3 ms·
There might not have been a large-scale public data dump of passwords, but if 20,000[1] employees had access to logs with plaintext passwords, there is no guara
by jyrkesh 7y ago
There might not have been a large-scale public data dump of passwords, but if 20,000[1] employees had access to logs with plaintext passwords, there is no guarantee I could ever accept that zero of them read or used customer passwords for personal purposes.
What's to stop a malicious ex-lover from grabbing a FB password and reading that person's private messages? If FB didn't even know there were passwords in plaintext, they very likely weren't auditing log access as much as was needed.
[1] https://www.theverge.com/2019/3/21/18275837/facebook-plain-text-password-storage-hundreds-millions-users https://www.theverge.com/2019/3/21/18275837/facebook-plain-t...
- UncleMeat 7y agoMalicious insiders don't need your password to access your data. If you are concerned about malicious insiders then plaintext password logs don't matter.
- _jal 7y agoWith FB's dataset and employee count, it would be insane not to be concerned with malicious insiders. Even if you completely discount morality and honesty where Facebook is concerned (and I do), there's substantial liability risk, PR risk, regulatory risk and commercial paranoia, which I suspect was likely their biggest concern, at least until recently.
- beat 7y agoI'm more concerned with plaintext passwords because most people use the same passwords over and over, so if you can break one system, you can break others.