Facebook temporarily disables profiles as it grapples with 150 million hacked Adobe passwords.

Facebook is asking millions of people to change their passwords if they had an account with Adobe, the content creation and cloud marketing company. Adobe was hacked recently and up to 150 million passwords were exposed.

Facebook is taking those exposed passwords and searching its system to find users who may have used the same password for Facebook. Those people will be asked to change their passwords.

The password crisis was triggered because Adobe apparently used only one encryption key for all its stored customer passwords, according to Krebs On Security:

What’s more, experts say Adobe appears to have used a single encryption key to scramble all of the leaked user credentials, meaning that anyone who computes, guesses or acquires the decryption key immediately gets access to all the passwords in the database.

The Adobe password hack is causing a huge headache all across the web. At first, it seemed that just a few million passwords had been stolen. But then that estimate increased to 38 million. And Krebs said the total universe of compromised passwords could be as high as 150 million.

So Amazon, Diapers.com and Microsoft are struggling with the same issue: The Adobe password cache is so massive that there are likely multiple millions of users with accounts at other companies who used identical passwords. Because the hackers can match passwords to IDs (email for instance), anyone who used the same password at Adobe for any other online company is now potentially screwed.

(click to enlarge)

Source: Business Insider

New Facebook feature trusts friends to reset your password.

Have you forgotten or lost your Facebook password? Relax. You can now turn to friends for help.

Facebook on Thursday rolled out Trusted Contacts account recovery, a feature it has tested with a limited number of people as the Trusted Friends capability since 2011.

Users can select three to five trusted contacts from their security settings at any time. These contacts should be available via phone or in person.

This feature could be helpful when a user suffers a mass compromise, meaning he or she loses access both to email and other accounts as a direct result of malware infestation. However, these cases are rare, and most users lose access only to specific accounts in targeted phishing schemes.

How it works:
Once users go into their Facebook Security Settings and select three to five people as trusted contacts, Facebook notifies those people.

When users can't log into their Facebook accounts, they can turn to their trusted contacts for help. Each contact will get a security code with instructions on how to use it. Users need security codes from three trusted contacts to recover their Facebook accounts.

When there's a problem, Facebook will generate an URL dynamically and the user's trusted contacts go into their own personal security settings and find the URL. The URL will give the contact a code and instructions on what to do with it.

Source: Tech News World