Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years

Re:Facebook Stored Hundreds of Millions of User Passwords in... by polote on Thursday March 21, 2019 @11:44AM (#19453677)

so yeah, dev have access to the password of your account, but really they dont need it, they probably have access to the hash in the database and login anyway. So really NO harm have been done

[ Parent | on HN ]

Re:Facebook Stored Hundreds of Millions of User Passwords in... by EnFinlay on Thursday March 21, 2019 @11:50AM (#19453766)

Having (read) access to the hash shouldn't give any access to the account.

Edit: You've made this comment twice in these threads. It's wrong.

[ Parent | on HN ]

Re:Facebook Stored Hundreds of Millions of User Passwords in... by polote on Thursday March 21, 2019 @02:22PM (#19455610)

Yeah I was wrong, it is only true if the dev has access to the prod database

[ Parent | on HN ]

Re:Facebook Stored Hundreds of Millions of User Passwords in... by p_rude on Thursday March 21, 2019 @11:48AM (#19453729)

It is neither a standard practice nor a best practice to give your devs access to your production auth databases.

[ Parent | on HN ]

Re:Facebook Stored Hundreds of Millions of User Passwords in... by icedchai on Thursday March 21, 2019 @11:59AM (#19453869)

Perhaps not in more mature organizations, but it's standard practice at every startup I've ever worked for. One place had the dev office VPN'd into production at all times.

[ Parent | on HN ]

Re:Facebook Stored Hundreds of Millions of User Passwords in... by glenneroo on Thursday March 21, 2019 @12:38PM (#19454322)

Did any of those startups have 200-600 million users?

[ Parent | on HN ]

Re:Facebook Stored Hundreds of Millions of User Passwords in... by icedchai on Thursday March 21, 2019 @01:41PM (#19455114)

No, these were small organizations. I'm just saying it's not uncommon. Sadly, some places don't even have a dev environment...

[ Parent | on HN ]