[fakedang]

I tested this quite recently actually. I typed my Facebook password to login with all sorts of mistakes, although the core part of it remains the same, with some minor changes (all caps, a capital letter, an extra character, etc). In all cases the passwords were accepted.

Which leads me to think that Facebook passwords might just be stored as searchable text rather than hashes. Granted I'm no cryptography expert though.

[Nilithus]

This was talked about in another HN thread a few years ago https://news.ycombinator.com/item?id=13426544

It's not stored in searchable text rather they simply have some heuristics that they modify the password submitted and retry automatically.

[fakedang]

Thanks. That's a very interesting approach by them.

[cratermoon]

Yikes.