Followed by a revelation that around 200-600 million Facebook users may have their account passwords stored in plain text and searchable by over 20,000 Facebook employees, cybersecurity experts are urging users to change their passwords and resort to the two-factor authentication (2FA).
As of now, the inquiry has uncovered archives with plain text user passwords dating back to 2012, according to a report published by KrebsOnSecurity, a blog run by journalist Brian Krebs.
Facebook took on the issue and issued out a statement on Monday saying it had fixed the issue and will be notifying everyone who have had their passwords compromised this way.
“It’s perfectly possible that no passwords at all fell into the hands of any crooks as a result of this. But if any passwords did get into the wrong hands then you can expect them to be abused,” said Paul Ducklin, Senior Technologist at global cybersecurity firm Sophos.
“Hashed passwords still need to be cracked before they can be used; plaintext passwords are the real deal without any further hacking or cracking needed,” Ducklin added.
Facebook said that it had not found any evidence until now of anyone internally misusing the information or access the passwords improperly.
“While the details of the incident are still emerging, this is likely an accidental programming error that led to the logging of plain text credentials. That said, this should never have happened and Facebook needs to ensure that no user credentials or data were compromised as a result of this error,” said John Shier, Senior Security Advisor at Sophos.
“This is also another reminder for people who are still reusing passwords or using weak passwords to change their Facebook password to something strong and unique and to turn on two-factor authentication (2FA),” Shier said.
Ducklin added that turning on the 2FA would ensure that miscreants do not get a hold of your account, as password only is not that secure.
Facebook also asked people to change their passwords “out of an abundance of caution”.
Earlier this month, Facebook received criticism for using phone numbers provided for security reasons — like two-factor authentication (2FA) –to target advertisements and making users searchable by their phone numbers across its different platforms.
“Another security measure users can implement to strengthen their digital security postures is to use different passwords for different online accounts. Don’t use your Facebook password for any other login, particularly for personal/professional email accounts or online banking,” said Sanjay Katkar, Joint Managing Director and Chief Technology Officer, Quick Heal Technologies Limited.
“It is also a good practice to log out whenever not using Facebook, even on mobile devices,” Katkar added.
ALSO READ:
- Amazon Apple Fest: deals on iPhones, iPads, macBooks and Apple Watch
- JBL Power Play Sale on Amazon: Discounts and cashback on headphones, speakers and more
- Mi A3, Mi A3 Lite in works from Xiaomi, could come with in-display fingerprint sensors