5 ms·
I would suspect a similar circumstance for the author's situation. Facebook does do some weird things to try to resume user engagement, but I've not really seen
by csydas 10y ago
I would suspect a similar circumstance for the author's situation. Facebook does do some weird things to try to resume user engagement, but I've not really seen them re-active accounts on their own. More than likely it was password reuse resulting in a breach.
The Author even considered that the password was checked by some automation against sites like haveibeenpwned, which makes sense to me to some degree for Facebook to be actively checking against, but they seem to dismiss this in favor of a spying option.
I agree that having to submit a government issued ID seems a little incredulous for being able to deactivate the account, but as others have suggested, I'm not really sure how else the author can prove they are who they say they are. It seems that any such approach would be equally egregious to the public eye (i.e., anyone can make a fuss and shut down a facebook account), but certainly there must be some middleground, such as multiple authentications.
A lot of the sanity checks used by companies are pretty unreasonable for most users to remember or pass - Microsoft and Skype, for example, have basically locked me out of my main skype account; their recovery challenge was to name the exact account names of 6 of my contacts as well as the the last two group chats I had been a part of. Since I hadn't used the account in about 2 years, this was really difficult for me, and the account names were even more difficult since people were using handles instead of real names, so the exact formatting was all but forgotten.
Riot Games Inc. had similar methods, asking "what was the first skin you were gifted and who gifted it?" when my friend was trying to recover their hacked account. That was stuff that had occurred years ago, and we had no idea who gifted what and when.
Again, I don't really pretend to have a good solution for these scenarios, but such solutions seem like they're just obstacles for the actual owner instead of neerdowells that overtake accounts.
- tokenizerrr 10y agoThe author clearly has access to the email account associated with the account. I don't see why they demand identification when they can just send a verification email, like literally every other website. What facebook is doing would make sense for a bank. They're not a bank. I know they think they are super duper important, but they're just another website that has no business demanding anyone's ID. Can you imagine the chaos once they get hacked and their ID database leaks?
- crottypeter 10y agoFor many third-party websites your facebook account is your identity, i.e. they are super duper important.
- csydas 10y agoThis is primarily why I'm a little torn about the "just send an auth" - Facebook, whether we like it or not, has wedged itself into a huge number of websites far beyond just the facebook domain. Surrendering control of a facebook account doesn't just let you mess with someone's social profile, it's potentially access to store accounts and much more. Whether or not people should be doing this is sort of irrelevant as the damage is already done and the situation is already entangled in Facebook's federated login.
- tokenizerrr 10y agoWhich in turn is just delegated to an email address + password combination. If the user controls that email, they obviously should control the facebook account, and everything else connected to it.
- Sir_Substance 10y ago>For many third-party websites your facebook account is your identity, i.e. they are super duper important. Correction, for many third party websites a facebook account is /an/ identity. If you closed your facebook account, what are the odds you're going to be using it as your openID login all over the place? Probably none.
- crottypeter 10y agoI think you underestimate the human ability to forget. Lots of people will decide to close their facebook account without thinking through the consequences (like that they used it to authenticate a dozen places).
- nommm-nommm 10y agoWhen I was 20 I'd tend to agree with you. Now well into my 30s I don't. I don't remember a ton of stuff anymore you think I would, including signing up for services. Plus you have to trust the user thinks everything through and associates "I don't want Facebook anymore for its primary purpose" with "I use Facebook for other things too."