Millions of Facebook Passwords Left Exposed
Consumer Reports has no financial relationship with advertisers on this site.
Consumer Reports has no financial relationship with advertisers on this site.
Facebook announced Wednesday in a blog post that passwords belonging to “hundreds of millions” of users were stored unencrypted on the company’s servers, where they could have been accessed improperly by Facebook employees.
The company says it has no evidence the passwords were stolen or misused, and says that they weren’t available to anyone outside the company. The problem was discovered in January, according to the blog post.
“We have fixed these issues and as a precaution we will be notifying everyone whose passwords we have found were stored in this way,” the post said.
That will include “hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users,” the post said. Facebook Lite is designed to work over slow data connections.
The new incident doesn’t pose much danger to consumer data, according to privacy experts, but it further erodes consumer trust in Facebook’s privacy and security practices.
“This is far from the first privacy and security incident at Facebook within the last year,” says Justin Brookman, director of consumer privacy and technology policy for Consumer Reports. “Software bugs happen, especially at large institutions like Facebook with so many moving parts, but it’s surprising that an issue of this magnitude slipped through for as long as it did.”
According to reporting by KrebsOnSecurity, a noted source of security news, employees have had access to some passwords since 2012. But Facebook says it did not become aware of the issue until January.
Standard security practices call for passwords to be “hashed” before they’re stored on corporate servers. When passwords are hashed, an algorithm replaces the characters with a random series of letters and numbers, making it difficult for a human to read them. If a password is stored in plain text, as was the case with Facebook, anyone who reads it could use it to gain access to your account.
“It’s good news for consumers that Facebook says none of the data was exploited by bad actors, but this is alarming, especially because many people tend to reuse the same password across different services,” says Bob Richter, who heads Consumer Reports’ privacy and security testing. “Facebook should be doing more to prevent this kind of issue before it happens, and catch it faster when it does."
According to Patrick Jackson, chief technology officer of the data security firm Disconnect, the problem was likely the result of a poorly designed internal logging system. Companies big and small keep a history of all the activity and information being transmitted on their platforms so there’s a trail to follow in the event of a data breach.
Passwords should always be excluded from these data sets to protect users’ privacy, Jackson says. “If you’re collecting data that shouldn’t be captured in the first place and storing it, that’s really problematic,” he says.
Facebook said by email that the passwords were stored inadvertently under various scenarios, for instance in logs generated during computer crashes.
What Steps Should You Take Right Now?
Facebook says it will soon start alerting users whose passwords were stored in plain text. There’s no reason to wait.
If you use Facebook or Instagram, it’s a good idea to change your password. To add another layer of defense, activate two-factor authentication.
Once you turn the feature on, the service will send you a verification code—via text or an app—to confirm your identity anytime you access your account from a new location, device, or browser. That makes it significantly more difficult for someone to break into your account, even if they know your password.
To adjust your Facebook log-in credentials using a computer browser, head to the Privacy Shortcuts page by clicking the question mark icon in the top right corner, and then scroll down to change your password and turn on two-factor authentication. To make the same changes in Instagram, open the mobile app, select Settings, and tap Privacy and Security.
CR’s Richter says it’s better to use an app such as Duo Mobile or Google Authenticator for two-factor authentication instead of text messages. Those options are available in the settings for both Facebook and Instagram.
While you’re at it, introduce some friction for would-be hackers by following our guide to better passwords. One tip to get you started: Steer clear of any passwords you’ve used before.
If you really want to protect yourself, many privacy and security experts recommend using a password manager such as 1Password or LastPass, which will generate unique, random passwords for every service you use, and keep track of them for you.
Once you’ve locked down your log-in credentials, you can take even more control of your data by adjusting your privacy settings on Facebook and Instagram.
Editor's Note: This article has been updated to include additional information from Facebook.
More from Consumer Reports:
Top pick tires for 2016
Best used cars for $25,000 and less
7 best mattresses for couples
Consumer Reports is an independent, nonprofit organization that works side by side with consumers to create a fairer, safer, and healthier world. CR does not endorse products or services, and does not accept advertising. Copyright © 2019, Consumer Reports, Inc.
