News for hackers. Stuff that matters.

A comment on FTC Imposes $5B Penalty and Sweeping New Privacy Restrictions on Facebook. Parent comment

Re:FTC Imposes $5B Penalty and Sweeping New Privacy Restrict... by nybble41 on Wednesday July 24, 2019 @10:58AM (#20515901)
>Facebook must encrypt user passwords and regularly scan to detect whether any passwords are stored in plaintext; and

Why are they storing passwords at all? It's not necessary for authentication. They should only be storing a hash, or better yet a public key derived from the password on the client.

[ Parent | on HN ]
Re:FTC Imposes $5B Penalty and Sweeping New Privacy Restrict... by constGard on Wednesday July 24, 2019 @11:47AM (#20516405)
It came to light that they were storing passwords in plaintext in an application log. In theory they only store hashes in places where they actually intend to store passwords.
[ Parent | on HN ]
Re:FTC Imposes $5B Penalty and Sweeping New Privacy Restrict... by civicsquid on Wednesday July 24, 2019 @11:22AM (#20516136)
I think this refers to previous stories where there were reports of passwords being logged as part of what I assume was request parameter logging.
[ Parent | on HN ]