it seems nobody has a clear answer as to how this process is done, everyone is debating on if passwords are stored in clear text (which sounds terrifying) or hashes...
They obviously don't store their passwords in plaintext. It would be terrible practice even if their incentive is just to save their user info in case of a breach.
They just hash common variations of the password (e.g. missing the last letter) to make it easier to login. Is that a good usability/security trade off? I think so but that's more debatable.
Comments
it seems nobody has a clear answer as to how this process is done, everyone is debating on if passwords are stored in clear text (which sounds terrifying) or hashes...
how much do you trust facebook?
Huh?
The top answer links https://www.youtube.com/watch?v=7dPRFoKteIU&feature=youtu.be..., which explains exactly what they do: try a number of different errors client-side.
They obviously don't store their passwords in plaintext. It would be terrible practice even if their incentive is just to save their user info in case of a breach.
They just hash common variations of the password (e.g. missing the last letter) to make it easier to login. Is that a good usability/security trade off? I think so but that's more debatable.
I trust they know better than to store passwords in clear text. I distrust them for a large enough host of other reasons keeping me off the platform.
read the replies, they answered how it's done. There's even a link to a youtube video of a facebook talk, the passwords are hashed.