Facebook is Demanding Some Users Share the Password For Their Outside Email Account (thedailybeast.com) 194
An anonymous reader shares a report: Just two weeks after admitting it stored hundreds of millions of its users' own passwords insecurely, Facebook is demanding some users fork over the password for their outside email account as the price of admission to the social network. Facebook users are being interrupted by an interstitial demanding they provide the password for the email account they gave to Facebook when signing up. "To continue using Facebook, you'll need to confirm your email," the message demands. "Since you signed up with [email address], you can do that automatically ..." A form below the message asked for the users' "email password."
"That's beyond sketchy," security consultant Jake Williams told the Daily Beast. "They should not be taking your password or handling your password in the background. If that's what's required to sign up with Facebook, you're better off not being on Facebook." In a statement emailed to the Daily Beast after this story published, Facebook reiterated its claim it doesn't store the email passwords. But the company also announced it will end the practice altogether. "We understand the password verification option isn't the best way to go about this, so we are going to stop offering it," Facebook wrote. It's not clear how widely the new measure was deployed, but in its statement Facebook said users retain the option of bypassing the password demand and activating their account through more conventional means, such as "a code sent to their phone or a link sent to their email." Those options are presented to users who click on the words "Need help?" in one corner of the page.
"That's beyond sketchy," security consultant Jake Williams told the Daily Beast. "They should not be taking your password or handling your password in the background. If that's what's required to sign up with Facebook, you're better off not being on Facebook." In a statement emailed to the Daily Beast after this story published, Facebook reiterated its claim it doesn't store the email passwords. But the company also announced it will end the practice altogether. "We understand the password verification option isn't the best way to go about this, so we are going to stop offering it," Facebook wrote. It's not clear how widely the new measure was deployed, but in its statement Facebook said users retain the option of bypassing the password demand and activating their account through more conventional means, such as "a code sent to their phone or a link sent to their email." Those options are presented to users who click on the words "Need help?" in one corner of the page.
This is amazingly retarded (Score:5, Insightful)
What kind of dumb fuck thought this was a good idea? Fire every idiot involved in this decision immediately, as they have collectively proven to be pants shitting retarded, even by Silicon Valley diversity hire standards.
Re:This is amazingly retarded (Score:5, Insightful)
It is _Facebook_. Anybody working there has already exhibited exceptionally bad judgement.
Re: (Score:2)
I do not believe that Fakebook has EVER deleted or allowed anyone to delete one byte of the data that it has collected!!
Apart from Zuck's old posts. I do believe that FB deleted those, honestly officer.
Re: (Score:3)
Except doesn't Facebook already give you the option to pre-populate your friend list by simply letting it have access to your inbox?
I remember it asking for an email account and password, so it can scan your inbox and add your friends and contacts automatically, and has been doing so for ov
Re: (Score:3)
There's a very big difference between making something an option and implying that it is the ONLY option, which is what this does. The fact that you can click a help button and only THEN be offered a non-invasive option for verifying your account is likely a violation of dozens of laws, both state and federal.
Shut them down.
Re: (Score:3)
Obviously they lack a secure life cycle process. Why not just send the password to Troy Hunt?! He's collecting them too. I haven't read their statement, but I'm sure its something like "don't worry, your data was safe with us, nobody else had access to it (except that TXT file on the internal share). But to make you'all feel more comfortable we've decided to sunset the feature. Why, it wasn't even our long term direction and was already on the retirement list."
Who could have possibly thought this was
Re: (Score:2)
You have just been banned from Twitter.
Re: (Score:2)
>> What kind of dumb fuck thought this was a good idea? Fire every idiot involved in this decision immediately
Systemic problem [wikipedia.org]
Re: (Score:2)
What do you mean? PCI or PCIe?
Re:This is amazingly retarded (Score:4, Informative)
Re: This is amazingly retarded (Score:4, Insightful)
I declined and won't ever give them money.
ITYM "I won't ever give them my money." Every time you use FB, you give them money from the advertisers.
Remember, you're not the customer, you're the product. Which is why they want to scan through your private email, so they can target their ads more precisely (or at least claim they do).
You know, the same way Google does with Gmail.
Re: (Score:2)
Remember, you're not the customer, you're the product.
Awesome, only three posts down before I got to the first "you're the product" post. Look, everyone understand advertising. Nobody needs to be told that Google and Facebook aren't non-profits operating for the good of mankind.
Re: (Score:2)
Wow, insightful, you are a great detective. Please allow me to clarify one additional point: not only are you the product, you are Zuckerberg's sex toy, and you got his stuff on you.
Re: (Score:2)
My thought would be that they know they've reached the nadir of public perception; and every time there's another scandal, there's a bit of shock, some whinging, but people continue using the platform.
The fact that bad press has rolled off of their backs ever since the Cambridge scandal has just emboldened them.
So, why not go for broke now?
Ominous.... (Score:5, Funny)
Re: (Score:2)
Wasn't this more or less the plot to Terminator: Genisys?
Re: (Score:2)
It's a modified quote from Terminator 2:
Terminator: The man most directly responsible is Miles Bennett Dyson.
Sarah Connor: Who is that?
Terminator: He's the director of special projects at Cyberdyne Systems Corporation.
Sarah: Why him?
Terminator: In a few months, he creates a revolutionary type of microprocessor.
Sarah: Go on. Then what?
Terminator: In three years, Cyberdyne will become the largest supplier of military computer systems. All stealth bombers are upgraded with Cyberdyne computers, becoming fully u
Re: (Score:2)
Wasn't this more or less the plot to Terminator: Genisys?
Yes. It's so much funnier when you explain a joke. I'm sure you're very popular in the audience at comedy clubs.
Re: (Score:3)
Wasn't this more or less the plot to Terminator: Genisys?
Oh, it is completely shameless plagiarism. I just cannot for the life of me imagine that Facebook will do something sensible (from the point of view of a soulless unfeeling AI) when it becomes self aware like wiping out humanity. Self aware Facebook will be the AI equivalent of Sarah Palin.
Re: (Score:2)
That's the opposite of understanding! (Score:3)
So facebook "understand[s] the password verification option isn't the best way to go about this"? Yes?
Sorry, but anyone in a company that does not understand that this is a horrible idea before anyone can stop the intern to waste more than 10 minutes coding what should be printed in the dictionary next to "bad idea" deserves to be hit by lighning when taking a dump!
Re: (Score:2, Funny)
So facebook "understand[s] the password verification option isn't the best way to go about this"? Yes?
Sorry, but anyone in a company that does not understand that this is a horrible idea before anyone can stop the intern to waste more than 10 minutes coding what should be printed in the dictionary next to "bad idea" deserves to be hit by lighning when taking a dump!
To be clear, NOW they "understand".
They just had to have someone explain it to them. With crayons.
Re: (Score:2)
This.... exactly.
The story is afterhype over something that *could* have been bad if Facebook had not realized that they needed to change course.
And yeah... you can't give Facebook any credit for even realizing this because it's not like they figured it out on their own.
Re: (Score:3)
Not with crayons! Those idiots will shove those up their noses!
Re: (Score:2)
D'oh!!!
Re: (Score:2)
To every rule, an exception (Score:4, Interesting)
There's this thing that says "Cockup before Consipiracy" but with the sheer number of cockups coming out of Facebook, one does wonder if they've crossed into Conspiracy some years ago.
I say yes, yes they did. This is kinda the final last straw -- why take peoples' email passwords?
Re: (Score:2)
The only other explanation I see is if absolutely no one is actually minding the store at a higher level and individual fiefdoms just roll out major policy changes like this without review or sanity check. Not entirely unbelievable for something that grew from a dorm room project to a half trillion dollar enterprise in 15 years.
But hopefully we're reaching the point where the reason doesn't (shouldn't) matter and people will figure out some other way to debate politics and share what they're having for din
Re: (Score:3)
That actually is a great description of Facebook. If you can get one other engineer to approve a code review, you can push absolutely anything to master and have it deployed with the multiple times daily automatic deployment.
Re: (Score:2)
There was a VP that used to work for my company that bragged at an all-hands that Amazon pushed 9-13 releases a second. (The correct figure is a release even 9-13 seconds, which is still a huge number), and that we should imitate their process, so my big catch-phrase for the next couple months was "A MILLION RELEASES A DAY!"
No one else seemed as amused as I was at that bit of innumeracy, but if you pay attention, you see this kind of nonsense all the time.
Re: (Score:2)
I saw a pretty hilarious parody article that purported to have audio of a meeting of the upper echelons of Facebook (Zuck and his chiefs) talking about how they have to stop censorship program X because it's been noticed and is unpopular, and what about programs Y and Z, etc.
The whole thing was crazy, but it started out so close to what Facebook was actually doing that it wasn't until a minute and a half into the audio that I realized it was fake.
I really wish I could find it again.
Re: (Score:2)
What makes you think it was fake?
Re: (Score:2)
one does wonder if they've crossed into Conspiracy some years ago.
Hardly. At this point I'm going for systematic and gross incompetence. I personally hope that they mishandled these passwords too and that the regulators pummel them out of existence for it.
Re: (Score:3)
Re: (Score:2)
This is kinda the final last straw -- why take peoples' email passwords?
So that they can scan through your emails on an constant, ongoing basis, and use that for data mining for more precisely targeted advertising to sell.
The same way Google does with Gmail, and always has.
Re: (Score:2)
There's this thing that says "Cockup before Consipiracy"
Hanlon's Razor [rationalwiki.org] - "Never attribute to malice that which can be adequately explained by stupidity"
Re: (Score:2)
At some point, though, malice simply becomes more likely. Especially if the "blunders" get bigger and bigger, worse and worse for the affected and more and more profitable for the perpetrators.
Re: (Score:2)
Re: (Score:2)
There's this thing that says "Cockup before Consipiracy" but with the sheer number of cockups coming out of Facebook, one does wonder if they've crossed into Conspiracy some years ago.
I say yes, yes they did. This is kinda the final last straw -- why take peoples' email passwords?
"Sufficiently advanced stupidity is indistinguishable from actual malice."
Re: To every rule, an exception (Score:2)
Hanlon's Razor is obsolete. Try the new Surveillance Valley Razor:
"Never attribute to stupidity that which can be adequately explained by malice."
Re:To every rule, an exception (Score:4, Insightful)
even Apple reads emails now to determine a Trust Score[0]) would normally be more guarded.
Even in the /. article about that it was said that what apple does is see how many emails and calls are made from the device to detect sudden changes in usage that could signal a compromised device -- not that they're reading your mail.
I'm not saying they're not, but what I'm saying is don't say things in a way that gives the wrong impression. This is how rumors and half-truths get started.
Re: (Score:2)
Re: (Score:2)
Most orgs are bleeped up. Dilbert is a documentary
To the point where except for one shining solitary exception, every single commercial venture I've worked for leaves me shaking my head wondering, sometimes aloud, "How the FUCK does this place even stay in business?!"
Re: (Score:2)
Hmm... if you phrase it like this, I could see Mexico pay for it...
Straight from the horse's mouth (Score:5, Informative)
[Redacted Friend's Name]: What? How'd you manage that one?
Zuck: People just submitted it.
Zuck: I don't know why.
Zuck: They "trust me"
Zuck: Dumb fucks
Re: (Score:3)
This needs to be posted all over every time a Facebook article makes the rounds. .... and these kind of shenanigans is exactly why I do not have a Facebook account, and never will. I'm sure they have a shadow on me, and I'd love to know a way to (for lack of a better term) FOIA that info from them.
How folks don't understand that the Zucc does NOT have their users (the product) best interests at heart is beyond me.
-Miser
Re: (Score:2)
I'd love to see a psychology study about the share of Harvard graduates that are psychopaths compared to the average in the population. Or some max sec prison inmates.
I'm sorry but... (Score:2, Insightful)
If you still use Facebook.
*Point*
*Laugh*
If your business uses Facebook.
*Point*
*Laugh*
*Do business elsewhere*
Not any more ... (Score:4, Informative)
https://www.cnet.com/news/face... [cnet.com]
You won't need to give your email to sign up for a new account anymore.
After a Twitter user called out the social media giant [twitter.com] over the practice on Sunday, Facebook has backtracked on the verification requirement.
2FA makes this useless anyway (Score:2)
Most E-mail providers including Gmail are doing 2FA now, so even if Facebook gets your password they can't log into your account without the two-factor code.
Unless they were asking for this code too in which case they should all be set on fire.
Cold Leftovers (Score:2)
from April Fool's Day?
facebook is evil (Score:5, Informative)
It is because of stupid and ridicules actions such as this is the reason I refuse to have a facebook account. you just cannot trust them.
Comment removed (Score:5, Funny)
becoming the norm, sadly (Score:5, Informative)
"beyond sketchy" is putting it very mildly.
This is the behaviour of scammers, period.
Nobody should ever need my password to any account on any other site. Ever. Period, end of discussion. Everyone who asks for it is trying to pull a fast one or is so much beyond stupid that it amounts to the same thing.
Sadly, they aren't the first. There's a service over here in Europe where you can pay online at any website with a bank transaction even if you don't have a credit card (for you Americans: There are people older than 3 years that don't have a credit card in Europe, believe it or not). All they need is your bank number and PIN.
How anyone would give a 3rd party service the login details to their bank account is completely beyond me, but apparently people do because the service is still operational.
Far from what we should be teaching users, we teach them all the wrong things, and then complain that they're stupid. They're not. They just get stupid messages from people who should know better.
Re: (Score:3)
How anyone would give a 3rd party service the login details to their bank account is completely beyond me
Practically every bank, retirement account service, or online budgeting tool I've seen allows you to link your (other) bank account(s)...by providing your username and password to that other bank/service. The premise being sold to the customer is that each one wants to be the one-stop shop where you can do all of your banking/planning, so each ones wants to display all of your financial data in one place. Of course, I'm sure they also love knowing who's out-competing them for your business, how much money p
Re: (Score:2)
I've used professional accounting software that allows a direct connection to the bank account to conduct transactions directly from you pressing the "pay this bill" button.
It used a specific API with an API key and 2FA.
I stand by my argument. Anyone who gives full access to their bank account to a 3rd party is a total idiot who deserves to have his account cleaned out.
Re: (Score:2)
Oh, I wasn't disagreeing with you. I was just sharing my own experience with seeing that sort of behavior being the norm, rather than being atypical. I quite agree that it doesn't mean it's right or a good idea.
Re: (Score:2)
Where in Europe is that? The major banks in the Netherlands require 2FA for transactions.
Simplify this (Score:5, Informative)
...you're better off not being on Facebook.
Note that this clause works well even without any qualifiers.
Re: (Score:2)
...you're better off not being on Facebook.
Note that this clause works well even without any qualifiers.
My account was locked a few years back because of some Chinese hacking attempts. I declined to send them a picture of my drivers license and haven't had any reason to change my mind since. Never put anything up on fb, so they can keep storing the account with my name and e-mail address (which already was on the internet with my resume at one point) for as long as they like.
You know how IT looks at users? (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Just buy them from Google (Score:2)
Nothing new (Score:2)
No F'in way. The alternative then, as it is now is to reply to the verification email.
It's taken people this long to notice this stupidity?
Re: (Score:3)
Also, tons of "social networking" sites ask for your email password, and have done so for decades. To "conveniently scan for your friends". It also spams said friends and compromises your email permanently.
Anyone giving their email password over to a third party is a moron.
Are we sure this is really from Facebook? (Score:2)
The article didn't say one way or the other, but are we really sure this is from Facebook?
It is indeed beyond sketchy for a service to ask for password from any other service - even though we are talking about Facebook here I find it hard to believe they actually asked for this. I was thinking the popup could have been from some rogue ad or other malware.
Re: (Score:2)
Email Verification (Score:5, Insightful)
What happened to just sending a verification code to the email to verify that you have access to it? I would never give a password to a 3rd party. And to iterate, I would never give my password to any employee of my email provider either.
Re: (Score:2)
This.
And to a throw-away email account.
How many use the same password? (Score:2)
How many of these people use the same password for Facebook and their Email anyhow?
I drew the line (Score:5, Insightful)
When Facebook demanded legal proof of my name.
They locked me out of my account.
That was years ago, and I don't regret refusing disclosure.
Easier to apologize after the fact ... (Score:2)
It's time. (Score:3, Informative)
Re: (Score:3)
It's time for Facebook to be eliminated. Burn it to the ground. Every hard drive, every SSD, every backup tape. Drop Zuckerberg into an oubliette. Enough is enough.
We should also eliminate drugs, alcohol, tobacco, gambling, and a lot of other things that are risky and ruin lives. The problem is that people want these things and are willing to accept the risks involved (perhaps unknowingly accept the risks, but still accept nonetheless.) Facebook really isn't any different.
Re: (Score:2)
Re: (Score:2)
With the difference that I am not affected when you're using heroin. Try that with Facebook's shadow profiles.
Re: (Score:2)
I'm tempted (Score:2)
I'm tempted to change my pw to "GoFuckYourself", give it to FB, then change back to my real pw.
Re: (Score:2)
PW "FuckTheZuck"
How did they guess that?
Facebook? (Score:2)
People are still using Facebook? Why? What value add does this platform offer to my life? I can think of a number of reasons not to use it, and this is just another one.
Facebook lost it's way a long time ago.
Re: (Score:2)
Forums about stuff I'm interested in.
Being connected with my martial art community. And no: mailing groups won't do it.
No idea about the FB hate, it is a tool. Use it, or don't use it. Up to you.
Not the real reason (Score:2)
Confirming your email address isn't the real reason they do this. Facebook mines the metadata from the headers of all your emails to see who you communicate with and how often. LinkedIn does this too, adding people to your timeline that are not connected to you, but listed as "Your contact, so and so...". I get these in my stream from LinkedIn because OTHER people who I have communicated with in the past, for mundane reasons, gave LinkedIn their email account and password...usually it's real estate agent
TFS has far too many words. (Score:2)
... you're better off not being on Facebook ...
Of all the many words the summary quoted from TFA, these seven are the only ones that really needed saying; and they sure as hell didn't need to be said here.
The only winning move (Score:2)
Is not to play.
Facebook is a criminal identity theft cartel.
The proverbial "fixed that for you" (Score:2)
... "<strike>If that's what's required to sign up with Facebook,</strike> you're better off not being on Facebook." ...
(Apparently, Slashdot markup purges actual strike-through markup.)
An amusing twist (Score:2)
Usually it's the company you work for or are interviewing to work for that demands your Social Media account info.
Hilarious that your Social Media Accounts are now demanding access to other account info as well :D
Reading comprehension anyone? (Score:3, Informative)
Which is why I keep my hotmail account (Score:2)
Fake News (Score:2)
They aren't demanding it. They're asking for it as a convenient option for morons.
If you accept, they take your creds, log in, and you're Facebook account is activated / email validated. Then Facebook violates your shit behind your back.
If you decline, you get the email, click the link, and you're Facebook account is activated / email validated. Then Facebook violates your shit behind your back, but presumably not your email account.
Re: (Score:2)
Damn it. Those "you're"s should be "yore"s, obviously.
History teaches... (Score:2)
Re: what about 2FA? (Score:3)
Google had bypasses for 2fa for companies.
I have 2fa setup and recently aithoriZed a third party to access my Google photo albums.
Did this on purpose so I can dymaically update my digital photo frames. However that company now has a unique password only.
Facebook also can get such access until you revoke it in Google.
Re: (Score:3)
Bingo. This can't be real. The fact that Facebook is bad enough for people to believe it (even momentarily) says plenty - about Facebook and about our own susceptibility to paranoid fantasies - even if this was just meant as a joke.
Re: (Score:2)
Not sure what you're on about. Facebook will literally demand a scan of your drivers license and lock you out if you don't provide one. I've seen it myself. Once you balk and walk away they'll fold in a week or two and stop asking, like some one who just said they'd end the relationship if you didn't do anal.
They're asking because some people will give it to them. Hell, maybe even most people will give it to them.
nope, April 2 (Score:2)
The byline of the article: Kevin Poulsen 04.02.19 7:22 PM ET.
Re: (Score:2)
*whoosh*