3 ms·
They say: > We aren't aware of any suspicious login activity on your account So they admit they don't think anything is going on, even. Facebook is just punis
by tokenizerrr 10y ago
They say:
> We aren't aware of any suspicious login activity on your account
So they admit they don't think anything is going on, even. Facebook is just punishing the author because they committed the sin of password reuse. And the punishment for password reuse is apparently demanding ID before allowing the author to do anything with the account that belongs to them. Even though they control the email address associated with the account.
- crottypeter 10y agoThey aren't aware of suspicious activity because they think OP reactivated his own account!
- tokenizerrr 10y agoSo supposedly OP was allowed to reactivate the account without any hassle at all, but then to actually sign in ID has to be shown? That is even more ridiculous since that just leaves the account in a limbo state for no reason at all. Should have asked for ID prior to reactivating if going down that road.
- lazyjones 10y ago> So supposedly OP was allowed to reactivate the account without any hassle at all, but then to actually sign in ID has to be shown? That is even more ridiculous Try to think about it without all that negative mindset. Someone quite obviously obtained the (careless) author's password from a leaked user database of another site. They used it to log on to FB and reactivate the account. That isn't suspicious, because the last login IP address FB had is 5+ years old and having a different one now is not unlikely. Then, the author logged on with his IP address - which was suspicious to FB, because they thought the legitimate owner of the account had recently logged on using a different IP address (perhaps even from a different country). In addition, it took him several attempts to get the password right. Therefore, they demanded some ID.
- crottypeter 10y agoAnd yet GP suggests facebook should frustrate returning customers who log in first time with the correct password.
- tokenizerrr 10y agoSo their automated systems detected malicious access as legitimate access, and legitimate access as malicious access? And this is somehow working as intended?
- crottypeter 10y agoI'm not sure what you are suggesting facebook should do. They can't very well just assume all attackers will set the evil-bit now can they? https://en.wikipedia.org/wiki/Evil_bit https://en.wikipedia.org/wiki/Evil_bit The automated system has done "the right thing" and fallen back to manual verification when it detected suspicious activity. They can't request id for every activation or reactivation.
- tokenizerrr 10y agoThey assume their automated system can catch evil users in the act. It couldn't. It failed it's job and let the attacker do what they wanted while preventing the legitimate user from controlling their account. So the automated system did more harm than good. It should either be overhauled or disabled.
- crottypeter 10y ago> They assume their automated system can catch evil users in the act. Where do they assume that?
- tokenizerrr 10y agoThe system exists. If it can't do that, it has no purpose.