Facebook has just admitted to years of problems with password hygiene by leaking plaintext passwords into logfiles by mistake.
Watch this special edition of Naked Security Live…
…we answer the questions lots of people have been asking us since we first wrote about this issue:
- What happened?
- Was this a blunder or was Facebook being deliberately sneaky?
- Should I close my account because of this?
- Is this issue connected to Facebook’s recent outage?
- What steps should I take right now?
(Watch directly on YouTube if the video won’t play here.)
Paul
Why do you still use facebook?
Paul Ducklin
Speaking personally – because I get to choose what I upload and how much I share, so if I am prudent (always a good idea online) I get access to a huge free cloud service to host content that would otherwise take a huge amount of effort to self-publish, wouldn’t have the same uptime, and wouldn’t have the same reach.
Anonymous
Bad
MrGutts
Facebook itself is one big privacy/security hole. Either lock your account down, which they will eventually undo what you have done by “mistake” or oopsey our fault, but you should just delete the trash. Facebook has proven over and over they do not care about you or your data, they are digital thugs / hoodlums.
Anonymous
Please NO VIDEO!!!
Paul Ducklin
Plenty of our readers enjoy consuming our content in more than just written form, which is why we also do podcasts and videos, and why we receive regular and frequent positive comments on our audio and video offerings.
Considering that it’s pretty obvious from the headline (the word [VIDEO] is the hint!) what is coming in the article, and considering that no one is forcing you to watch, and considering that we have already published written material on this very topic for those who prefer to read rather than watch (to prefer to read and watch as well)…
…I think we’re going to have to agree to disagree.
We aren’t going to stop making videos for everyone else in the world just because you don’t like them.
Fred Kerby
Well said. As usual, a top notch piece of work in the video. Sound advice based on rational thinking. Keep up the great work.
David C.
I suspended my Facebook account many years ago. I haven’t deleted it because at the time it wasn’t possible and maybe I might want to re-activate it in the future.
Theoretically, my old password could be used to re-activate the account. In the light of this news, should I re-activate it, change the password and suspend it again? Do we know the time-frame for these recorded passwords? If it happened before I suspended my account (or if they haven’t kept the logs after all these years), then I suspect I can ignore this, but is there any way for me to know?
Paul Ducklin
2012 or later is the most precise I have seen so far.