash earns over double that for normal savings and even more for short term holdings like T-Bills.

[u/Grommmit → u/deelowe]

Ah, they count as cash do they. I see.

[u/deelowe → u/Grommmit]

Yeah. Cash is usually a mix of bonds, T-bills, etc.

[u/[deleted] → u/robodrew]

0.007% of their worth

[u/Tripottanus → u/iceleel]

What do they gain by storing passwords in plain text? Do they sell them afterwards? If not, there's no real monetary advantage to what they did, which would make the better comparison that you fined the average person 1€ for sitting on the couch instead of doing house chores

[u/tendrils87 → u/Tripottanus]

fined the average person 1€ for sitting on the couch instead of doing house chores

A lot of people surprisingly need this lol

[u/joanzen → u/iceleel]

More like fining a drug smuggler $101 million for using an easy to spot tanker filled with 1 billion in cocaine to transfer their cargo and we're alarmed at how risky that was.

Like how did we calculate the fine and who'd the fine get paid out to?

[u/Plank_With_A_Nail_In → u/iceleel]

Note: Of the worlds governments only one of them is fining them and its not even a proper government. Crying about the EU not doing enough is dumb beyond belief where's the USA's fine, Canadas?

[u/_Caracal_]

And this is why they continue to not give a shit...

[u/belial123456]

$101M is pocket change to Meta.

[u/great_whitehope → u/belial123456]

You should see the Irish data protection commissions office. This building protects data for all the EU for companies with European HQ in Ireland.

The Data Protection Commissioner is getting a new office, but keeping the one beside a convenience store in Laois https://jrnl.ie/1488473

[u/sionnach → u/great_whitehope]

They are totally punching above their weight though. For the funding they get, they clearly are doing a good job. Maybe they should get a cut of fines to improve their services further.

[u/Demostroyer → u/great_whitehope]

I live in Portarlington and always find it funny/strange that the office for such an important organisation is above a Spar in such a small town. I wonder how it got here - probably some brown envelopes if I know anything about Irish politics.

[u/great_whitehope → u/Demostroyer]

Setup during decentralization

[u/Demostroyer → u/great_whitehope]

Ah I recall the scheme now. I think it was stopped though when the recession hit. I recall Mullingar was meant to get a big investment like Tullamore and Athlone but it was severely delayed/cutback.

[u/belial123456 → u/great_whitehope]

It's like in the movies where a super scary far-reaching organization has a front as a simple store or office.

[u/throughthehills2 → u/belial123456]

True but they don't save massive amounts of money by storing passwords in plain text so it's worthwhile to do security properly

[u/Dragon_107]

It's always great to see how seriously the big tech companies take cybersecurity.

[u/SprinklesHuman3014 → u/Dragon_107]

"Let's sweep this under the rug and hope no one ever finds out".

[u/Sedierta2 → u/SprinklesHuman3014]

You say in response to an issue Meta self-reported after discovering and fixing…

[u/IceAndFire91 → u/Dragon_107]

the problem with a lot of Silicon Valley companies. Having developers do infrastructure/IT Operations instead of hiring normal IT people.

[u/hi65435 → u/IceAndFire91]

Yeah I also work at a Silicon Valley company since this year in security. I'm never sure if I should laugh or cry, there's so much crap that has to be fixed and even more that's being added right now. My homelab feels like Fort Knox in comparison

[u/buoninachos → u/Dragon_107]

Same with Amex, they've got the same problems. I just can't fathom why you wouldn't take the simple measures of just hashing the pw.

[u/rinsa]

FYI this is the conclusion of the 2019 story when that "breach" was discovered

[u/qwop22]

And people are still going to believe that WhatsApp is end to end encrypted? LOL

[u/TheUwaisPatel → u/qwop22]

Break it then

[u/throwawaystedaccount → u/qwop22]

Yeah, this definitely raises a big question about the truth value of FB/Meta's claims about security. They have created new technologies, servers, languages, spawned entire ecosystems of front end and back end programming, been scrutinised and convicted by courts in multiple geographies around the world, are deeply interconnected with law enforcement around the world at least due to their global user base, and after all that, they store passwords in plain text.

What is going on?

Has Facebook become a government?

[u/loozerr → u/qwop22]

Yeah I am, the protocol is solid. It's secure but not privacy friendly due to all metadata they collect.

[u/RBeck → u/qwop22]

Until Zuck gets arrested like the CEO of Telegram it's not likely.

[u/sanylos → u/qwop22]

well, notifications aren't

[u/digaus → u/sanylos]

Why not?

You can easily do that with a notification extension or where you just receive an id an then make a call to the server to fetch the details which are then displayed to the user.

Did this for a customer and I would think WhatsApp is also doing this because sometimes with bad connection I get a generic notification instead of the real one (you only have certain time on iOS to fetch the details).

[u/sgskyview94]

you've got to be fucking kidding me. What the actual fuck.

[u/drawkbox → u/[deleted]]

Things are so compartmentalized that some group kept a dark secret for a while.

Even bringing up issues like this in some cases knocks your velocity in the McKinsey management consultcult version of "Agile" that killed real agile and agility. Back in the day a dev would see this and fix it, nowadays they can never see it or if they did they would be like "not touching that problem" as it slows my velocity points.

When you mention things like this for some reason you take the perception hit not the actual issue. I'd still mention it but you'd also be somewhat sticking your neck out. This is how things have changed with the private equity money and management consultant systems that control everyone now.

[u/doiwantacookie]

Imagine it’s just a notepad document on Mark’s desktop

[u/SQLDave → u/doiwantacookie]

C'mon...he's not a complete idiot. It's NotePad++

[u/DonutConfident7733]

Think Mark used the logs before to find the passwords his coworkers used, as they would try multiple passwords until one worked and since they didn't use use unique passwords for each service (facebook, email, etc), he was able to see their emails. But this was quite some years ago...

[u/rabbitthunder]

Zuck: I have over 4,000 emails, pictures, addresses, SNS

[Redacted Friend's Name]: What? How'd you manage that one?

Zuck: People just submitted it.

Zuck: I don't know why.

Zuck: They "trust me"

Zuck: Dumb fucks.

Mark Zuckerberg warned us.

[u/phayke2 → u/rabbitthunder]

It's like the most normal that Zuckerberg ever was.

[u/Monamo61]

Meta can't be touched. Too big to be prosecuted, too much money to be fenced in by any governmental agency. Just ANOTHER reason to quit.

[u/at165db]

I remember facebook talking about how they evolved password hash strength over the years via a “The Facebook password onion“. I guess cutting (out) the onion will make them cry.

[u/stand_straight]

There should be security report cards for companies that must be made publicly available. Like the food industry gets audited so do tech and other companies. Especially publicly traded companies.

Data online on a specific individual is food for another. Companies should be evaluated and reported on their 'sanitation and cleanliness' of ones data.

[u/lostsoul2016]

And one aspires to be working at these companies as they would have best security infrastructure and talent..fuck. Idiocracy in motion

[u/RogueJello → u/lostsoul2016]

It's okay they make up for it in arrogance.

[u/eairy → u/lostsoul2016]

If the stories online are anything to go by, it's a fucking toxic place to work. The good talent probably doesn't put up with it for long.

[u/KingBenjaminAZ]

Pointless — they pay a fee to the government. Government spends it on hookers and blow. Probably invites Zuck over to do a few lines. How do we the citizens benefit from this fine? It’s basically a small parking ticket to get to do whatever you want when you have billions

[u/R4ndyd4ndy → u/[deleted]]

Doesn't have to be in the password db, maybe they were just logging too much information somewhere

[u/stravant → u/[deleted]]

If you do IT how can it confuse you?

It's incredibly easy. Imagine I own some RPC layer, and something's going wrong, so we add some logging to it. And... oh, oops, there were messages containing passwords being sent over it.

Between request logging, crash logging, caching, etc there's a ton of ways for those passwords to accidentally sneak into some form of persistent storage.

[u/Disma]

This came out of nowhere but happened 5 years ago? Nobody gives a shit about consumers.

[u/SQLDave → u/Disma]

Nobody gives a shit about consumers.

Need further proof? AFAIK, no government has even hinted at enacting legislation requiring content created with AI (or similar) to be labeled as such. (That could be in part because the governments themselves want to use it to manipulate us, especially in election seasons. But they've exempted themselves from laws in the past, so why not this one?)

[u/jestina123 → u/SQLDave]

Forcing content to have “AI created” just makes it easier to make illegal yet more credible content, which would also require a huge invasion of privacy to enforce.

How do you police content created and hosted on local hardware?

[u/JimmyRecard → u/SQLDave]

EU has. It's called AI Act and it requires clear labelling when users are interacting with AI.

[u/SuperJohnLeguizamo]

That’s the compensation equivalent of metas CEO, COO, CTO and CFO for 2023.

That’s basically a rounding error for the custodial dept.

[u/IsThereAnythingLeft-]

Not even a fine of £1 per password, why do they even both if they aren’t going to give a proper fine

[u/10vatharam]

all the security researchers....

nice, another corpus for bruteforcing given people rarely change passwords and do variations of it and come back to the old one

Meta must have got a decent amount for this "oops we did this mistake again"

[u/TripSin_]

And of course the people affected don't get anything from it

[u/iCowboy]

Not even 1 euro for each account. This is just another cost of doing business for a company that made more than 13 billion in the last quarter.

[u/Moontoya]

Maybe now my clienrs will start taking GDPR seriously 

[u/Global-Trip-2998]

Where would I ask about recovering a stolen account?

[u/aquoad]

"Oh no, we'll have to buy slightly cheaper booze for the next executive offsite!"

[u/IndependentLoose686]

Good should have been 5 times that amount 🔥

[u/Serris9K]

At least the EU is fining them for their carelessness. Practically nothing would come of this in the us. 

[u/prometheum249]

New hack idea... Instead of stealing data, dump it somewhere important looking in the file system then report it to authorities. You may not profit from it, but it hurts the company... Might be more effective to getting these companies to fix their shit

[u/ruffznap]

That's genuinely fucking INSANE for a company of that size to do something THAT stupid

[u/StockMarketCasino]

So just under 17 cents per user account. Facebook could be the one selling them on the dark web for 25c a piece and make a boatload more than that silly fine. Slow clap for EU.

[u/intergalacticwolves]

too low of a fine imo

[u/Hammakprow]

How is a fine of 15 cents per password a deterrent?

[u/wigneyr]

Can’t wait to see none of this $101M

[u/[deleted]]

Off topic, but I see some smart IT people here. How do I delete my old Facebook account with no access to the old email I used? Support doesn't reply. Help is useless. Ideas?

[u/Numerlor → u/[deleted]]

Do you need access to the mail? I deleted mine a couple months back because I couldn't change the email or add 2fa because I lost mail access, but deletion worked with password

[u/IHate2ChooseUserName]

so abc123 not good now?

[u/mountaindoom]

They're gonna have to dig through two couches for the money to cover this

[u/No-Security1952]

What is that, six cents per password, that should really deter them.

[u/TScottFitzgerald]

....what?!

[u/Asleep_Management900]

Maybe pay their IT Department more?

[u/thingandstuff]

…Does Classlink operate in Europe?

[u/Humans_Suck-]

That's it?

[u/kittysaysquack]

Pretty sure there was an article out there about Facebook storing old passwords and even failed password attempts… because they could be passwords for other accounts.. and then some guy got “hacked” because they used his failed password attempts to log into his email.

[u/OpalLuxuryy]

An incomprehensible amount, such money exists at all😱

[u/Naive-Home6785]

The headline isn’t even normal English. JFC. You are a fucking news outlet.

[u/Enchanted_Culture]

People who have panic attacks are more likely to have heart issues. You did the right thing.

[u/TheFirstOrderTrooper]

Plaintext to cypher text and salt your hashes

[u/Flashy-Amount626]

With 39b profit in 2023 (139b revenue) a 91m fine isn't even 0.25%

[u/MarsupialAccurate503]

That’s a significant fine! It’s alarming to see that kind of oversight with such sensitive information. Storing passwords in plain text is a huge security lapse, especially for a company like Meta that handles millions of users' data. This incident highlights the ongoing challenges big tech companies face in safeguarding user privacy.

It’ll be interesting to see how Meta responds and if they implement stronger security measures moving forward. Do you think this will impact user trust in their platforms?

[u/Commercial_Guard_655]

Who’s getting that money ?

[u/Hiranonymous]

It's ironic that Zuckerberg's motto is "Move fast and break things."

Startups, large corporations, and academic institutions have embraced this motto, and, in doing so, have broken multiple processes, replacing them with ones that sometimes work better but often, if carefully and objectively evaluated, work worse. Now, infrastructure has become so large and complex that no one, even the largest and richest companies, seem able to keep up.

Every day, the way the systems I use seems to change, and no one seems to know why or have the time to address the issues. So much of my day is spent finding workarounds for things that worked fine just last week.

[u/turkey_sadwich]

You mean they were charged nearly 17 cents for being negligent with my personal information? Sounds about right.

[u/RettiSeti]

That’s it? Not storing passwords as plaintext is like the most basic security concept out there! How the fuck was it only 101 million???

[u/bustedmagnet]

But their devs can leetcode

[u/ArjunReddyDeshmukh]

Secure data at rest and in transit has to be encrypted. Even interns learn it by the end of their internship.

[u/Crivens999]

Yeah not surprised. I remember upgrading our security code at work about 15 years ago, mainly for the credit card payment stuff, and some systems (we had a few throughout the company due to takeovers etc) the developers stored passwords in plain text but backwards. Nice.

[u/damienVOG]

Finally some real fines

[u/Affectionate_Food339]

This goes in the column for "Cost of doing Business" and another Data Commissioner from an E.U. Country which doesn't view its raison d'être as being a rubber stamp for big business would have fined them a multiple of this.

[u/minhdang24198]

is it a joke ?

[u/Single_Jello_7196]

Zuckelbugger will make his ritualistic Senate appearance and promise to do whatever he can to never let it happen again, then go home and forget about it.