[et_pb_section fb_built=”1″ fullwidth=”on” _builder_version=”3.21.1″ background_image=”https://www.mdsny.com/wp-content/uploads/2019/03/https_specials-images_forbesimg_com_dam_imageserve-2.jpg” background_position=”bottom_center” background_blend=”darken” custom_padding=”0px|0px|0px|0px”][et_pb_fullwidth_header title=”What we can learn from Facebook’s password management” text_orientation=”center” background_overlay_color=”rgba(0,0,0,0.42)” title_font_color=”#ffffff” _builder_version=”3.21.1″ title_font=”||||||||” title_text_color=”#ffffff” title_font_size=”37px” subhead_font=”||||||||” subhead_text_color=”#ffffff” subhead_font_size=”19px” background_color=”rgba(255, 255, 255, 0)” background_layout=”light” button_one_text_size__hover_enabled=”off” button_two_text_size__hover_enabled=”off” button_one_text_color__hover_enabled=”off” button_two_text_color__hover_enabled=”off” button_one_border_width__hover_enabled=”off” button_two_border_width__hover_enabled=”off” button_one_border_color__hover_enabled=”off” button_two_border_color__hover_enabled=”off” button_one_border_radius__hover_enabled=”off” button_two_border_radius__hover_enabled=”off” button_one_letter_spacing__hover_enabled=”off” button_two_letter_spacing__hover_enabled=”off” button_one_bg_color__hover_enabled=”off” button_two_bg_color__hover_enabled=”off”][/et_pb_fullwidth_header][/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”3.0.65″ custom_padding=”12px|0px|0px|0px”][et_pb_row make_fullwidth=”on” custom_padding=”27px|1px|0px|2px” _builder_version=”3.21.1″][et_pb_column type=”4_4″ _builder_version=”3.0.47″][et_pb_text _builder_version=”3.21.1″ text_font=”||||||||” text_text_color=”#000000″ text_font_size=”15px” header_font=”||||||||” custom_margin=”-20px||”]
By Mike Fiorito, VP of Business Development at MDS
Recently, Facebook acknowledged a bug in its password management systems. This internal bug caused hundreds of millions of Facebook and Instagram user passwords to be stored as plaintext. As a result, thousands of Facebook employees could have searched for and found them. Krebs reports that the passwords stretched back to those created in 2012.
Organizations can store account passwords securely by scrambling them with password-hashing before saving them to their servers. This way, even if someone compromises those passwords, they won’t be able to read them, and a computer would find it difficult—even functionally impossible—to unscramble them. As a prominent company with billions of users, Facebook invests heavily to avoid the liability and embarrassment of security mishaps. Unfortunately, one open window negates all the padlocks, bolts, and booby traps money can buy. Anything short of everything is never enough.
“As part of a routine security review in January, we found that some user passwords were being stored in a readable format within our internal data storage systems,” said Pedro Canahuati, Facebook’s vice president of engineering, security, and privacy. “Our login systems are designed to mask passwords using techniques that make them unreadable. To be clear, these passwords were never visible to anyone outside of Facebook and we have found no evidence to date that anyone internally abused or improperly accessed them.”
Canahuati said that Facebook has now corrected the password logging bug and that the company will notify hundreds of millions of Facebook Lite users, tens of millions of Facebook users, and tens of thousands of Instagram users that their passwords may have been exposed. Facebook does not plan to reset those users’ passwords.
Facebook said that the exposed passwords weren’t all stored in one place, and that the issue didn’t result from a single bug in the platform’s password management system. Instead, the company had unintentionally and incidentally captured plaintext passwords across a variety of internal mechanisms and storage systems, like crash logs. Facebook says that the scattered nature of the problem made it more complicated both to understand and to fix, which the company says explains the nearly two months it took to complete the investigation and disclose the findings.
Why did Facebook retain logs that included sensitive data for so long, and why was the company unaware of its contents?
This breach makes clear that performing audits and analyzing the storage of private user data is paramount. Along with a host of other resources and techniques, MDS uses tools like Compliance Manager to perform on-going risk assessments to meet GDPR, NIHST and HIPPA compliance.
“The data that’s captured incidentally as part of debugging and operating at the network scales they do is not uncommon,” says Kenn White, a security engineer and director of the Open Crypto Audit Project. “But if Facebook retains that for years it raises a lot of questions about their architecture. They have an obligation to protect these debug logs and audit and understand what they’re retaining. In some ways that’s the most sensitive data they hold, because it’s raw and unmanaged.” Any company, but especially a company like Facebook, which stores an enormous amount of private user data, must maintain a vigilant Cybersecurity program.
Facebook says its investigation hasn’t revealed any signs that anyone intentionally accessed its hundreds of millions of errant passwords to steal them. But whether you get a password notification from Facebook or not, you might as well go ahead and change it as a precaution.
To do so on Facebook desktop, go to Settings → Security and Login → Change Password. On Facebook for iOS and Android, go to Settings & Privacy → Settings → Security and Login → Change Password. On Facebook Lite for Android, go to Settings → Security and Login → Change Password. Changing your account password on either main Facebook or Facebook Lite changes it for both.
On Instagram, go to Settings → Privacy and Security → Password to change your password. Instagram and Facebook do not use the same password but can be linked to log into one with the other.
Are you concerned about your data privacy and data storage within your organization? Contact an MDS expert today for a 1:1 consolation.
[/et_pb_text][et_pb_image _builder_version=”3.0.74″ animation_style=”slide” animation_direction=”left” animation_duration=”500ms” animation_intensity_slide=”10%”][/et_pb_image][/et_pb_column][/et_pb_row][/et_pb_section][et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”3.0.74″ background_color=”#bcbcbc” custom_padding=”14px|0px|9px|0px”][et_pb_row make_fullwidth=”on” admin_label=”row” _builder_version=”3.0.65″ background_color=”#bcbcbc” background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.0.47″][et_pb_cta title=”Take Back Your Day” button_url=”https://www.mdsny.com/contact” button_text=”Contact Us” _builder_version=”3.16″ header_font=”Droid Sans|on|||” header_text_color=”#141414″ header_font_size=”31px” body_font=”Droid Sans||||” body_text_color=”#000000″ body_font_size=”19px” use_background_color=”off” background_size=”initial” background_position=”top_left” background_repeat=”repeat” custom_button=”on” button_text_color=”#000000″ background_layout=”light” button_bg_color_hover=”#008a93″ button_text_size__hover_enabled=”off” button_one_text_size__hover_enabled=”off” button_two_text_size__hover_enabled=”off” button_text_color__hover_enabled=”off” button_one_text_color__hover_enabled=”off” button_two_text_color__hover_enabled=”off” button_border_width__hover_enabled=”off” button_one_border_width__hover_enabled=”off” button_two_border_width__hover_enabled=”off” button_border_color__hover_enabled=”off” button_one_border_color__hover_enabled=”off” button_two_border_color__hover_enabled=”off” button_border_radius__hover_enabled=”off” button_one_border_radius__hover_enabled=”off” button_two_border_radius__hover_enabled=”off” button_letter_spacing__hover_enabled=”off” button_one_letter_spacing__hover_enabled=”off” button_two_letter_spacing__hover_enabled=”off” button_bg_color__hover_enabled=”on” button_bg_color__hover=”#008a93″ button_one_bg_color__hover_enabled=”off” button_two_bg_color__hover_enabled=”off”]
Learn how the latest technologies can free up your time so you can focus on your business
[/et_pb_cta][/et_pb_column][/et_pb_row][/et_pb_section]