Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years
(Edit: reworded a bit to make it clear I don&#x27;t think this is acceptable)<p>Sounds a lot like some service was logging the full body of a signup&#x2F;login request, which then was readable for anyone with access to the logging&#x2F;tracing infrastructure.<p>Dumb mistake but it&#x27;s not hard to imagine this happening,  considering that FB probably has a bunch of services involved in the login&#x2F;signup flow to prevent bots&#x2F;spam, abuse, etc.<p>Not to imply this is acceptable, especially at a IT company like FB with vast resources and know how. Raw passwords are an especially big screw-up.
There are a lot of failures here, from actually logging something so sensitive over giving access to so many employees to not noticing this for years. (Assuming this was actually log data).<p>BUT if we are honest, anonymizing log data is rarely a priority. Even if it is, leaking sensitive data can happen easily in a lot of different points in the infrastructure. In actual application code, client + server exception tracing (just imagine a deserialization exception which contains part of the input) , web server, load balancer, proxies, service mesh... 
There is a lot of interesting stuff hiding in the logs at pretty much every company.<p>This is a good time to look in the mirror and audit your logging and tracing data. Unless you are in a highly regulated field like finance&#x2F;healthcare or  there is a strong company-wide culture for security&#x2F;privacy with regular audits already, I can almost guarantee you will find at least one data point that should not be where it is.<p>Protecting sensitive data needs to be a big consideration for every dev, ops and especially management, which has to allocate enough time for security reviews and audits.