3 ms·

The breach definitely sounds illegal, but why the hell were they storing unencrypted passwords in the first place? When I first learned about databases, that i

The breach definitely sounds illegal, but why the hell were they storing unencrypted passwords in the first place? When I first learned about databases, that is the very first thing I learned never to do.

qeorge 17y ago
To be fair, its not that simple of a problem. At the time, Facebook Connect didn't exist, Twitter didn't use OAuth, and I don't know what MySpace was doing. So if you wanted to give a 3rd party app access to your account, they had to store your password. Sure, they should have used some kind of 2 way cipher on it, but how much safer than plain text is that anyway? Of course, once Facebook et all started using OAuth-like protocols they should have dropped the passwords. There's a lot of shame here for sure, but its not quite as amateur of a mistake as it sounds on first blush.
- idlewords 17y ago
  The post explains that no passwords to outside services were implicated in the breach. So this is just as amateur a mistake as it sounds - storing their own passwords in plaintext for no reason at all.
  - qeorge 17y ago
    Not true. This press release may say that, but earlier accounts disagree: "This matter now appears worse than originally suspected as the dataset also contains a table where RockYou have stored user credentials for social networks and other partner sites." http://www.techcrunch.com/2009/12/14/rockyou-hack-security-myspace-facebook-passwords/ http://www.techcrunch.com/2009/12/14/rockyou-hack-security-m... Also, consider RockYou's initial statement, in which they would only say that no Facebook accounts were compromised: "RockYou confirms that no application accounts on Facebook were impacted by this hack and that most of the accounts affected were for earlier applications (including slideshow, glitter text, fun notes) that are no longer formally supported by the company." But you're right about them storing the internal passwords in clear text, which I did not know. That is absurdly dumb.

qeorge 17y ago

To be fair, its not that simple of a problem. At the time, Facebook Connect didn't exist, Twitter didn't use OAuth, and I don't know what MySpace was doing. So if you wanted to give a 3rd party app access to your account, they had to store your password. Sure, they should have used some kind of 2 way cipher on it, but how much safer than plain text is that anyway? Of course, once Facebook et all started using OAuth-like protocols they should have dropped the passwords. There's a lot of shame here for sure, but its not quite as amateur of a mistake as it sounds on first blush.

idlewords 17y ago
The post explains that no passwords to outside services were implicated in the breach. So this is just as amateur a mistake as it sounds - storing their own passwords in plaintext for no reason at all.
- qeorge 17y ago
  Not true. This press release may say that, but earlier accounts disagree: "This matter now appears worse than originally suspected as the dataset also contains a table where RockYou have stored user credentials for social networks and other partner sites." http://www.techcrunch.com/2009/12/14/rockyou-hack-security-myspace-facebook-passwords/ http://www.techcrunch.com/2009/12/14/rockyou-hack-security-m... Also, consider RockYou's initial statement, in which they would only say that no Facebook accounts were compromised: "RockYou confirms that no application accounts on Facebook were impacted by this hack and that most of the accounts affected were for earlier applications (including slideshow, glitter text, fun notes) that are no longer formally supported by the company." But you're right about them storing the internal passwords in clear text, which I did not know. That is absurdly dumb.