Surprise Surprise! Facebook Stored 600 Million User Passwords In Plain Text On Company Servers

Facebook is at it again, displaying utter neglect when it comes to safeguarding their users, not to mention disclosing breaches to them.

The social media company has admitted to storing the passwords of millions of users in plain text, where employees could see them.

The issue was first uncovered by cybersecurity Brian Krebs earlier this week, but it wasn't until yesterday that Facebook confirmed the news in a blog post. And get this, it was a serious flaw in their systems that cropped up back in 2012, and we had no word about it, despite the fact the flaw was discovered in January this year. I mean, it's not surprising considering the habit Facebook has made of not disclosing breaches and vulnerabilities until they're in hot water for it.

Based on reports, the password data for anywhere between 200 million to 600 million Facebook users was exposed.

The issue cropped up recently because Facebook is investigating these incidents. Apparently, employees built applications that logged users' unencrypted passwords in plain text on internal company servers. It's standard security protocol to encrypt saved passwords, using a process called hashing), but a number of factors ended up with apps that weren't doing this.

As such, as many as 20,000 Facebook employees would have had access to those plain text passwords. Facebook says it's now starting to notify all the affected users, but a password reset won't be necessary. To be clear, these passwords were never visible to anyone outside of Facebook and we have found no evidence to date that anyone internally abused or improperly accessed them," says Pedro Canahuati, VP of Engineering, Security and Privacy, in a blog post.

"We estimate that we will notify hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users."

Despite those claims though, Krebs notes his insider source at Facebook says at least 2,000 employees searched through the files containing those plain text passwords. Though the access logs show them looking at the files, there's no clear reason what for.

At this point, we're at a level of ludicrousness with Facebook that's hard to even take seriously anymore. In the span of a year, the company has gone from a single security misstep to just flat out tap dancing in the path an oncoming train