Facebook Left Hundreds of Millions of Passwords Exposed to Its Employees

Security data from several of the company’s products may have been stored as plain text.

Ting Shen/Xinhua via ZUMA

For indispensable reporting on the coronavirus crisis, the election, and more, subscribe to the Mother Jones Daily newsletter.

Facebook stored hundreds of millions of its users’ passwords in a “readable format” according to the company, leaving them exposed to employees with access to the internal files.

The company disclosed the incident in a post on its public relations portal. Facebook’s description of plans to notify affected users suggest the scale of the security breach, which included “hundreds of millions of Facebook Lite users,” referring to a stripped down version of its app offered in countries with less broadband access, as well as “tens of millions of other Facebook users, and tens of thousands of Instagram users.”

Facebook explained that it usually masks passwords to prevent employees from being able to access them internally. “In security terms, we ‘hash’ and ‘salt” the passwords, including using a function called ‘scrypt’ as well as a cryptographic key that lets us irreversibly replace your actual password with a random set of characters,” the company detailed in its post. “With this technique, we can validate that a person is logging in with the correct password without actually having to store the password in plain text.”

While the company did not explicitly admit to keeping the files in plain text, Brian Krebs of Krebs on Security, who broke the news of the exposed passwords, reported the files had been exposed in easily readable, plain text, inside a searchable database to which thousands of its employees had access.

Facebook claims it has not yet found any examples of the password database being abused by its employees, or evidence that passwords had been obtained by anyone outside the company. In its post, the company advised users against using the same password on different services, while suggesting users may want to change Facebook and Instagram passwords.

The security gaffe comes days after Facebook CEO Mark Zuckerberg announced a new pivot to privacy at the company, laying out a 3,000 word plan for a new “privacy-focused vision.”

DEMOCRACY DOES NOT EXIST...

without free and fair elections, a vigorous free press, and engaged citizens to reclaim power from those who abuse it.

In this election year unlike any other—against a backdrop of a pandemic, an economic crisis, racial reckoning, and so much daily crazy—Mother Jones' journalism is driven by one simple question: Will America will move closer to, or further from, justice and equity in the years to come?

If you're able to, please join us in this mission with a donation today. Our reporting right now is focused on voting rights and election security, corruption, disinformation, racial and gender equity, and the climate crisis. We can’t do it without the support of readers like you, and we need to give it everything we've got between now and November. Thank you.

DEMOCRACY DOES NOT EXIST...

without free and fair elections, a vigorous free press, and engaged citizens to reclaim power from those who abuse it.

In this election year unlike any other—against a backdrop of a pandemic, an economic crisis, racial reckoning, and so much daily crazy—Mother Jones' journalism is driven by one simple question: Will America will move closer to, or further from, justice and equity in the years to come?

If you're able to, please join us in this mission with a donation today. Our reporting right now is focused on voting rights and election security, corruption, disinformation, racial and gender equity, and the climate crisis. We can’t do it without the support of readers like you, and we need to give it everything we've got between now and November. Thank you.

We Recommend

Latest

Sign up for our newsletters

Subscribe and we'll send Mother Jones straight to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.

Subscribe

Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.

Donate