Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years

Re:Facebook Stored Hundreds of Millions of User Passwords in... by munk-a on Thursday March 21, 2019 @12:16PM (#19454046)

I think they are indeed the same outcome but I'd count plain-text DB passwords as grossly negligent while as this was merely negligent. Clearly both are terrible and deserve a shaming, but not hashing passwords going into a DB is a decision that someone pretty much necessarily had to have the full scope of and made a bad decision on. This logging issue could potentially be attributed to a mistake in team communication (i.e. the people we hired to auto-log requests didn't realize that `/login` should be blacklisted for logging and for some reason we never explicitly told them to do so).

So I agree that these actions are indeed same but different.

They ultimately speak to a failure at Facebook, but it doesn't speak to utter incompetence at Facebook.

[ Parent | on HN ]

Re:Facebook Stored Hundreds of Millions of User Passwords in... by cflewis on Thursday March 21, 2019 @12:25PM (#19454165)

Yeah, there's so many ways this could happen. The one that came to mind for me was an engineer who thought passwords were being filtered by the time it got to their part of the stack, but somehow didn't notice they weren't because the payload was minified or because they tested in a test environment where they knew there wasn't the filtering but didn't look at prod (where there was also not the filtering).

So many ways this could have gone down, so easy to do.

[ Parent | on HN ]