After a report revealed around 200-600 million Facebook users may have had their account passwords stored in plain text and searchable by over 20,000 Facebook employees, cyber security experts are urging users to change their passwords and turn on the two-factor authentication (2FA).
So far the inquiry has uncovered archives with plain text user passwords dating back to 2012, according to the report published this week by KrebsOnSecurity, a blog run by journalist Brian Krebs.
Facebook in a blog post on Thursday said that it had fixed the issue and will be notifying everyone whose passwords it found stored this way.
"It's perfectly possible that no passwords at all fell into the hands of any crooks as a result of this. But if any passwords did get into the wrong hands then you can expect them to be abused," said Paul Ducklin, Senior Technologist at global cyber security firm Sophos.
"Hashed passwords still need to be cracked before they can be used; plaintext passwords are the real deal without any further hacking or cracking needed," Ducklin added.
Facebook said it had found no evidence to date that anyone internally abused or improperly accessed the passwords.
"While the details of the incident are still emerging, this is likely an accidental programming error that led to the logging of plain text credentials. That said, this should never have happened and Facebook needs to ensure that no user credentials or data were compromised as a result of this error," said John Shier, Senior Security Advisor at Sophos.
"This is also another reminder for people who are still reusing passwords or using weak passwords to change their Facebook password to something strong and unique and to turn on two-factor authentication (2FA)," Shier said.
Turning on 2FA would mean that a password alone is not enough for crooks to raid your account, Ducklin added.
Facebook also asked people to change their passwords "out of an abundance of caution".
Earlier this month, Facebook came under scrutiny for using phone numbers provided for security reasons -- like two-factor authentication (2FA) -- for things like advertising and making users searchable by their phone numbers across its different platforms.
"Another security measure users can implement to strengthen their digital security postures is to use different passwords for different online accounts. Don't use your Facebook password for any other login, particularly for personal/professional email accounts or online banking," said Sanjay Katkar, Joint Managing Director and Chief Technology Officer, Quick Heal Technologies Limited.
"It is also a good practice to log out whenever not using Facebook, even on mobile devices," Katkar added.
NASA head Nelson says China hiding military presence in space
The chief of US space agency NASA has told lawmakers in Washington that China is using civilian programmes to hide military objectives in space.
Google sacks 28 employees involved in protests over Israel govt contract
Tech giant Google has laid off 28 employees who were involved in sit-in protests at its offices over a Google contract with the Israeli government.
US lawmaker raises alarm over spike in attacks on Hinduism
An Indian-descent lawmaker has raised alarm over a “substantial increase” in attacks on Hinduism and Hindu places of worship in the US and expressed frustration at the failure of law enforcement agencies to find and book those responsible.
India is our strategic partner, world's largest democracy: US
Replying to a question raising concern on alleged "democratic backsliding in India" on Monday, he said, "India is the world's largest democracy, it is an important strategic partner of the United States, and I expect that to remain true."
Biden reiterates US commitment to Israel's security
These were Biden's first public remarks since Iran launched a large-scale retaliatory attack against Israel on Saturday, in which most of the missiles and drones used were intercepted -- mainly by Israeli and US forces, Xinhua news agency reported.
Australia in shock as another stabbing incident reported from Sydney
In yet another shocking incident, a bishop and a few other worshippers were stabbed by a man during a church service that was being broadcast online in Sydney on Monday evening (local time).
At polarised UNSC meet on Iran attack, only consensus is Middle East tensions shouldn’t escalate
After hearing a warning at the polarised Security Council’s emergency meeting from Secretary-General Antonio Guterres that the “Middle East was on the brink”, the only consensus was that there should be no further escalation of tensions there.
Indian American selected among 12 NASA astronaut candidates
He continued on to earn a master's degree in aeronautics and astronautics from Massachusetts Institute of Technology and graduated from the US Naval Test Pilot School.