For 14 years, Google kept G Suite users' passwords unencrypted

dr.gautam · 发表于 2019-05-22 21:54:07

[br]

[br]Just recently, Facebook drew widespread criticism for storing the passwords of its users in plain text.[br][br]The issue lasted for years, but as it turns out, the social network wasn't alone in this act.[br][br]For 14 years, Google, the biggest technology giant in the world, had also stored the passwords of many of its users in an unencrypted, text format.[br][br]Here are the details.[br][br]Google kept G suite businesses' passwords unhashed[br][br]Issue[br][br]Normally, passwords are hashed with a cryptographic key to prevent them from being read even if they are accessed by mistake.[br][br]However, Google recently acknowledged that an error associated with its password recovery implementation led to the storage of some G Suite users' passwords in an unhashed format.[br][br]The plain-text passwords were kept on its internal system since 2005.[br][br]Issue stemmed from a G Suite specific feature for companies[br][br]Fact[br][br]The problem of unhashed passwords occurred from a feature that let company administrators for G Suite set user passwords manually. The passwords they chose were stored in the unencrypted format on the administrator console and on Google's systems.[br][br]

[br]Now, the issue has been resolved[br][br]Solution[br][br]Notably, Google has now disabled the capability when the issue gained momentum.[br][br]The company says that there is no evidence of the bug being exploited or anyone accessing the plain-text passwords in question.[br][br]Also, it is worth noting that the passwords were on Google's internal systems, which would have made it difficult for an outsider to get their hands on them.[br][br]Affected users are being alerted now[br][br]Remedial[br][br]The search giant hasn't given a word on how many users might have been impacted but has already started resetting passwords and sending out emails to affected customers about the issue.[br][br]Also, the issue was limited to a subset of people using G Suite, which is the corporate version of Gmail and other Google apps. The consumer accounts were not impacted.[br][br]Google apologized and promised to maintain security standards[br][br]Fact[br][br]"We take security of our enterprise customers extremely seriously, and pride ourselves in advancing the industry's best practices for account security. Here we did not live up to our own standards, nor those of our customers. We apologize to our users and will do better."[br][br]Facebook and Twitter have been involved in similar cases[br][br]Other issues[br][br]The latest issue didn't impact consumer Google accounts, but it definitely highlights the problem of poor security on the internet.[br][br]Just recently, millions of Facebook and Instagram passwords were stored in the same way, and some 20,000 Facebook employees could have accessed them.[br][br]Similarly, back in May 2018, Twitter had suffered a breach and asked all 330 million of its users to change passwords.[br][br][br][br][br][br]source : en.newsbytesapp.com[br]