5 ms·
> I am concerned that they knew that I used this password on several different sites. How did they know that? I suppose they keep an automated list of passwords
by mintplant 10y ago
> I am concerned that they knew that I used this password on several different sites. How did they know that? I suppose they keep an automated list of passwords that have been hacked on other sites, when those hacked passwords are made public? If so, that much is reasonable.
A clear demonstration of how users don't read error messages, as the screenshot that appears above this paragraph spells out the exact method the author suggests.
- sleepychu 10y agoand at the bottom of the page: > You can also try other challenges to confirm your identity.
- a3_nm 10y agoThe identity challenge does not matter: you shouldn't have to confirm your identity to protest against the reactivation of an account you intended to close. The point still stands: OP intended to close their account in 2012, and are now being signed up again without their consent.
- wodenokoto 10y agoOf course you should. Else anybody can close accounts that have been purposely reopened.
- llukas 10y agoNo. Instead of reopening account on a whim require id when account is being reopened.
- crottypeter 10y agoFrustrate returning customers ... not a great idea
- ForHackernews 10y agoYou should be able to actually delete an account, not just "deactivate" it.
- fritzw 10y agoYou can delete accounts, but the function is hidden and you have to search the help section to find it https://www.facebook.com/help/delete_account https://www.facebook.com/help/delete_account
- ForHackernews 10y agoGood tip!
- phs318u 10y agoHow ironic. I deactivated my account last year thinking it was the only option. I click on the link... to be asked to login to Facebook. :-|
- ballenf 10y agoYep, been down that road. You indeed have to reactivate your account in order to delete it. FB's approach here is a great example of a dark pattern. I've known several people who really want to kick the FB habit and deactivated their accounts. But when they accidentally reactivate, the temptation was too great to go back since everything was still there just how they left it. Evil genius right there.
- deleted 10y ago[deleted]
- tech2 10y agoYou're not the customer, you're the product.
- drusepth 10y ago
- cwyers 10y agoThey did require a form of identification -- the user's password. The user was careless, and so that password ended up being compromised. This is exactly the same as any other scenario where a user's password has been compromised -- they need to prove they're the legitimate user, not whoever has the compromised password.
- tjoff 10y agoAnd the only proper way to do that identification is to go through the registered mail.
- abritinthebay 10y agoGiven how many times I've had registered mail delivery screw up... no.
- tjoff 10y agoThere is NO WAY I'd EVER give facebook or any other random internet service any real identification (that includes phone number). Forcing someone to provide real identification for a service that didn't require it to sign up in the first place is just ludicrous. For all intents and purposes my email is the sole identification available for a service like facebook. Further, a passport picture isn't worth squat because there is nothing linking my email to it anyway (and a passport picture can easily be forged or copied).
- abritinthebay 10y agoThat's fair, but that wasn't really my point.
- tjoff 10y agoWell, what would be the alternative then?
- bardworx 10y agoThis happened to me recently, with Facebook. However, Facebook didn't reactivate my account, I was the one who mistakenly clicked on a link on Spotify when I reactivated my account which somehow triggered the reactivation. I'm going to guess that OP of article had a similar situation; Using another service, an errant click was made that triggered an event on Facebook.
- losteric 10y agoFacebook will do whatever they can to keep your account active. The shutdown process is a pure embodiment of dark patterns, and a single click reactivates the account. I remember shutting down my account and then recieving some emails a week later, clicked the link wondering why FB was still emailing me, boom account reactivated. Shut it down again, then a couple weeks later I clicked the wrong share link and once again my account was reactivated. If I was an investor or advertiser, I would be deeply suspicious of Facebook's metrics...
- monochromatic 10y agoNo, you absolutely should have to confirm your identity in this situation. Otherwise... well, imagine that I close my account and then decide to reopen it. ANYONE IN THE WORLD could block me from reopening it if FB doesn't require identification in the way you suggest.
- awinter-py 10y agoAlso possible that the user read & understood the message but didn't take it as proof of its claim. FB has a history of collecting cross-site passwords from failed logins.
- ccrush 10y agoI would like to know more about this. Do you have a source? I have suspected this for years.
- awinter-py 10y agohttp://www.businessinsider.com/how-mark-zuckerberg-hacked-into-the-harvard-crimson-2010-3 http://www.businessinsider.com/how-mark-zuckerberg-hacked-in...
- Zaephyr 10y agoFB's security people likely track and have copies of account/password dumps from site breeches. Sort of like Troy Hunt does with haveibeenpwned.com but for their own internal security measures.