They've been pretty open about how they store passwords and it's definitely not plaintext, here's a talk about it: https://video.adm.ntnu.no/pres/54b660049af94

They've been pretty open about how they store passwords and it's definitely not plaintext, here's a talk about it: https://video.adm.ntnu.no/pres/54b660049af94 https://video.adm.ntnu.no/pres/54b660049af94 My outside impression is that security is taken seriously enough at Facebook to hire highly competent people to run it. They pay out bug bounties, and run internal red team exercises to test their own ability to detect and react to a compromise. https://threatpost.com/how-facebook-prepared-be-hacked-030813/77602/ https://threatpost.com/how-facebook-prepared-be-hacked-03081... I think we can extend them enough benefit of doubt to rule out storing user passwords in plaintext.