20 ms·
Facebook Asking for Some New Users' Email Passwords
- raverbashing 8y agoCongratulations, Zuckerberg just beat Gates in complete lack of Ethical behaviour
- SmellyGeekBoy 8y agoJust?
- samtrack2019 8y agoThe sad story of people is that they give their email password to everyone who are asking, I keep telling my friends that please don't tell me your password and just type it but they keep laughing at me i.e: stop it! you and your crazy tin hat. it's the sad reality really.
- missingcolours 8y agoTitle seems misleading. Per the article it seems they demand email confirmation, but merely offer to access your email for you in order to accomplish that. (This is not a defense of Facebook's actions here)
- dang 8y agoOk, we'll s/demanding/asking for/ above.
- realusername 8y agoYeah and they surely won't use those passwords for anything else, like the phone numbers which they promised would be used for 2FA only.
- ardy42 8y ago> Per the article it seems they demand email confirmation, but merely offer to access your email for you in order to accomplish that. It's definitely a dark pattern though. And Facebook rarely seems content to only use data for the purpose they advertise when asking for it. For instance, there was an article recently that proved they were using phone numbers collected for 2FA to do ad-targeting as well.
- sb057 8y agoPer the tweets they reported on, there was no alternative. You either have to give Facebook your email password, or you don't get an account.
- j16sdiz 8y agoNo, that was an excuse. They use that to pull your contact list.
- kevin_thibedeau 8y agoI had someone create a Facebook account with my email once. I let it persist for a year until I got tired of the friend request notices. Did a password reset and deleted the account.
- procinct 8y agoDid you verify the email for them?
- Marsymars 8y agoI'm not sure how rigorous email verification workflows are in general. I had someone manage to transfer their Apple account to one of my emails a few years ago.
- kevin_thibedeau 8y agoNo. It was never verified. Facebook didn't care.
- nullc 8y agoHow did you get through the time limited "name the tagged friends" authentication?
- 908087 8y agoThis must be part of Zuckerberg's new pro-privacy makeover. Maybe they can also scan users' e-mails for "suicidal ideation" and have their swatting algorithm send in the police to "protect" them.
- headsoup 8y agoIt is perhaps the way you've presented the argument that is generating downvotes, but I fail to see how this is outside the realm of Facebook's pursuits given past behaviour and current activity. Or is it that people would support this use because of a 'noble intention?' (ends justify means)
- dylan604 8y agoWould Facebook then start making calls to the police for welfare checks when a user stops using Facebook without closing their account? Surely, something must have happened to the user if they stopped logging in frequently. After all, users don't just stop using the service.
- packetslave 8y agohttps://www.axios.com/facebook-will-stop-asking-new-users-for-their-email-passwords--355c2e94-793f-47b7-a582-9ee0a4f01ae3.html https://www.axios.com/facebook-will-stop-asking-new-users-fo... Facebook told Axios that "a very small group of people have the option of entering their email password to verify their account when they sign up for Facebook," but noted that people could choose instead to confirm their account with a code or link sent to their phone or email. "That said, we understand the password verification option isn't the best way to go about this, so we are going to stop offering it,” the company said in a statement. Those being asked for their e-mail passwords were users who listed an e-mail address that doesn't use the secure OAuth protocol, which allows users to verify their identity to a third party without sharing their passwords.
- dragonsngoblins 8y agoAnd so what if they are going to stop? Why were they offering it in the first place? It is such an obviously terrible idea
- jammygit 8y ago'move fast and break things' ?
- lostlogin 8y agoWhat’s the phase after you’ve moved fast and broken the things?
- Kliment 8y ago"fuck you, I got what I wanted"
- helloindia 8y agoDone is better than perfect.
- 8y ago
- ma2rten 8y agoIn the old days didn't lots of people give their email passwords to Facebook, so that it can scan their contact and invite everyone to Facebook?
- bArray 8y agoNot sure about them previously asking for email passwords, but there are many email APIs that can give permissions access to your contacts [0]. I don't doubt that in the older days of Facebook they were probably achieving this using some shadier methods. But worse than this, just by installing the Facebook App it liberally takes contact details from your device [1]. I personally use mbasic.facebook.com as it can run without JS and only updates when you refresh the browser. facebook.com refuses to run without JS and causes my browser to use tonnes of resources when JS is enabled. (P.S. Like many, I can't completely abandon Facebook just yet as lots of older friends and family are "unable" to migrate to other platforms.) [0] https://developers.google.com/contacts/v3/ https://developers.google.com/contacts/v3/ [1] http://www.androidbeat.com/2018/03/facebooks-android-stealing-contacts-call-logs-sms-data-years/ http://www.androidbeat.com/2018/03/facebooks-android-stealin...
- tomc1985 8y agoEven if Facebook didn't, I'm pretty sure LinkedIn did
- jaimehrubiks 8y agoI didn't know about mbasic facebook, it is awesome! Thank you. It even works the chat without needing to put the phone in desktop mode.
- murat124 8y agoPeople changed their email passwords many times since then, time to update the db.
- wodenokoto 8y agoYes. Linkedin was quite agressive about it back in the days.
- just_a_dev 8y agoI dont know why anyone with any commonsense still uses Facebook, Instagram or Twitter. They're completely uncontrolled nonsense that I wouldn't trust with my email address. Let alone my phone number. Call me crazy or socially inept, but I value privacy.
- wybiral 8y agoI value privacy as well, but I use Twitter for public things. To me it's not much different than having a public blog that data companies could scrape and store. Facebook and Instagram feel different to me just because people tend to use them in more personal ways. But, again, if you plan to make the data public anywhere it can always be gobbled up by spiders and three-letter agencies.
- wrboyce 8y agoAs much as I dislike what Instagram “is”, it is pretty much the best platform for (non-public) photo sharing. If there was something better, I’d use it, but there is not.
- just_a_dev 8y agoMaybe I'm jaded, but I only share photos of my life via text or even sd card. No one needs to see my life, besides it's kinda boring. Even if my boring life means I shouldn't be worried about it being exposed, I dont want that out there. I dont know maybe I'm just weird hahah.
- tomc1985 8y agoAmateur photographer here, Instagram is invaluable. Post only what you want the world to see, and so on...
- aphextron 8y agoAre you an amateur photographer? Or are you someone who posts images to a social media website for a dopamine hit? Perhaps there’s a value to gatekeeping. It can make us actually put effort and consideration into things. Modern web services like Instagram have allowed human fantasies to run wild, completely detached from reality. If you truly cared about your art and wanted it to be seen, you would devote yourself to that and work on getting into a gallery, or set up your own website. Instead you retreat to a fantasy world of online likes where you feel legitimized as an artist with zero real effort, and zero care or true appreciation on the audience’s part.
- Causality1 8y agoFacebook has never faced significant financial consequences for its misdeeds. You can be assured it will continue to hold its users privacy and security as distant second place priorities to how much money it can make off them. If you want a company not to be evil you have to make being evil more expensive than being good. Nobody is willing to do that so the shit-show will continue for the foreseeable future.
- hn_throwaway_99 8y agoAll of these types of "hey, give us your password to this other system" are just training users to get phished. IMO the worst offender in this is Plaid, which has created a service where millions of people are giving their banking credentials so some random startup can mine your transaction data. And people think FB has privacy implications...
- slouch 8y agoThat's exactly how mint.com works, owned by Intuit/QuickBooks.
- inferiorhuman 8y agoYeah back when ING still had a retail presence in the US they were notorious for not working well with Mint… because they required a mint specific access key and not your master credentials.
- hn_throwaway_99 8y agoYeah, but the difference (at least I think so, as I'm not a mint user) is that Plaid is building an API for other startups to use. It's somewhat amazing to me how little is needed for folks to gleefully hand over their bank passwords to anyone who asks for it.
- nemothekid 8y agoMint legitmatized that authorization flow years before Plaid came around and the banks decided that was the best way to move forward instead of adopting something like an oauth2 flow.
- VoiceOfWisdom 8y agoI remember Quicken doing it back in the early 2000s.
- anoncake 8y ago
- joering2 8y agoHonest question - is it the time for a new social network already??
- sb057 8y agoYeah, I'm starting to think that Google+ could really pick up new users if th-oh wait... right...
- creato 8y agoGoogle recognized that social networks are a liability and not an asset.
- strictnein 8y agoYoutube is a social network with lots of videos. Only somewhat joking.
- kabes 8y agoWonder if they would have recognized it if google+ was successful.
- baroffoos 8y agoThere already are new social networks. Why aren't you using them?
- UweSchmidt 8y agoNetwork effects keep people in place. Switching social networks would need a bit of a movement, which OP maybe wanted to low-key initiate? The next social network would also have to provide the simplicity, performance and features people expect, while showing real, understandable improvements in terms of privacy or the economic model (e.g. no risk being bought by Facebook like WhatsApp). In general, 'new social networks' seem rarely discussed, here in HN or elsewhere; can you maybe name a few of the options you have in mind?
- fattire 8y agoCould someone please set up a honeypot IMAP server to detect illegal Facebook logins?
- kyle-rb 8y agoI just don't understand how this gets implemented without someone speaking up and saying "hey, wait, isn't this an insane thing to do?". I would guess it's some combination of the complainers being ignored, and people at a higher level thinking "well we're doing this in a secure way, as long as the user trusts us, and why wouldn't they trust us, we're Facebook!".
- AndyMcConachie 8y agoMove fast and break things!
- tinus_hn 8y agoPreferably other peoples things!
- leCapitalist 8y agoEasy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this. The lowly L3 engineer fresh out of college understands how crazy this is and speaks up, but is hammered down by the culture. The decision is quite literally above their pay grade. They begrudgingly fall in line as they have the most to lose in this situation. Finally a story like this breaks and upper management realizes the contradiction with the narrative that they're trying to create - that Facebook really does care about your privacy. The whole project gets scrapped, and by the time it's all said and done, over $1M is wasted. Welcome to life at a big tech company.
- starbugs 8y agoYour summary hits the nail on the head. But you forgot the most important thing: What happens once upper management reads an article like this and realizes they f*cked up badly again? Yes, more of the same hierarchy, compensation, promotions, and "culture". Welcome to "efficient" big corporate hierarchies.
- thefounder 8y agoThey did it before and to be fair Facebook knows better what they are doing. People are generally "ignorant" and don't care so why not?
- danielscrubs 8y agoI noticed that when I was dating around it was extremely important that they could find my Facebook profile if I said I don't use Facebook much they would immediately respond with scepticism. For that purpose alone I kept it. And they have a point, it's easy to find out if someone is single or not via Facebook, and you are bound by your friends to be truthful. I'm not single anymore, but I'm still curious, in those countries where everyone is not sleeping around with everyone what would replace Facebook?
- mike00632 8y ago>... everyone is not sleeping around with everyone... wat?
- atulvi 8y ago> countries where everyone is sleeping around with everyone I want to know where these are
- orbifold 8y agoFrance obviously:)
- huxflux 8y agoSo I kept it, why would you? go against the stream.
- TeMPOraL 8y ago> it's easy to find out if someone is single or not via Facebook That was many, many years ago. Ever since, they've been tightening up privacy defaults, and now when checking out that person you met, the best you'll get is a profile picture and a list of mutual friends. Everything else tends to be locked down by default for non-friends, and Facebook keeps regularly reminding people posting widely that they could tighten their posting range. Whether that's a good or bad evolution depends on one's use cases and the views on whether being able to do little background checks on other people is OK or not.
- qwerty456127 8y agoWTF
- wodenokoto 8y agoHey, this is like 10 years ago, when both facebook and linkedin were pestering you to give them your e-mail password, so they could import all your contacts. We really haven't moved forward at all!
- deanclatworthy 8y agoWhat am I missing here? I have to type my password when I log in to Facebook. They are probably storing a hash of each of the users passwords (after changes) and then comparing against index[0]?
- tragic 8y agoThey're asking for the password to your email account, not your Facebook account.
- deanclatworthy 8y agoSo what are they doing with that? How can they verify it? Are they actually logging into your email account with that? Surely (BigCompany) measures would prevent that?
- icebraining 8y ago> So what are they doing with that? How can they verify it? Are they actually logging into your email account with that? Well, of course. > Surely (BigCompany) measures would prevent that? What do you mean?
- yosamino 8y agoThey send you a confirmation email, and then, instead of you logging into your emailaccount and clicking the verification link, they ask your emailacount password and log into your emailaccount for you and click the verification link for you.
- subbz 8y agoLate april fools?
- emilsedgh 8y agoI think Facebook is very desperate and they don't seem to have a choice. You see, Facebook has Facebook.com, Instagram and Whatsapp. Facebook.com has already reached it's peak and is not going to grow. Instagram is likely to have the same trajectory as Facebook.com and Whatsapp is not making them money anyways. They failed to get into any new market or come up with any decent product. And they are supposed to compete with Google, which is competing on all fronts with extremely competitive offerings. * Google Search * Gmail * Android * Youtube * Chrome * Chrome OS * Google Drive * Google Analytics * Google Docs * Google Cloud * Google Apps * Google Maps And they seem to be constantly trying new things (Stadia seems to have a really good chance to compete with PS and Xbox and get them a holding in gaming) And Facebook keeps pushing out pathetic moves like this and all their acquisitions that were supposed to help them get into new markets and sectors (Oculus, Parse, etc) seem like failures. Acquisition of Instagram bought them another 10-15 years and they should be just very lucky to keep making the right call and buy the next Instagram)
- passalong2019 8y ago> extremely competitive offerings Chrome OS Have you followed news recently? It's dead.
- threeseed 8y agoYou can't possibly be serious. Google continues to make the majority of their money from advertising. And since those early days they have not released a single product which has helped to diversify their revenue stream. But they've had plenty of failures along the way. Facebook is far more interesting in terms of diversification. Payments via Messenger/WhatsApp is going to be great for them and is already doing well. Spilling over into web services e.g. Dating is equally looking promising. And they've done okay in the enterprise space with Workspace. Fact is that it's far harder to switch social graphs than it is to switch search engines.
- 26a2o4 8y ago>Facebook is demanding some users fork over the password for their outside email account as the price of admission to the social network What a dishonest article. Facebook is not demanding users to give them the password to their email to be able to use the network. Instead, it looks like they are giving the option of doing so to verify the email address, but you can still go the traditional route of verifying your email by clicking a link.
- thinkingemote 8y agoInteresting take. The article says what happens it doesn't hide the process. The user is presented with a dialog box asking for their external email password and the article states that the user by clicking the small "need help?" Link in the corner can ask for other traditional methods. Nothing dishonest in the article.
- werbel 8y ago>Those options are presented to users who click on the words “Need help?” in one corner of the page. Hiding something under completely unrelated link is not presenting your options in any way which is remotely close to being honest.
- skilled 8y agoJust when you think these idiots couldn't come up with any more dumb shit.
- fimdomeio 8y agoThe question here rather than why are you asking for mail passwords is what is facebook doing with the passwords? All possible answers seem creepy as hell.
- auslander 8y agoLinkedin asks you to do the same at every page.
- icebraining 8y agoI never gave mine, and haven't seen that in years. Not that I think they're a decent company.
- fareesh 8y agoHow is this even implemented safely? The passwords have to be forwarded over to the email provider, so they are flying around log files, unsafe in the database. There's actually a programmer somewhere who can read all of them and put them in a text file and take them home.
- icebraining 8y agoIn theory, the password doesn't have to be stored at all. I bet it's kept in some sort of job queue, so it might be stored in disk (e.g. Redis AOF), but even that could be avoided. Still, one has to wonder why do it at all, considering the simple alternative of sending a verification email, which was already implemented.
- fareesh 8y agoIsn't the motive to get the user's contact lists? If there's an error isn't there a chance that the password leaks out into an error log somewhere?
- icebraining 8y ago> Isn't the motive to get the user's contact lists? Probably, yeah. > If there's an error isn't there a chance that the password leaks out into an error log somewhere? Sure; there are ways of avoiding that, but who knows what they did.
- speeq 8y agoOh, did they stop asking for nudes yet? https://www.bbc.com/news/newsbeat-44223809 https://www.bbc.com/news/newsbeat-44223809
- giancarlostoro 8y agoI'm starting to miss MySpace.
- slics 8y agoIt’s interesting to note, that in order for a feature or capability to be implemented, it has to provide value to the end user. So at the planing phase of this feature, didn’t anyone in their right mind thought that this was a bad idea. Given the current situation that Facebook (Fakebook) is in with security missteps why even invest time and money just to hope that users (at least the ones that are concerned) won’t complain. Hope it’s not a strategy.
- jrockway 8y agoI wonder what Facebook would do if I created a site that "verifies your identity" by having the user type in their Facebook password. It just seems like an unwritten rule that sites are not to ask users for other sites' passwords. It's basically phishing.
- jobigoud 8y agoI think there are many services for social media that ask for your account password so they can post in your name on Instagram or Twitter when you post a Youtube video or whatnot. Not to mention the shadier services that do the follow-unfollow dance.
- jaimex2 8y agoWhat hypocrites. They certainly don't like it when you do it to them. https://www.gizmodo.com.au/2018/08/facebook-wanted-us-to-kill-this-investigative-tool/ https://www.gizmodo.com.au/2018/08/facebook-wanted-us-to-kil...
- u801e 8y agoOn a somewhat related note, I recently added an external bank account to my E-trade account. They gave me two options for verifying it. The first was to make a small deposit into the external account (which they said would take several days to complete). The second option was to provide my bank account's credentials and they could verify it immediately. I chose the first option.
- nathan_long 8y agoVerifying a user's email by collecting their password is ineffective for users with 2FA enabled and reckless/malicious for those (the majority) without it. Accidentally log that data somewhere, and you've opened a way for attackers to take over your users bank accounts, social media, and pretty much every other online account, as they all rely on email verification. If we had privacy laws with teeth, somebody at FB would be calculating how many millions in liability each piece of data collected represents. This one would be astronomical and an automatic "no" by those calculations.
- MagicPropmaker 8y agoI don't understand how they can login for you on any of the popular email providers. Gmail, for example, detects a new computer by cookie and "fingerprint" (ip address, browser, UA, etc). You then get 2fa'd or at least "robot checked". How did they make this a smooth experience?
- jobigoud 8y agoOn accounts with 2FA not activated I just get an email on my backup account that a new computer has logged in.
- javagram 8y agoAccording to the article it was only offered to a subset of providers that don’t have OAuth APIs. Presumably google and other high security email providers got the OAuth option and this more insecure option was offered to users with ESPs that don’t have the gmail security features you mentioned.
- aqibgatoo 8y agoFacebook is cancer
- sarashawqy1 8y agowhy
- megous 8y agoI don't get the outrage. No comment mentions this, but most non-tech people already give Facebook their e-mail password. All Facebook needs to do is try to use it. Lookup the password re-use rates among users of the Internet. People may have weak and strong password for less and more important services. Guess how would they rate the Facebook...
- jayalpha 8y agoHey, this is great news. This is like linkedin. Who does not appreciate this never ending stream and connection invites to non Linkedin users?
- christkv 8y agoAll corporations are fundamentally feudal systems. At a big enough scale they all become some twisted form of the Franz Kafka novel The Castle.
- yalogin 8y agoDoesn’t a lot of the social networks do this? Linkedin used to ask for email password all the time at one point, don’t know if they still do. Mint and others want passwords to bank accounts. I know we are a bit more sensitive I e about privacy but the general population is still not. I can understand Facebook needs to be extra cautious now but I guess they don’t care.
- GistNoesis 8y agoHow did they make it work? Even given the passwords, how would they check robustly without tripping the email "unusual connection from IP x.x.x.x". Even if they have a few IP to make the checks, the mail server may notice that one IP is connecting to thousands of accounts.
- alex_young 8y agoSome habits are hard to get over I guess. Remember when Mark Zuckerberg (allegedly) used FB data to hack into the email accounts of journalists reporting on him? [0] Why trust him now? [0] https://www.businessinsider.com/how-mark-zuckerberg-hacked-into-the-harvard-crimson-2010-3?r=US&IR=T https://www.businessinsider.com/how-mark-zuckerberg-hacked-i...
- ubermonkey 8y agoIt remains true that no one should ever ask for your password. Simply asking for my password is enough to make me distrust you forever.
- hgasimov 8y agoThe answer is simple. They don't care about moral side of their actions and government doesn't want to take any serious action about that. I would be surprised if they stopped doing so.
- dmitryminkovsky 8y agoDoesn’t this ask the user to violate the terms of service of their own email platforms, assuming most email providers prohibit you from sharing passwords?
- deleted 8y ago[deleted]
- lostmyoldone 8y agoAlmost certainly.
- deleted 8y ago[deleted]
- js2 8y agoI recently learned that when you connect your Paypal account to your checking account, there's two verification methods you can choose between: 1) the good old fashioned, we'll make two small deposits into your account, tell us what they are; and 2) just give us the login info for your bank's web site. But Mint works the same way, doesn't it?
- andrewstuart2 8y agoThe primary difference being that I go to Mint/Quickbooks/etc. expecting them to provide services that require access to my personal financial data. Facebook already has a messenger, so they definitely don't need access to my emails.
- 0xffff2 8y agoI believe most if not all legitimate companies that ask for your banking credentials (besides your bank, obviously) are just passing them straight to https://plaid.com/ https://plaid.com/. It's still questionable whether you should trust Plaid with your banking credentials, but at least you probably don't need to trust that Paypal and Mint are both going to store your credentials securely.
- bpicolo 8y ago> but at least you probably don't need to trust that Paypal and Mint are both going to store your credentials securely. Sure you do. They have it in plaintext on their servers. It can end up in logs. It's also not just Plaid - Mint uses Intuit, Yodlee is an option. There's a whole lot of people you need to trust to use these services For many banks, it also means you need to disable 2fa on your banking account, so using these services directly weakens your security.
- saluki 8y agoWhy don't banks provide a read only api and login/password if this type of thing is becoming more common. Providing any company my banking or email account login password sounds like a really bad idea. And something I'm not willing to provide.
- 8y ago
- nnq 8y agoLast service that I remember asking me for the signup email password was ...wait for it ...MySpace! It was years ago, but it sounds a bit like a swan song pattern to my ears despite the lack of any rational connection... ...they should find a new WhatsApp or a Snapchat to buy ASAP because sooner or later they'll be too uncool for people to share the interesting content in their garden, so their humongous user base's value will start asymptoting to $0.
- philipov 8y agoWhat is a swan song pattern? Google thinks it's a quilting style.
- 3minus1 8y agojust look up swan song
- XalvinX 8y agoLed Zeppelin's label! I always loved that graphic they used.
- romwell 8y agoThey feel Facebook is about to pass on, so to speak. That Facebook will cease to be. That it will expire and go to meet its maker (as its last user). That it's about to be stiff, bereft of life, resting in peace. That if it hadn't been propped up by the network effect, it'd be pushing up the daisies. That Facebook is about to kick the bucket, to shuffle off its mortal coil, run down the curtain and join the bleedin' choir invisible. That Facebook will soon be an ex-social network.
- zelon88 8y ago> "...so we are going to stop offering it,” Facebook wrote. Stop patronizing us. Seriously, you look foolish and ignorant. Drop the marketing speak and own your screw-up.
- mithr 8y agoIf this is really for the purpose of email verification, I can't even begin to fathom what they were thinking. Asking for users' email credentials is terrible, but even requiring that they log in using OAuth is ridiculous! Verifying email addresses is a solved problem that doesn't require _any_ of that... you just send a time-sensitive, signed link containing a unique identifier to that email address, and users click it to verify their address. I really can't understand why they would choose to go a different way -- and particularly _this_ one.
- sleepybrett 8y agoJesus fucking christ facebook, read the goddamned room.
- Crontab 8y ago"They trust me — dumb fucks" ~ Mark Zuckerberg
- pass3hux 8y agohttps://goo.gl/images/nGTXAE https://goo.gl/images/nGTXAE
- PunksATawnyFill 8y agoNEVER force people to use an E-mail address as a user ID. Doing so is amateur-hour and straight-up STUPID: https://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...
- methodover 8y agoCredential stuffing is a huge problem. I am not sure if allowing users to use non-email addresses as a user-name helps solve that problem, though. I would be interested in reading research on the subject.
- XalvinX 8y agofuckerberg is up to his old tricks again...won't people ever get tired of this?