Facebook Plain-Text Password Debacle: Experts Say Change Your Password, Turn on 2FA
HIGHLIGHTS
Facebook claims there is no evidence of passwords being misused
Security experts warn about changing passwords out of caution
Archives with plain text password date back to 2012
After a report revealed around 200-600 million Facebook users may have had their account passwords stored in plain text and searchable by over 20,000 Facebook employees, cybersecurity experts are urging users to change their passwords and turn on the two-factor authentication (2FA).
So far the inquiry has uncovered archives with plain text user passwords dating back to 2012, according to the report published this week by KrebsOnSecurity, a blog run by journalist Brian Krebs.
Facebook in a blog post on Thursday said that it had fixed the issue and will be notifying everyone whose passwords it found stored this way.
"It's perfectly possible that no passwords at all fell into the hands of any crooks as a result of this. But if any passwords did get into the wrong hands then you can expect them to be abused," said Paul Ducklin, Senior Technologist at global cybersecurity firm Sophos.
"Hashed passwords still need to be cracked before they can be used; plaintext passwords are the real deal without any further hacking or cracking needed," Ducklin added.
Facebook said it had found no evidence to date that anyone internally abused or improperly accessed the passwords.
"While the details of the incident are still emerging, this is likely an accidental programming error that led to the logging of plain text credentials. That said, this should never have happened and Facebook needs to ensure that no user credentials or data were compromised as a result of this error," said John Shier, Senior Security Advisor at Sophos.
"This is also another reminder for people who are still reusing passwords or using weak passwords to change their Facebook password to something strong and unique and to turn on two-factor authentication (2FA)," Shier said.
Turning on 2FA would mean that a password alone is not enough for crooks to raid your account, Ducklin added.