4 ms·
Since his Facebook account is clearly important to him, he shouldn't have reused a password that he shared with unimportant sites.
by averagewall 10y ago
Since his Facebook account is clearly important to him, he shouldn't have reused a password that he shared with unimportant sites.
- bcraven 10y agoNo I think you've missed the point, the _account_ is unimportant: "I do not want an account on Facebook. I have been happy to live without Facebook for the last 5 years." What is _important_ is the fact that it was activated without any user input, and can't be deactivated without handing over quite substantial trust.
- crottypeter 10y agoGP has not missed the point. The deactivated account should have been secured with a decent password (if the "lack-of-an-account" was important). It wasn't reactivated without any user input - or at least we can't possibly know that. We just don't know who the user was who did the reactivating.
- bigbugbag 10y agoDecent or not is irrelevant to the triggering of the breached credentials. You could have the best possible password ever, once you give it to a service that stores it plain text it's game over. The actual password issue here is password reuse and what should have been done is not having a facebook account in the first place. Is it even possible to get out of facebook once your data is in there ? The user being the account owner, we do know (provided we trust him) that it was not him so yes it was reactivated without any user input. From what I gather it could be that email/password was used on another service that got breached and either a bot or someone trying all those breached credentials on facebook caused the reactivation, or a relative that knew the user/pass or facebook trying to collect more personal data on old inactive accounts and inadvertently getting exposed once again.
- falsedan 10y agoPlease don't blame the user for this terribly-unfriendly UI flow.