Keyboard shortcuts are available for common actions and site navigation.
You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more
Breaking: Facebook stored hundreds of millions of user passwords in plain text. No evidence of abuse but "as a precaution we will be notifying everyone whose passwords we have found were stored in this way."https://motherboard.vice.com/en_us/article/qvy9k7/facebook-hundreds-of-millions-user-passwords-plaintext-data-leak …
This comes after Twitter and Github made similar mistakes, leaving passwords that were supposed to be hashed elsewhere in plain text. Now Facebook confirms it did much the samehttps://motherboard.vice.com/en_us/article/qvy9k7/facebook-hundreds-of-millions-user-passwords-plaintext-data-leak …
Updated with comment from a former technical Facebook employee https://motherboard.vice.com/en_us/article/qvy9k7/facebook-hundreds-of-millions-user-passwords-plaintext-data-leak …pic.twitter.com/WAOxuTY5fH
Updated with comment from a current technical Facebook employeehttps://twitter.com/josephfcox/status/1108791817359818755 …
Updated with comment from another former Facebook employee "Would have been scandalous even internally"https://motherboard.vice.com/en_us/article/qvy9k7/facebook-hundreds-of-millions-user-passwords-plaintext-data-leak …
"Breaking"? Where people thinking that Mark Zuckerberg knew how to properly salt and hash passwords back when he was not going to class at Harvard?
They were stored fine with salted scrypt hashes Unfortunately they were logged in plain text too
This is why you don't drop out of Harvard
@iamdevloper @nixcraft this looks pretty much fucked up to me
i’d say “fucking unbelievable” but nah, i totally believe them to be this cavalier and inept at the absolute basic, 101 rules of how to store passwords that any 14 year old with a passing interest in dev could tell you
If you still use Facebook you deserve all of it.
This is why we use this DB to check user's password changes: https://haveibeenpwned.com/
Surely this Cannot be an issue if the primary key is encrypted for the passwords. Correct me if im wrong but the volume of passwords would eliminate any risk of brute force?
They are talking about the password getting put into a log file as plaintext and that file is not encrypted. Why they were logging passwords is beyond me though.. the password should have been hashed then discarded before any DB tried to log it
Big oopsie
By coincidence they were only the passwords of conservative users
Complete amateurs at FB
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
+44 20 8133 5190. Wickr 
josephcox. XMPP 
jfcox@jabber.ccc.de 
joseph.cox@vice.com
