> Sounds a lot like some service was logging the full body of a signup/login request, which then was readable for anyone with access to the logging/tracing infr

> Sounds a lot like some service was logging the full body of a signup/login request, which then was readable for anyone with access to the logging/tracing infrastructure. Wouldn't that also include failed login attempts complete with the failed passwords? I mention this due to FB's history of even logging the entered passwords of failed attempts, which Zuck supposedly used to hack into people's Email accounts [0]. Because if that also applies here, then a whole lot of people just had way more leaked than just their FB password. [0] https://www.businessinsider.com/henry-blodget-okay-but-youve-got-to-admit-the-way-mark-zuckerberg-hacked-into-those-email-accounts-was-pretty-darn-cool-2010-3?IR=T https://www.businessinsider.com/henry-blodget-okay-but-youve...