3 ms·

This is not two factor authentication, this is merely trading one factor (your password) for another factor (your telephone). In proper two-factor authenticatio

by gcr 16y ago

This is not two factor authentication, this is merely trading one factor (your password) for another factor (your telephone). In proper two-factor authentication, you should be required to enter your real password into your phone and THEN get a one-time password back out (your telephone is a trusted device). My teenage friends trade phones all the time and they constantly nab them out of pockets, backs, purses, etc. for a few seconds. This change makes it trivially easy to steal someone's credentials.

tptacek 16y ago
Since they didn't call it two-factor authentication, it's not fair to whack them for not implementing two-factor authentication. It's "I'm at someone else's computer" authentication, and it's a fine idea. Within the next 2 years, most everyone's phone will already be logged in to Facebook, as smartphones become as cheap as iPods, mooting the latter concern. Regardless, if you can't safely use the feature, you'd be well advised not to use it.
- Groxx 16y ago
  I remember claims that, by now a couple years ago, cell phones would cost $10 and the batteries would last for weeks. My phone dies in 3 days if I have bluetooth on, and it cost $60 for the one-step-above-dirt phone after a 2 year contract got me a discount. Also, how many people do you think are "well advised" of safely using security features? Even simple ones? Who don't see Facebook as one gigantic privacy / security geyser? ie, non-security-aware-geek-types? This is a minor, arguable security improvement and a major feel-good for people who don't know any better, and not much else.
  - gcr 16y ago
    You say that most people don't understand security, and unfortunately, you're exactly right. So why do those who know better intentionally choose to make things /less/ secure but market it as /increasing/ security?
- gcr 16y ago
  I don't see how perpetuating the problem (every phone device is going to be insecurely logged in within the next 2 years) moots the concern. "Everyone does it!" is no excuse for a poor security model.

by gcr 16y ago

tptacek 16y ago

Since they didn't call it two-factor authentication, it's not fair to whack them for not implementing two-factor authentication. It's "I'm at someone else's computer" authentication, and it's a fine idea. Within the next 2 years, most everyone's phone will already be logged in to Facebook, as smartphones become as cheap as iPods, mooting the latter concern. Regardless, if you can't safely use the feature, you'd be well advised not to use it.

Groxx 16y ago
I remember claims that, by now a couple years ago, cell phones would cost $10 and the batteries would last for weeks. My phone dies in 3 days if I have bluetooth on, and it cost $60 for the one-step-above-dirt phone after a 2 year contract got me a discount. Also, how many people do you think are "well advised" of safely using security features? Even simple ones? Who don't see Facebook as one gigantic privacy / security geyser? ie, non-security-aware-geek-types? This is a minor, arguable security improvement and a major feel-good for people who don't know any better, and not much else.
- gcr 16y ago
  You say that most people don't understand security, and unfortunately, you're exactly right. So why do those who know better intentionally choose to make things /less/ secure but market it as /increasing/ security?
gcr 16y ago
I don't see how perpetuating the problem (every phone device is going to be insecurely logged in within the next 2 years) moots the concern. "Everyone does it!" is no excuse for a poor security model.