3 ms·
Meta pays the price for storing passwords in plaintext
- zoklet-enjoyer 2y agoThe fine is too low for a company of this size.
- kleinsch 2y agoAuthor of this article learned a lot about password hashing, missed the detail that this was in logs, not the database. Usually you try to avoid logging passwords, you don’t hash them in logs.
- appendix-rock 2y agoYup. A bunch of coverage is understating this point, and the peanut gallery commenters are taking it hook, line, and sinker. Accidentally logging plaintext passwords, whilst concerningly incompetent, is not on the same level as explicitly deciding to store plaintext passwords.
- ChrisArchitect 2y ago[dupe] Discussion: https://news.ycombinator.com/item?id=41669912 https://news.ycombinator.com/item?id=41669912
- deafpolygon 2y ago91m is a drop in the bucket for Meta. Jesus.
- mozzieman 2y agoMost companies have this problem, devs logging credentials all the time. Many web frameworks have a log all then blacklist mentality which leads to soo many mistakes. ex ruby on rails etc.