Facebook is looking for your stolen passwords. On Friday, the social network announced that it built a system that will actively search sites for stolen credentials and then reference that data with its own records. "This is a completely automated process that doesn't require us to know or store your actual Facebook password in an unhashed form," Facebook security engineer Chris Long wrote in a post. "In other words, no one here has your plain text password." If there is a match, users will be notified by Facebook. Long also offered some common-sense advice: don't use the same password for every website. As the Dropbox security scare last week showed, big companies don't necessarily have to be hacked to be compromised. The stolen username-password combinations were not swiped from Dropbox, the company said, but taken from other services and posted on Pastebin, one of many "paste" sites that let people share plain text — often computer code but sometimes ill-gotten information like passwords.
IN-DEPTH
- Dropbox: Claims of 7 Million Hacked Accounts Not True
- Inside the Psychology of Celebrity Hackers: 'It's a Badge of Honor'
- How to Devise Passwords That Drive Hackers Away (New York Times)