Facebook Stored Millions Of User Passwords In Plain, Readable Text
The Facebook logo photographed in 2018 at the company’s headquarters in California. On Tuesday, Facebook said it found millions of user passwords stored in plain, readable text in its internal data storage systems.
Marcio Jose Sanchez/AP
hide caption
toggle caption
Marcio Jose Sanchez/AP
Unknown to hundreds of millions of Facebook users, their passwords were sitting in plain text inside the company’s data storage, leaving them vulnerable to potential employee misuse and cyberattack for years.
“To be clear, these passwords were never visible to anyone outside of Facebook and we have found no evidence to date that anyone internally abused or improperly accessed them,” Facebook’s Vice President for Engineering, Security and Privacy Pedro Canahuati said in a statement Thursday.
Staff made the discovery in January, during a routine security check, he said.
The company plans to notify hundreds of millions of Facebook Lite users, in areas with scant connectivity, as well as tens of millions of other Facebook users and tens of thousands of Instagram users.
The announcement came in the midst of a report by cybersecurity blog Krebs on Security, which cited an anonymous Facebook source. As many as 600 million users may have been affected, according to the source.
“My Facebook insider said access logs showed some 2,000 engineers or developers made approximately nine million internal queries for data elements that contained plain text user passwords,” blogger Brian Krebs stated.
The archives date back to 2012, according to the report.
Thursday’s disclosure is the latest in a slew of controversies. In 2018, the world learned that political consulting firm Cambridge Analytica harvested information on millions of Facebook users. Later that year, Facebook announced a massive security breach affecting nearly 50 million accounts.
“This is a company that goes from crisis to crisis,” Jeff Chester, executive director of the Center for Digital Democracy, tells NPR.
He says it’s part of a pattern. “Although Facebook is not alone, the problem is that the focus has been on turning all this data into revenue to help advertisers and not enough has been done to help data security.”
There have been accusations of discriminatory ad targeting, discoveries that the company was collecting data from third-party apps on people’s personal details such as menstrual cycles, photos which were accidentally made available to app developers, reports that users’ phone numbers – submitted for security — were targeted by advertisers “within a couple of weeks,” and a scathing New York Times article on Facebook’s attempt to discredit critics with a Washington consulting firm.
Last month, British lawmakers likened Facebook to “digital gangsters” who shunned accountability as disinformation spread like wildfire on social media.
Federal prosecutors are currently conducting a criminal investigation into arrangements Facebook made with Amazon, Apple and other tech giants, according to the New York Times. The partnership may have enabled the companies to access troves of user data without consent, at times without consent.
Chester says news of the password storage insecurity could add fuel to a flame burning in Washington among lawmakers pushing for regulations on big tech companies. “This makes the case for Congress passing privacy legislation and toughening up cybersecurity laws as well,” Chester says.
Facebook insists privacy is its top priority.
“There is nothing more important to us,” Canahuati said, “than protecting people’s information, and we will continue making improvements as part of our ongoing security efforts at Facebook.”
Note: Facebook is among NPR’s financial supporters.
Blair Braverman And Her Dogs Finish First Attempt At Iditarod
Blair Braverman just finished her rookie attempt at the nearly 1,000-mile Iditarod race in Alaska. She sent a radio diary of the most-notable moments from her first go at the race.
AILSA CHANG, HOST:
The Iditarod stretches for nearly a thousand miles through the Alaskan wilderness from Anchorage to Nome. Mushers and their sled dog teams race through frigid temperatures and rugged terrain. This year’s competition wrapped up earlier this week, and about a quarter of the racers dropped out along the way. Iditarod rookie Blair Braverman became a Twitter sensation as she prepped for the race, posting stories and photos of her charismatic dogs. We spoke with her in the days leading up to the race.
BLAIR BRAVERMAN: If I think about the race, it’s terrifying. But if I think about being out there with my dogs who are my best friends and my family, I just get so much strength from that, which gives me all the courage I need.
CHANG: Now, critics say the sport is cruel to dogs. She is aware of the criticism but says the animals are highly trained athletes and are never happier than when they’re running. Braverman took a recorder with her on the trail, and she sent us this audio diary.
BRAVERMAN: So I’m 29 miles into the Iditarod. The dogs are doing good. They had some little pieces of chicken for snacks. I passed a sign that some people had painted that said only 986 miles to Nome (laughter). I think that was about a mile out of the starting chute.
(SOUNDBITE OF HARNESSES JANGLING)
BRAVERMAN: Come on.
We spent our first night on the Iditarod Trail, and the dogs did well. It’s a beautiful day. It is, like, 4 degrees. We’re averaging about 8 miles per hour but 10 miles per hour when they see a bird (laughter). We’re going over some overflow, but it’s not bad. It’s just sort of like going through melted snow cone – sounds like this.
(SOUNDBITE OF SNOW SLUSHING)
BRAVERMAN: Helli is in heat, and Boo is very horny. He’s a teenage boy. He’s not neutered. But he’s far away from Helli, so he’s turned his interest to Ebony instead. Boo – eyes forward. OK, time to navigate some forest trail, so I’ll put this way.
OK, so I’m on a big, wide frozen river on – it’s about 20 degrees. It’s beautiful. The sun’s coming out from a snow shower. I will say we’re spending a lot of time pooping on the trail. In training, they poop while running, and they seem to have come to a collective decision. They’re running a thousand miles. They’re going to stop to poop (laughter).
So the last couple checkpoints, everyone sees you off. And they’re like, goodbye; have a good run. Ten feet later, Ebony stops to poop. And then they all sort of, like, laugh. And then they’re like, OK, bye; like, you can go. And then, like, 8 feet later, like, Spike stops to poop. At this point, people are just feeling, like, pretty uncomfortable because you’re not gone yet, but it’s just ’cause the dogs are pooping. Ready – oh, no, we have another tangle.
We’re on our way from McGrath to Takotna, and this is supposed to be a pretty easy 18-mile run. And I will say they’re definitely tired, and – oh, steep hill, whoa. OK – went down onto a riverbed. So I’m a little worried about if they’re going this slowly – if it means that it’s going to be too much for them to keep going. And I’d be bummed, but I’m nothing but, you know, just completely consumed with pride and amazement and gratitude for these dogs. OK, we’re going up a hill into the village. I can see lights from windows.
(SOUNDBITE OF DOGS BARKING)
UNIDENTIFIED PERSON #1: Good evening.
BRAVERMAN: Hello.
UNIDENTIFIED PERSON #1: Which number?
BRAVERMAN: Eleven.
UNIDENTIFIED PERSON #1: Eleven – you going right through?
BRAVERMAN: No, I’m going to stop here.
UNIDENTIFIED PERSON #1: OK. That sounds good.
BRAVERMAN: Hey, buddy – back feet. There you go.
OK, I’m heading out into the most rural part of the trail, and – what’s going on up there? Helli – oh, my God, Helli, you broke that harness, too. How? How do you do it so fast? I don’t have another one for you. Oh, boy, I don’t know, man. I don’t know if we’re going to finish this race or we’re not or – who knows? We’re just going to keep going.
Someone told me there was a really bad storm coming, and it got really dark. Like, I was using my headlamp at 1:30 in the afternoon. And I, like, wasn’t even thinking. I just – I was like, well, safety first and race second, and I turned the team around, and we went back to the previous shelter cabin. I took care of the team, and I fed them and bedded them down. And I thought we don’t have enough dog food for this extra 20 miles we just added to the run. Yeah, we have to get out.
I don’t think we can do it. I don’t think we have enough dog food – oh, God (crying).
So some interesting things have happened. I was sitting in the cabin. I think I was there for about 20 hours. And I called the race judge. And he’s like, do you have enough dog food? And I said, not really. And he goes, there’s a crew of three mushers ahead of you. They’re traveling together. If you can catch up to them, maybe they would have extra dog food. Then you may continue the race. So I mushed for three hours. We get to Old Woman cabin, and what do you know? But there’s three dog teams parked there.
So the people are Victoria, Jeremy and Cindy. And Victoria’s like, dude, I packed for the apocalypse. She pulls out, like, 30 pounds of dog food. She’s like, you want this? I don’t need it. So I feed my dogs. And now I’m mushing into the sunset that we turned away from last night. We got this crazy second chance.
(Laughter) I see the lights of Nome. I see them. We’ve got to get over this mountain, but I see the lights in the distance.
(CHEERING)
UNIDENTIFIED PERSON #2: Let’s give a big, warming, Saint Patrick’s Day cheer for Blair Braverman.
UNIDENTIFIED PERSON #3: Right here.
BRAVERMAN: Yes.
UNIDENTIFIED PERSON #3: Welcome to Nome.
BRAVERMAN: Thank you.
UNIDENTIFIED PERSON #3: All right.
BRAVERMAN: Hey, good job, you guys. You did it. Oh, my gosh, Flame, oh. OK, let’s get you guys to bed and get you a good meal ’cause I’ve been promising you that for 70 miles now.
CHANG: Seventy miles of the 1,000 total miles that Blair Braverman traveled during the Iditarod. It took 13 days, 19 hours and 17 minutes. She came in 36th place. Braverman’s Twitter followers raised money for Alaska schools while she raced, bringing in over $100,000. This story was produced by Lu Olkowski and Dave Blanchard.
Copyright © 2019 NPR. All rights reserved. Visit our website terms of use and permissions pages at www.npr.org for further information.
NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
