News for hackers. Stuff that matters.

A comment on Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years. Parent comment

Re:Facebook Stored Hundreds of Millions of User Passwords in... by IshKebab on Thursday March 21, 2019 @12:15PM (#19454030)
No you're misrepresenting what (probably) happened. They had some system that logged API requests (fine and normal). Some API requests include plaintext passwords (also fine and normal).

The issue is presumably that they had no exclusion to the logging for sensitive information like passwords, which is honestly very easy to overlook.

So two thousand Facebook employees were not "retrieving passwords". They were looking at the API logs, which is a normal thing to do.

[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by planb on Friday March 22, 2019 @04:24AM (#19460473)
This. It's a bit baffling to me that even the HN audience doesn't come to this conclusion immediately - maybe people want to assume the worst because it's Facebook?
[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by IshKebab on Friday March 22, 2019 @04:32AM (#19460511)
Definitely. This always happens when Facebook comes up here. People forget to use their brains and just rant about how evil Facebook is.
[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by C4stor on Friday March 22, 2019 @06:40AM (#19461176)
> Some API requests include plaintext passwords (also fine and normal)

Wait, no ? How is that fine and normal ? It doesn't seem fine and normal all.

[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by yogaboll on Friday March 22, 2019 @11:52AM (#19463727)
It's completely standard. If you encrypt the password in the browser, potential hackers have access to the encryption code which makes it useless.

Check the network tab in dev-tools when logging in to hn for example and you'll see your password in the request body :)

[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by mesozoic on Friday March 22, 2019 @07:42PM (#19467995)
Maybe normal but still not best practice
[ Parent | on HN ]