Does Facebook store plain-text passwords?

Question

I was about to reset my Facebook password and got this error:

Your new password is too similar to your current password. Please try another password.

I assumed that Facebook stores only password hashes, but if so, how can they measure passwords similarity? This should be impossible with good hashing function, right?

Question is - how is this possible and what are the implications?

Thanks in advance.

UPDATE

I didn't make it clear - I was not asked to provide old and new password. It was the "reset password" procedure, where I only provide a new password, so most of answers of suggested duplicate are not applicable.

UPDATE2

mystery solved - see comment (from Facebook engineer)

Answer 1

Let's hope and assume that Facebook stores only hashes of current password (and potentially previous passwords).

Here is what they can do:

1. user sets first password to "first" and fb stores hash("first").

2. later on, users resets password and is asked to provide new password "First2"

3. Facebook can generate bunch of passwords (similar to the new one): ["First2", "fIrst2", "firSt2", ... "first2", ... "first", ... ] and and then compare hash of each with the stored hash.

This is the only solution that comes to my mind. Any other?

Answer 2

I wouldn't know if they do (don't even use Facebook), but it's also possible that they use Hardware Security Modules (HSM) for their cryptoprocessing that don't store hashed passwords but merely reversibly encrypt them. With the volume of authorization requests they have to deal with, this would make perfect sense, as it's orders of magnitude faster than secure (read: slow) password hashing, while still offering safe password storage.

HSMs could then be programmed to compare stored and new password as an input of one of their functions and merely return result of it (could even be a boolean value in our case), with the original password never even transmitted or stored in plaintext anywhere, besides their internal memory (which is tamper resistant). This is usually referred to as an onboard secure key and application storage/processing.

By the way, many banks use HSMs because a proper implementation of it also requires physical security for the devices themselves and the way they're accessed (plus, they are rather costly), but this obviously provides a great deal more flexibility in the way passwords can be processed securely without them ever being disclosed.

Answer 3

There's only one correct answer to this. Nobody knows (except Facebook).

Facebook could store your Facebook password in plaintext, but there also might be some scheme that uses fuzzy hashes or pre-computed hashes of similar passwords.

There is really no way of knowing unless we were to break into Facebook and audit all of their assets.

Answer 4

Another possibility is that Facebook stores a hash of your password, and a hash of the SOUNDEX of your password. Then when you enter your new password, it can compare the hash of its SOUNDEX with previously stored ones and respond that a password is too similar.

This is, of course, purely conjecture.

Answer 5

Another possibility is that fb doesn't hash, but encrypt passwords with their master key. Than they could decrypt it anytime to compare it to your new one.

1. Let's hope not - they should hash it!
2. As Rell3oT pointed out, no one knows except fb. So all we can do is throw wild guesses into the ring.

Answer 6

Supplying a little more detail about the password storage method itself.

The earlier historic answers predate any confirmation from Facebook. But at Passwords 14, Alec Muffett gave a talk in which he explicitly described password storage at Facebook in some detail.

In his talk, he confirms that Facebook is not storing passwords in plain text, but rather uses a multi-step method that is quite resistant to a variety of attacks:

... as follows:

$cur  = 'plaintext'

# MD5 the plaintext.
$cur  = md5($cur)

# Hash SHA1 with a 160-bit salt.
$salt = randbytes(20)
$cur  = hmac_sha1($cur, $salt)

# Hash SHA256 with a secret salt, using an internally abstracted crypto service.
$cur  = cryptoservice::hmac($cur)
        [= hmac_sha256($cur, $secret)]

# Run the result through the scrypt KDF
$cur  = scrypt(2^14, 8, 1, $cur, $salt)

# Use SHA256 (to reduce and normalize the large scrypt result)
$cur  = hmac_sha256($cur, $salt)

This level of resistance should not be surprising, since Muffett is the author of crack, one of the first efficient password-cracking tools.

So we now have confirmation that Facebook does not store passwords in plain text.