Google admits to exposing plaintext passwords on its servers since 2005

A few weeks ago, Facebook admitted that it had exposed the passwords of 200 million users, which appeared in plain text on its internal servers. The acceptance came only after the incident was revealed by security researchers. In a blog post published on May 21, Google also acknowledges that G Suite users’ passwords have been openly stored on its servers since 2005, suggesting that this practice is not uncommon.

Google: Passwords of millions of users exposed on their servers

Typically, user passwords are automatically encrypted through a hash operation before being stored in online service databases. So much so that even if someone entered this database, it would be impossible to decipher the passwords in question. Yet Google users’ passwords have been openly exposed for years.

The firm explains that in 2005 it allowed company administrators to manually set passwords for G Suite apps for their employees. These passwords were stored in the open rather than hashed and could be easily retrieved.

Also read : Google launches Password Checkup, an extension that says your password has been hacked

Google explains that the functionality to recover passwords in this way is no longer available. However, many of these passwords remained unchanged. That’s why the company recommends that all users make a change. Finally, Google claims that there is no evidence that malicious people can exploit these passwords stored in plain text. It was necessary to be able to access secure databases that were not already clear in itself.