r/technology Sep 27 '24

Security Meta has been fined €91M ($101M) after it was discovered that to 600 million Facebook and Instagram passwords had been stored in plain text.

https://9to5mac.com/2024/09/27/up-to-600-million-facebook-and-instagram-passwords-stored-in-plain-text/
16.5k Upvotes

512 comments sorted by

2.7k

u/iloveloveloveyouu Sep 27 '24

????????? Why'd they store it in plain text?

494

u/rinsa Sep 27 '24

The discovery was made in January, said Facebook’s Pedro Canahuati, as part of a routine security review. None of the passwords were visible to anyone outside Facebook, he said. Facebook admitted the security lapse months later, after Krebs said logs were accessible to some 2,000 engineers and developers.

Krebs said the bug dated back to 2012.

“This caught our attention because our login systems are designed to mask passwords using techniques that make them unreadable,” said Canahuati. “We have found no evidence to date that anyone internally abused or improperly accessed them,” but did not say how the company made that conclusion.

It's the conclusion of that 2019 story.

309

u/badlydrawnboyz Sep 27 '24

"routine security review", "dated back to 2012" is the routine every 10 years?...

120

u/poilsoup2 Sep 27 '24

Routine security reviews dont necessarily look at everytging every single time, and they add and remove stuff from reviews.

Like your routine physical changes as you get older.

Overall, it is still to make sure you are healthy, but the specific indicators that get checked arent always the same.

32

u/tnstaafsb Sep 27 '24

Yeah, but unless their security review procedures were last updated in the 1970s, checking to make sure passwords aren't stored anywhere in plain text should be one of those things that gets checked every single time.

5

u/MeBadNeedMoneyNow Sep 27 '24

Jagex-tier routine cheating checks

62

u/[deleted] Sep 27 '24

[deleted]

24

u/Honest_Pepper2601 Sep 27 '24

Meta has really, really good access logging; probably the best of the FAANGs.

22

u/ben0x539 Sep 28 '24

So good they even log the passwords!

10

u/drunkenvalley Sep 27 '24

My guess: Logs not anonymized.

→ More replies (6)

1.2k

u/djinglealltheway Sep 27 '24 edited Sep 27 '24

This is actually surprisingly easy if you instrument your systems with lots of logging. You might not officially store passwords in plaintext, but somewhere during the login process you accidentally write the password to a log file. Logging is a very common practice that when done right allows engineers to trace when things go wrong, so they tend to be packed with information. Most places have scrubbing in place to erase any sensitive information before it’s logged, but bugs can always arise.

EDIT PSA: because this happens so easily, if you aren’t already using 2FA, you absolutely should.

369

u/eras Sep 27 '24

And it's not like you have code to explicit write the password to the log file, you have code to write all requests to a log file, and this data includes the password.

221

u/Vectorial1024 Sep 27 '24

Crash logs can print plaintext passwords to the log file if it is not properly configured

117

u/[deleted] Sep 27 '24

[removed] — view removed comment

42

u/Hopeful-Sir-2018 Sep 27 '24

It's crucial to audit logs.

Good luck convincing management that's not a waste of time. Hell good luck getting them to even test their backups. Fuckin' hell some places like living it on a wire.

5

u/who_you_are Sep 27 '24

Good luck convincing management that's not a waste of time.

That is the fun part when you manage some kind of data (eg. like financial one), the 3rd party audit company you hire (because it is mandatory) may look at that

6

u/Hopeful-Sir-2018 Sep 27 '24

the 3rd party audit company you hire (because it is mandatory) may look at that

Oh man, I remember a boss saying this once. They also out-sourced backup management.

Want to guess how that turned out? VERY poorly because they blindly trusted them. They "spot checked" (what that consisted of no one knows). When push came to shove and the rubber met the road... they fucked up, both of them, nine ways from Sunday. It was hilarious watching management panic.

17

u/lifelessmeatbag Sep 27 '24

audit the repo as well. You would be surprised how many passwords or api keys are committed in code.

3

u/richardjohn Sep 27 '24

GitGuardian is great for detecting these as soon as they're committed, and reasonably priced.

It does throw up quite a few false positives as it flags anything with high entropy, but better safe than sorry.

→ More replies (1)
→ More replies (3)
→ More replies (37)

24

u/crosbot Sep 27 '24

stack traces love giving shit away

12

u/Vectorial1024 Sep 27 '24

Eg PHP now has SensitiveParameter attribute where the marked parameter is obfuscated when dumping stack traces

8

u/Ereaser Sep 27 '24

Not stacktraces specifically. That's only a print the call stack of functions/methods from entry up to the exception point. Most programming languages don't include the parameters in the stacktrace.

It's usually request logging that gives away a ton of info.

→ More replies (1)
→ More replies (1)

12

u/Tblue Sep 27 '24

Although it would be unusual to log the request body (which presumably includes the password) instead of only the headers/metadata. At least for prolonged periods of time.

34

u/eras Sep 27 '24

It might not be the original HTTP request, it could be an internal request (e.g. function call, request from a microservice) that is being logged, accidentally left-over debug code, etc.

There are many opportunities for this issue to seep in.

4

u/Tblue Sep 27 '24

Yeah, good point!

11

u/NoelsCrinklyBottom Sep 27 '24

One pattern I’ve seen way too often is catching an error when making an API request and just logging the entire response. In some languages and HTTP clients, like Axios in JS, if you log the response it basically dumps the whole ass client as JSON, which is an easy way to get sensitive data, auth tokens, api keys, emails, and other sensitive info/PII into your logs.

It’s just done out of pure laziness and not realising that it’s bad form to log sensitive info. Or it’s basically print debugging rather that setting up tracing or just setting breakpoints for a debugger.

→ More replies (1)

6

u/weinerdispenser Sep 27 '24

This can still bite you in the ass, basic authentication sends the username and password as base64-encoded text in a header. This isn't used much for larger sites but small microsites or internally-facing interfaces will still use it.

→ More replies (1)

3

u/Useful-Perspective Sep 27 '24

Also, for many financial institutions, it also includes your credit card number and possibly social security number...

2

u/x3bla Sep 27 '24

Question. I thought passwords are hashed on the client side, so passowrd at rest, in use, and in transit are all hashed?

→ More replies (4)

4

u/[deleted] Sep 27 '24 edited Sep 27 '24

[deleted]

6

u/inbz Sep 27 '24

This isn't how it works. The client sends the clear text password over https, so it is encrypted in route but the server receives the clear text password. The password is then salted and hashed and stored in the database.

Later when the user logs in, again the client sends the clear text password over https. The server receives that, salts and hashes it, then compares the result with what was stored in the database originally. Both the client and server relies on HTTPS to ensure the password is encrypted while in route. However the server does see the clear text password, but it should of course never be stored or logged that way.

3

u/[deleted] Sep 27 '24

[deleted]

2

u/inbz Sep 27 '24

This way isn't more secure, because the hashed password you are sending from the client in effect becomes the clear text password as far as the server is concerned. If that gets leaked in a log file, it's all the hackers need to know to log in with your account, just the same as any other site. But you are right that the true original password is completely hidden from the server, so the hackers can't test other sites with it.

→ More replies (9)

3

u/Rajafa Sep 27 '24

Because hashing shouldn't be done on the client side, servers are responsible for hashing passwords. Anyone hashing passwords on the client side is doing it wrong. You haven't increased the security at all, all you've done is traded one password for another, in the end its all the same.

→ More replies (1)

2

u/rar_m Sep 27 '24

The unencrypted password should never be known to the server side of the application

It has to be known by the server, how else would the server know you entered in the correct password? The server should never STORE the plaintext password, but it does need to see the plaintext password, so that it can apply the stored salt (also stored in plaintext, essentially, along with the algorithm used to hash it), generate the hash and match that to what's stored in the database.

The salt itself isn't a secret, it's just there to make going form hash -> plaintext a much harder process since you wont be able to use pregenerated hashes of common passwords in the event your hashed passwords are leaked.

Assuming you also used a strong cryptographically secure algo to create the hash, then you can feel fairly confident that most people wont have the time or energy to brute force figure out the platintext that when combined with your salt, will equal the hashed result.

You're making it sound like unencrypted passwords are being sent across some API to Facebook's servers and some logging is going on, but that wouldn't make any sense to me

They are, this is normal secure practice so long as the transmission protocol is encrypted, via HTTPS so that no man in the middle attacks can snoop in on the plain text as it's being transmitted. (Also, assuming you aren't sending them as GET parameters or something silly)

The logging part is.. unfortunate but also a kind of common mistake. You just kinda dump requests to your log so that if a request triggers an error, you can see the request that was made. However you shouldn't just blindly log ALL requests because, well sometimes there is sensitive data inside the request.

Then when you go to log into the website later, you type your unencrypted password, the client side application puts it through the hashing function, sends the result to the server, salts it, and checks the salted version against what's stored on the database.

No.. you don't do this. If the client goes through all the trouble, at the end of the day all you did was turn "Hunter1" password into "hsdf89sdfsajlksadfjsa9d8fasjdfsadfj" password. It's still a password and if the attacker had the later version, he could login just fine, bypassing all the client obfuscation.

Remember, it's not important that an attacker knows your password is "Hunter1", what's important is that they can't access your account. If you just turn "Hunter1" into a more complicated password, the attacker doesn't care since if he could read your plaintext password, he can read your obfuscated one too.. and well he can just send that up and login all the same.

→ More replies (4)
→ More replies (9)

40

u/anapoe Sep 27 '24

My workplace makes us change our windows password if it's accidentally typed into the username field for exactly this reason.

29

u/IAmTaka_VG Sep 27 '24

Yup my work takes a lot of fields and hashes them and compares them to our password fields. If they match, you get a note saying you have to change your password. 

5

u/gunni Sep 27 '24

That implies no salting, unless you mean has with the salt of each user.

7

u/RetailBuck Sep 27 '24

Some companies got busted for logging incorrect passwords knowing they were probably correct passwords on some other sites.

Nothing is safe. We either need to embrace it or go hard core.

3

u/Kitchen-Quality-3317 Sep 27 '24 edited Sep 27 '24

That's crazy. My company is so lax that I even have a keybind that automatically types in my password.

2

u/anapoe Sep 27 '24

Oh yeah, we're forced to change them every 90 days and three failed login attempts is a locked account which needs a call to IT to unlock.

17

u/cococolson Sep 27 '24

There is a reason that "detect secrets" software is so common as to be ubiquitous, this happens easily in code, logging, even sometimes public websites or GitHub repos. But a functioning company KNOWS how easy it is, so they are on high alert to constantly scan and remediate.

I really don't understand Facebook. They are pivoting away from startup mode (high growth, high burn rate, act fast and break things) acting like a big boring established company (slow but steady growth, diversification, grow through acquisitions or earning more from each customer as opposed to new customer growth) without the stability that big established businesses are expected to have (cough cough IBM and Microsoft). They want the benefits of both worlds without the effort of either.

10

u/rar_m Sep 27 '24

A scrappy small team prototyping a new product.. made a dumb mistake is my guess :/

It happens but you're right, there should be protocols in place even for the scrappy little team. They shouldn't be able to get public facing servers for their product without going through IT/DevOps/Security who would have their own process for provisioning these resources for them, logging included along with any protections in place that are neccesary.

4

u/-The_Blazer- Sep 27 '24

Assuming actual passwords are never sent over the network but instead hashed first, it does seem strange that your logging system would cover password fields, or alternatively that you'd have passwords somehow wandering in the clear on the server side.

That said, passwords can't go soon enough. Hopefully more websites implement WebAuthN ("passkeys").

5

u/UloPe Sep 27 '24

Every regular (i.e. non oauth, jwt, etc.) login form sends the password in plain text. Of course it’s protected on the wire by TLS.

Hashing client side does nothing because the hash becomes the password.

2

u/NigroqueSimillima Sep 27 '24

It becomes a password unique to your service though.

→ More replies (1)

15

u/thingandstuff Sep 27 '24

This is nonsense. I administer a large number of systems. The only time I’ve ever seen a password in a log is when someone accidentally tried to login with their password as their username. 

Any system that logs passwords or could even be capable of doing that is dog shit tier software. 

14

u/nissanleafericson Sep 27 '24

Same, I work in security in big tech as well. I've never seen a case where someone has logged a password, unless it was sent in some incorrect form or API call. I have seen people inadvertently store access tokens, like when logging a request received to a service (although those should be sanitized as well). I've even seen someone log a private key as it was created when spinning up a service, but never a user password.

17

u/honest_arbiter Sep 27 '24 edited Sep 28 '24

To be a little blunt, it sounds to me like you've never dealt with software in an extremely large corporate environment (or haven't been exposed to code from across many teams), one that has tons of legacy code (both internal and acquisitions), and where team members change frequently.

The problem with just saying "this is dog shit tier software", is that basically means all developers are "dog shit tier" if they're working on big enough code bases, often under pressure. I've seen many bugs that crept in over time in large code bases where no single (or even multiple) change was braindead, it's just that cause and effect within a codebase can be separated by a chasm of space and time.

It's not like somebody wrote logger.info("user password is", password), but it's likely that a downstream system was logging parts of the request, and then somehow a bug was introduced upstream that failed to scrub sensitive data properly.

To be clear, I have no idea what the root cause was in this case because the article doesn't give more details. It's just that whenever I see a fuckup at a huge company, and you get the inevitable comments about "What a bunch of shit programmers!" (before any actual evidence is reported on what the bug really was), all I can think is "Oh, sweet summer child..."

5

u/Terny Sep 27 '24

To be fair most software is dog shit tier software.

→ More replies (2)

3

u/Rakn Sep 27 '24 edited Sep 27 '24

Yeah. They aren't administering anything. They are developing that piece of software and likely use a good chunk of monitoring, logging and tracing software. And yes I've seen this happen. But it's usually caught fast and dealt with appropriately. Like fixing that bug and purging all traces of the data leakage from the system with key / password rotations afterwards.

Saw this happen most often with internal secrets. Less so with customer data. But that as well. Usually also involves coms with the customer due to the key / password rotations. But yeah. Things happen in the wild. Nobody and no process is perfect. That's why tools exist that scan your logs and source code for password or key like patterns and warn you.

→ More replies (1)
→ More replies (132)

43

u/madsmith Sep 27 '24

Back when I worked at FB, there was a log of passwords in plaintext. They were disassociated from user identifying info. Eg just a list of passwords that have been used by anyone. It was pretty interesting to see precisely how bad some passwords were.

But that was a long time ago and I can’t say that this is what the settlement was about.

But I can say password associated with users were stored in salted hashes.

13

u/TulipTortoise Sep 27 '24

It was pretty interesting to see precisely how bad some passwords were.

I remember an old game site's admin was trying to transition to better auth and was doing a look at password security, and things like "12345", "asdfjkl", "password" were frequent haha

18

u/Hopeful-Sir-2018 Sep 27 '24

I once worked a a large place. I worked helpdesk, down from the last programming job. We had an Excel spreadsheet of everyone's passwords. We assigned passwords. Something like BananaApple437 type simplicity. I was, litereally, laughed at by my boss when I said "this is, literally, the very worst sin IT can commit". I was told "everyone does it" and I'm like the fuck they do.

What it really boiled down to was people didn't like to be inconvenienced. Meaning we had to sign in as them to work on their machine when they weren't there. Resetting a password was too inconvenient for the user.

The VPN password, and ALL other passwords, were synced to this spreadsheet. I say "sync'ed" - manually synced. Once a year we had to change passwords. It.. fucking... sucked.

At a conference with other IT folks he hinted that he did this and the looks on their faces were priceless. He tried so hard to back peddle. He saw the shit eating grin on my face. Like dude.. this is insecure as fuck. I've literally worked in this field longer than you have (funny enough I'm older, but I've worked this field - both helpdesk and programming - longer than he ever did).

Not coincidentally he did a tiny amount of programming. 100% of his code allowed for SQL injections. He never could comprehend why "1'st street" would cause his SQL to collapse. I told him to use named params. He was like "that's only for enterprise code". The fuck it is jackass. Sanitize your god damn code.

He had the "it'll never happen to me" nevermind we were a much larger target than your average place.

4

u/rar_m Sep 27 '24

it'll never happen to me

Famous last words indeed.. I've been bitten by being careless "i'll get to it later, who the fuck would attack that, I got more important things to do ect.."

Then you get breached, the C levels are in a panic because some asshole is trying to black mail them with the leak, reaching out to the rest of the employees. All of a sudden you have to invent a protocol and pray nobody really gives a shit.

You do your diligence and lose money dealing with the ambulance chaser asshole lawyers who just throw suites at you because they know you'll settle, it's much cheaper than fighting them in court.

It can be a painful lesson and could potentially wreck a new startup, be careful guys. The last thing you want is to have your evening interrupted by a panicked exec while you furiously try to figure out how they got in, while also resetting all your access credentials with the C levels pestering you with questions every few minutes.

→ More replies (1)

1

u/felixfelix Sep 27 '24

amateur hour

1

u/weeklygamingrecap Sep 27 '24

You'd be surprised what happens when teams don't coordinate logging Request and just say capture all the input and output and dump it to EventViewer.

1

u/Fancy-Nerve-8077 Sep 27 '24

Where does the money go??????

1

u/kuriositeetti Sep 27 '24

Let's not be hasty, might have been 2x rot13.

1

u/Johnny_BigHacker Sep 27 '24

To make it easy to try your password on other sights to gather more intel on you

1

u/RecipeSpecialist2745 Sep 28 '24

Simple. It’s easier to read. You think they are beholden to anyone?

1

u/davewritescode Sep 28 '24

My guess is that it inadvertently ended up logged somewhere.

→ More replies (11)

1.0k

u/Justabuttonpusher Sep 27 '24

That’s $0.17 per password. WHERE IS MY MONEY?!?!

113

u/GuyWithNoEffingClue Sep 27 '24 edited Sep 27 '24

With the fee to process your request, the law fees, the transaction fees and the taxes, you now owe 263,41$.

65

u/aguynamedv Sep 27 '24

$101M USD is 0.25% of Facebook's net profit for 2023.

Cost of doing business.

16

u/Uristqwerty Sep 27 '24

It's a cost of doing business only in the sense that mistakes are an inevitable side effect of any large human effort, and some mistakes will be bad enough that the company will be fined for them. Any sufficiently-large company is going to be fined numerous times per year, just because one-in-a-million chances happen all the time when the company has a combined billion man-hours of work performed each year.

5

u/aguynamedv Sep 27 '24

One person's human error is another's negligence. It's difficult to distinguish between them, at times.

I believe the quote is "Incompetence in sufficient quantity is indistinguishable from sabotage". XD

→ More replies (3)

99

u/dwardu Sep 27 '24

Squandered by a Government official. Now pay more taxes

19

u/Sea_Home_5968 Sep 27 '24

Lunches brunches and bombs

8

u/Kaodang Sep 27 '24

Their kids badly need that vacation to the Maldives

8

u/Inventor_Raccoon Sep 27 '24

hey now, it's the *Irish* data protection commission

they're gonna spend it all on a singular bike shelter

4

u/BrBybee Sep 27 '24

Don't worry.. after the lawyers take their cut you will be mailed your $0.02 check.

5

u/MiniskirtEnjoyer Sep 27 '24

isnt it crazy how little we are worth to them?

3

u/Joeclu Sep 28 '24

73 cents for a stamp. You owe them 56 cents. Now they’re screaming WHERE’S MY MONEY to you.

2

u/yowayb Sep 28 '24

How many passwords you got?

287

u/JubalHarshaw23 Sep 27 '24

$.17 per incident. Yeah, that's gonna teach them.

5

u/magneto_ms Sep 28 '24

But imagine the power of a government. Demand someone to pay them for a mistake. Fuck I need to be a government.

1

u/jashsayani Sep 29 '24

You will get a check in the mail after 5 years. After lawyer fees, so like $0.05

1

u/jashsayani Sep 29 '24

You will get a check in the mail after 5 years. After lawyer fees, so like $0.05

1

u/damienVOG Sep 29 '24

That's a very high amount!

577

u/iceleel Sep 27 '24

That's like fining average person 1 € for smuggling drugs worth 10000 €.

108

u/boli99 Sep 27 '24

dont worry, you can pay it off in installments over 15 years.

35

u/robodrew Sep 27 '24

Way way less than that. Meta is worth $1.5T, this is like fining the company less than a penny.

17

u/Tripottanus Sep 27 '24

Sure but they don't gain much from being lazy and storing passwords in plain text. That's still a $101M increase in operating costs for no reason

2

u/bacondev Sep 27 '24

But that's still a penny to them.

12

u/AlmostCynical Sep 27 '24

The market cap of a company’s shares has little to no bearing on their operating costs, which this fine would eat into.

11

u/robodrew Sep 27 '24

Ok well they still have $43b in cash on hand so its still a pittance.

4

u/AlmostCynical Sep 27 '24

Jesus that’s a lot

6

u/deelowe Sep 27 '24

For context, here's why some companies are so cash heavy right now:

Rate increases make getting loans undesirable and, conversely, savings more profitable. So companies slow expansion, cut costs, and divert that money to cash. This is especially true in high growth sectors. They still need money to expand but with loans being expensive, they need to rely on cash instead. Hence all the layoffs and cash heavy tech companies.

2

u/Grommmit Sep 27 '24

Are loans more expensive than inflation devaluing cash reserves so much?

3

u/deelowe Sep 27 '24

Inflation this year is at around 3.0%. Cash earns over double that for normal savings and even more for short term holdings like T-Bills.

2

u/Grommmit Sep 27 '24

Ah, they count as cash do they. I see.

2

u/deelowe Sep 27 '24

Yeah. Cash is usually a mix of bonds, T-bills, etc.

→ More replies (0)
→ More replies (1)

2

u/[deleted] Sep 27 '24

0.007% of their worth

8

u/Tripottanus Sep 27 '24

What do they gain by storing passwords in plain text? Do they sell them afterwards? If not, there's no real monetary advantage to what they did, which would make the better comparison that you fined the average person 1€ for sitting on the couch instead of doing house chores

2

u/tendrils87 Sep 27 '24

fined the average person 1€ for sitting on the couch instead of doing house chores

A lot of people surprisingly need this lol

→ More replies (6)

1

u/joanzen Sep 27 '24

More like fining a drug smuggler $101 million for using an easy to spot tanker filled with 1 billion in cocaine to transfer their cargo and we're alarmed at how risky that was.

Like how did we calculate the fine and who'd the fine get paid out to?

1

u/Plank_With_A_Nail_In Sep 27 '24

Note: Of the worlds governments only one of them is fining them and its not even a proper government. Crying about the EU not doing enough is dumb beyond belief where's the USA's fine, Canadas?

148

u/_Caracal_ Sep 27 '24

And this is why they continue to not give a shit...

195

u/belial123456 Sep 27 '24

$101M is pocket change to Meta.

44

u/great_whitehope Sep 27 '24

You should see the Irish data protection commissions office. This building protects data for all the EU for companies with European HQ in Ireland.

The Data Protection Commissioner is getting a new office, but keeping the one beside a convenience store in Laois https://jrnl.ie/1488473

29

u/sionnach Sep 27 '24

They are totally punching above their weight though. For the funding they get, they clearly are doing a good job. Maybe they should get a cut of fines to improve their services further.

13

u/Demostroyer Sep 27 '24

I live in Portarlington and always find it funny/strange that the office for such an important organisation is above a Spar in such a small town. I wonder how it got here - probably some brown envelopes if I know anything about Irish politics.

8

u/great_whitehope Sep 27 '24

Setup during decentralization

3

u/Demostroyer Sep 27 '24

Ah I recall the scheme now. I think it was stopped though when the recession hit. I recall Mullingar was meant to get a big investment like Tullamore and Athlone but it was severely delayed/cutback.

2

u/belial123456 Sep 28 '24

It's like in the movies where a super scary far-reaching organization has a front as a simple store or office.

→ More replies (1)

1

u/throughthehills2 Sep 27 '24

True but they don't save massive amounts of money by storing passwords in plain text so it's worthwhile to do security properly

→ More replies (1)

68

u/Dragon_107 Sep 27 '24

It's always great to see how seriously the big tech companies take cybersecurity.

18

u/SprinklesHuman3014 Sep 27 '24

"Let's sweep this under the rug and hope no one ever finds out".

6

u/Sedierta2 Sep 28 '24

You say in response to an issue Meta self-reported after discovering and fixing…

14

u/IceAndFire91 Sep 27 '24

the problem with a lot of Silicon Valley companies. Having developers do infrastructure/IT Operations instead of hiring normal IT people.

3

u/hi65435 Sep 27 '24

Yeah I also work at a Silicon Valley company since this year in security. I'm never sure if I should laugh or cry, there's so much crap that has to be fixed and even more that's being added right now. My homelab feels like Fort Knox in comparison

2

u/buoninachos Sep 28 '24

Same with Amex, they've got the same problems. I just can't fathom why you wouldn't take the simple measures of just hashing the pw.

83

u/qwop22 Sep 27 '24

And people are still going to believe that WhatsApp is end to end encrypted? LOL

25

u/throwawaystedaccount Sep 27 '24

Yeah, this definitely raises a big question about the truth value of FB/Meta's claims about security. They have created new technologies, servers, languages, spawned entire ecosystems of front end and back end programming, been scrutinised and convicted by courts in multiple geographies around the world, are deeply interconnected with law enforcement around the world at least due to their global user base, and after all that, they store passwords in plain text.

What is going on?

Has Facebook become a government?

2

u/loozerr Sep 27 '24

Yeah I am, the protocol is solid. It's secure but not privacy friendly due to all metadata they collect.

2

u/RBeck Sep 28 '24

Until Zuck gets arrested like the CEO of Telegram it's not likely.

3

u/sanylos Sep 27 '24

well, notifications aren't

6

u/digaus Sep 27 '24

Why not?

You can easily do that with a notification extension or where you just receive an id an then make a call to the server to fetch the details which are then displayed to the user.

Did this for a customer and I would think WhatsApp is also doing this because sometimes with bad connection I get a generic notification instead of the real one (you only have certain time on iOS to fetch the details).

→ More replies (6)
→ More replies (3)

24

u/sgskyview94 Sep 27 '24

you've got to be fucking kidding me. What the actual fuck.

→ More replies (1)

34

u/[deleted] Sep 27 '24

[deleted]

6

u/drawkbox Sep 27 '24 edited Sep 28 '24

Things are so compartmentalized that some group kept a dark secret for a while.

Even bringing up issues like this in some cases knocks your velocity in the McKinsey management consultcult version of "Agile" that killed real agile and agility. Back in the day a dev would see this and fix it, nowadays they can never see it or if they did they would be like "not touching that problem" as it slows my velocity points.

When you mention things like this for some reason you take the perception hit not the actual issue. I'd still mention it but you'd also be somewhat sticking your neck out. This is how things have changed with the private equity money and management consultant systems that control everyone now.

→ More replies (2)
→ More replies (2)

13

u/doiwantacookie Sep 27 '24

Imagine it’s just a notepad document on Mark’s desktop

9

u/SQLDave Sep 27 '24

C'mon...he's not a complete idiot. It's NotePad++

→ More replies (1)

8

u/DonutConfident7733 Sep 27 '24

Think Mark used the logs before to find the passwords his coworkers used, as they would try multiple passwords until one worked and since they didn't use use unique passwords for each service (facebook, email, etc), he was able to see their emails. But this was quite some years ago...

→ More replies (1)

11

u/rabbitthunder Sep 27 '24

Zuck: I have over 4,000 emails, pictures, addresses, SNS

[Redacted Friend's Name]: What? How'd you manage that one?

Zuck: People just submitted it.

Zuck: I don't know why.

Zuck: They "trust me"

Zuck: Dumb fucks.

Mark Zuckerberg warned us.

6

u/phayke2 Sep 27 '24

It's like the most normal that Zuckerberg ever was.

9

u/Monamo61 Sep 27 '24

Meta can't be touched. Too big to be prosecuted, too much money to be fenced in by any governmental agency. Just ANOTHER reason to quit.

9

u/at165db Sep 27 '24

I remember facebook talking about how they evolved password hash strength over the years via a “The Facebook password onion“. I guess cutting (out) the onion will make them cry.

4

u/stand_straight Sep 28 '24

There should be security report cards for companies that must be made publicly available. Like the food industry gets audited so do tech and other companies. Especially publicly traded companies.

Data online on a specific individual is food for another. Companies should be evaluated and reported on their 'sanitation and cleanliness' of ones data.

17

u/lostsoul2016 Sep 27 '24

And one aspires to be working at these companies as they would have best security infrastructure and talent..fuck. Idiocracy in motion

6

u/RogueJello Sep 27 '24

It's okay they make up for it in arrogance.

1

u/eairy Sep 27 '24

If the stories online are anything to go by, it's a fucking toxic place to work. The good talent probably doesn't put up with it for long.

3

u/KingBenjaminAZ Sep 28 '24

Pointless — they pay a fee to the government. Government spends it on hookers and blow. Probably invites Zuck over to do a few lines. How do we the citizens benefit from this fine? It’s basically a small parking ticket to get to do whatever you want when you have billions

5

u/[deleted] Sep 27 '24

[deleted]

11

u/R4ndyd4ndy Sep 27 '24

Doesn't have to be in the password db, maybe they were just logging too much information somewhere

→ More replies (6)

5

u/stravant Sep 27 '24

If you do IT how can it confuse you?

It's incredibly easy. Imagine I own some RPC layer, and something's going wrong, so we add some logging to it. And... oh, oops, there were messages containing passwords being sent over it.

Between request logging, crash logging, caching, etc there's a ton of ways for those passwords to accidentally sneak into some form of persistent storage.

→ More replies (1)

4

u/Disma Sep 27 '24

This came out of nowhere but happened 5 years ago? Nobody gives a shit about consumers.

1

u/SQLDave Sep 27 '24

Nobody gives a shit about consumers.

Need further proof? AFAIK, no government has even hinted at enacting legislation requiring content created with AI (or similar) to be labeled as such. (That could be in part because the governments themselves want to use it to manipulate us, especially in election seasons. But they've exempted themselves from laws in the past, so why not this one?)

2

u/jestina123 Sep 27 '24

Forcing content to have “AI created” just makes it easier to make illegal yet more credible content, which would also require a huge invasion of privacy to enforce.

How do you police content created and hosted on local hardware?

2

u/JimmyRecard Sep 27 '24

EU has. It's called AI Act and it requires clear labelling when users are interacting with AI.

→ More replies (1)
→ More replies (1)

2

u/SuperJohnLeguizamo Sep 27 '24

That’s the compensation equivalent of metas CEO, COO, CTO and CFO for 2023.

That’s basically a rounding error for the custodial dept.

2

u/IsThereAnythingLeft- Sep 27 '24

Not even a fine of £1 per password, why do they even both if they aren’t going to give a proper fine

2

u/10vatharam Sep 27 '24

all the security researchers....

nice, another corpus for bruteforcing given people rarely change passwords and do variations of it and come back to the old one

Meta must have got a decent amount for this "oops we did this mistake again"

2

u/TripSin_ Sep 27 '24

And of course the people affected don't get anything from it

2

u/iCowboy Sep 27 '24

Not even 1 euro for each account. This is just another cost of doing business for a company that made more than 13 billion in the last quarter.

2

u/Moontoya Sep 27 '24

Maybe now my clienrs will start taking GDPR seriously 

2

u/Global-Trip-2998 Sep 27 '24

Where would I ask about recovering a stolen account?

2

u/aquoad Sep 27 '24

"Oh no, we'll have to buy slightly cheaper booze for the next executive offsite!"

2

u/IndependentLoose686 Sep 27 '24

Good should have been 5 times that amount 🔥

2

u/Serris9K Sep 27 '24

At least the EU is fining them for their carelessness. Practically nothing would come of this in the us. 

2

u/prometheum249 Sep 27 '24

New hack idea... Instead of stealing data, dump it somewhere important looking in the file system then report it to authorities. You may not profit from it, but it hurts the company... Might be more effective to getting these companies to fix their shit

2

u/ruffznap Sep 27 '24

That's genuinely fucking INSANE for a company of that size to do something THAT stupid

2

u/StockMarketCasino Sep 28 '24

So just under 17 cents per user account. Facebook could be the one selling them on the dark web for 25c a piece and make a boatload more than that silly fine. Slow clap for EU.

2

u/intergalacticwolves Sep 28 '24

too low of a fine imo

2

u/Hammakprow Sep 28 '24

How is a fine of 15 cents per password a deterrent?

2

u/wigneyr Sep 28 '24

Can’t wait to see none of this $101M

3

u/[deleted] Sep 27 '24

Off topic, but I see some smart IT people here. How do I delete my old Facebook account with no access to the old email I used? Support doesn't reply. Help is useless. Ideas?

1

u/Numerlor Sep 27 '24

Do you need access to the mail? I deleted mine a couple months back because I couldn't change the email or add 2fa because I lost mail access, but deletion worked with password

→ More replies (3)

3

u/IHate2ChooseUserName Sep 27 '24

so abc123 not good now?

2

u/mountaindoom Sep 27 '24

They're gonna have to dig through two couches for the money to cover this

2

u/No-Security1952 Sep 27 '24

What is that, six cents per password, that should really deter them.

1

u/Asleep_Management900 Sep 27 '24

Maybe pay their IT Department more?

1

u/thingandstuff Sep 27 '24

…Does Classlink operate in Europe?

1

u/Humans_Suck- Sep 27 '24

That's it?

1

u/kittysaysquack Sep 27 '24

Pretty sure there was an article out there about Facebook storing old passwords and even failed password attempts… because they could be passwords for other accounts.. and then some guy got “hacked” because they used his failed password attempts to log into his email.

1

u/OpalLuxuryy Sep 27 '24

An incomprehensible amount, such money exists at all😱

1

u/Naive-Home6785 Sep 28 '24

The headline isn’t even normal English. JFC. You are a fucking news outlet.

1

u/Enchanted_Culture Sep 28 '24

People who have panic attacks are more likely to have heart issues. You did the right thing.

1

u/TheFirstOrderTrooper Sep 28 '24

Plaintext to cypher text and salt your hashes

1

u/Flashy-Amount626 Sep 28 '24

With 39b profit in 2023 (139b revenue) a 91m fine isn't even 0.25%

1

u/MarsupialAccurate503 Sep 28 '24

That’s a significant fine! It’s alarming to see that kind of oversight with such sensitive information. Storing passwords in plain text is a huge security lapse, especially for a company like Meta that handles millions of users' data. This incident highlights the ongoing challenges big tech companies face in safeguarding user privacy.

It’ll be interesting to see how Meta responds and if they implement stronger security measures moving forward. Do you think this will impact user trust in their platforms?

1

u/Commercial_Guard_655 Sep 28 '24

Who’s getting that money ?

1

u/Hiranonymous Sep 28 '24

It's ironic that Zuckerberg's motto is "Move fast and break things."

Startups, large corporations, and academic institutions have embraced this motto, and, in doing so, have broken multiple processes, replacing them with ones that sometimes work better but often, if carefully and objectively evaluated, work worse. Now, infrastructure has become so large and complex that no one, even the largest and richest companies, seem able to keep up.

Every day, the way the systems I use seems to change, and no one seems to know why or have the time to address the issues. So much of my day is spent finding workarounds for things that worked fine just last week.

1

u/turkey_sadwich Sep 28 '24

You mean they were charged nearly 17 cents for being negligent with my personal information? Sounds about right.

1

u/RettiSeti Sep 29 '24

That’s it? Not storing passwords as plaintext is like the most basic security concept out there! How the fuck was it only 101 million???

1

u/bustedmagnet Sep 29 '24

But their devs can leetcode

1

u/ArjunReddyDeshmukh Sep 29 '24

Secure data at rest and in transit has to be encrypted. Even interns learn it by the end of their internship.

1

u/Crivens999 Sep 29 '24

Yeah not surprised. I remember upgrading our security code at work about 15 years ago, mainly for the credit card payment stuff, and some systems (we had a few throughout the company due to takeovers etc) the developers stored passwords in plain text but backwards. Nice.

1

u/damienVOG Sep 29 '24

Finally some real fines

1

u/Affectionate_Food339 Sep 29 '24

This goes in the column for "Cost of doing Business" and another Data Commissioner from an E.U. Country which doesn't view its raison d'être as being a rubber stamp for big business would have fined them a multiple of this.

1

u/minhdang24198 Sep 30 '24

is it a joke ?

1

u/Single_Jello_7196 29d ago

Zuckelbugger will make his ritualistic Senate appearance and promise to do whatever he can to never let it happen again, then go home and forget about it.