3 ms·

Facebook's own announcement is titled "Keeping Passwords Secure"[0] Facebook comms: You can't really use the word "keep" when the entire post is about how you

Facebook's own announcement is titled "Keeping Passwords Secure"[0] Facebook comms: You can't really use the word "keep" when the entire post is about how you have failed to keep passwords secure, by storing it in plaintext. Or at least, you probably shouldn't use that word. It signals that you intend to keep doing what you're doing, which wasn't just keeping passwords insecure up until sometime in January. It's up until today when you effectively disclosed that you haven't notify hundreds of millions of users that their passwords were compromised for months after discovering it. I know they "were never visible to anyone outside of Facebook", but that group still includes some +25K people. [0] https://newsroom.fb.com/news/2019/03/keeping-passwords-secure/ https://newsroom.fb.com/news/2019/03/keeping-passwords-secur...

ggggtez 8y ago
And they found 2000 employees accessed the data. I don't care how secure they think the passwords are in those 2000 people's hands. You can bet those have been sold on the black market if they leaked to that many people. Just takes 1 unscrupulous person, which is why you encrypt passwords so even if it leaks, the leaker can't get the original!
tonyjstark 8y ago
Why informing them and not resetting their password as a standard security measurement? I think the headline makes it even worse because it's so tone deaf.
CobrastanJorji 8y ago
Facebook comms knows that. That's why Facebook comms used the word "keep." It's also why they said "some" passwords and not "hundreds of millions" of passwords. Facebook comms also knows that "there is nothing more important to us than protecting people’s information" is a bald-faced lie, since Facebook is literally in the business of selling people's information to companies like Cambridge Analytica, but sometimes it's okay to lie as long as it sounds like a meaningless platitude so that nobody would be expected to seriously believe it.

ggggtez 8y ago

And they found 2000 employees accessed the data. I don't care how secure they think the passwords are in those 2000 people's hands. You can bet those have been sold on the black market if they leaked to that many people. Just takes 1 unscrupulous person, which is why you encrypt passwords so even if it leaks, the leaker can't get the original!

tonyjstark 8y ago

Why informing them and not resetting their password as a standard security measurement? I think the headline makes it even worse because it's so tone deaf.

CobrastanJorji 8y ago

Facebook comms knows that. That's why Facebook comms used the word "keep." It's also why they said "some" passwords and not "hundreds of millions" of passwords. Facebook comms also knows that "there is nothing more important to us than protecting people’s information" is a bald-faced lie, since Facebook is literally in the business of selling people's information to companies like Cambridge Analytica, but sometimes it's okay to lie as long as it sounds like a meaningless platitude so that nobody would be expected to seriously believe it.