Facebook finds millions of users’ passwords stored in plain text
Facebook said the flaw had been caused by a feature which had enabled users to confirm their account and import their email contacts at the same time; however, a redesign in 2016 had removed some of the language which explained this but was still uploading contacts in some cases.
“Earlier this month we stopped offering email password verification as an option for people verifying their account when signing up for Facebook for the first time,” a spokeswoman said.
“When we looked into the steps people were going through to verify their accounts we found that in some cases people’s email contacts were also unintentionally uploaded to Facebook when they created their account.
“We estimate that up to 1.5 million people’s email contacts may have been uploaded. These contacts were not shared with anyone and we’re deleting them.
“We’ve fixed the underlying issue and are notifying people whose contacts were imported. People can also review and manage the contacts they share with Facebook in their settings.”
Facebook’s acknowledgement of the issue comes after concerns were raised by security researchers earlier this month.
Security expert Bennett Cyphers, from the Electronic Frontier Foundation, said “for all intents and purposes, this is a phishing attack” and labelled the process “downright irresponsible”.
