“For passwords, the problem gets worse because 98% of them, or 19,867,627 to be exact, are in plain text.”
Three researchers scanned five million domains and found 916 Firebase sites leaking 125 million records, including a bank. Firebase ships its own authentication service, so these companies built a plain “password” field on purpose. The researchers sent 842 warning emails. One percent replied, a quarter fixed it, and an Indonesian gambling network mocked them.