6 ms·

https://www.axios.com/facebook-will-stop-asking-new-users-for-their-email-passwords--355c2e94-793f-47b7-a582-9ee0a4f01ae3.html https://www.axios.com/facebook-wi

https://www.axios.com/facebook-will-stop-asking-new-users-for-their-email-passwords--355c2e94-793f-47b7-a582-9ee0a4f01ae3.html https://www.axios.com/facebook-will-stop-asking-new-users-fo... Facebook told Axios that "a very small group of people have the option of entering their email password to verify their account when they sign up for Facebook," but noted that people could choose instead to confirm their account with a code or link sent to their phone or email. "That said, we understand the password verification option isn't the best way to go about this, so we are going to stop offering it,” the company said in a statement. Those being asked for their e-mail passwords were users who listed an e-mail address that doesn't use the secure OAuth protocol, which allows users to verify their identity to a third party without sharing their passwords.

dragonsngoblins 8y ago
And so what if they are going to stop? Why were they offering it in the first place? It is such an obviously terrible idea
- jammygit 8y ago
  'move fast and break things' ?
  - lostlogin 8y ago
    What’s the phase after you’ve moved fast and broken the things?
    - Kliment 8y ago
      "fuck you, I got what I wanted"
    - helloindia 8y ago
      Done is better than perfect.
      - iainmerrick 8y ago
        Shurely “broken is better than slow”?
    - LiquidFlux 8y ago
      Forgiveness is easier to ask for than permission?
    - DCoder 8y ago
      "It's your problem now!"
    - scottie_m 8y ago
      “It was a mistake, and we’re sorry.” Repeat in an infinite loop because the collective media and societal memory is similar to a concussed bee’s.
- HenrikB 8y ago
  They did something similar around 2010 when they (repeatadly) asked users to enter their email address and password "to see if any of your contacts are on Facebook so you can connect with them" with a "don't sorry, we won't save your password" note next to it. What they didn't say was that they pulled in all of the user's contacts and added also them to their "super graph".
dhimes 8y ago
They shouldn't need to log in to the user's password account at all through OAuth or any other way! A side problem with this is that if it's truly easier for the user than clicking on an emailed link, then users are going to expect that from all of us. So you have to do the sleazy shit or from the users' point of view you are "behind" and less good. I wish there was some good way to educate the user to privacy dangers. I mean, we could make an online workshop but would have to support it by advertising because we would have to reach the people who don't realize there even could be a problem. And the people willing to drop $5 on it are the ones who don't need to (classic problem in education).
- arrosenberg 8y ago
  Sounds like the perfect job for Public Service Announcements. I remember when those were a regular thing on TV.
reaperducer 8y ago
"That said, we understand the password verification option isn't the best way to go about this, so we are going to stop offering it, now that we've been caught." Facebook always leaves that part out of its responses to these problems.
- gowld 8y ago
  Caught? They offered the feature directly to users. It wasn't a secret.
  - ninju 8y ago
    Caught in terms being scolded for doing a insecure thing
  - romwell 8y ago
    >Caught? They offered the feature directly to users. Who didn't know any better, nor why it is bad in general and how it can harm them specifically. So yes, FB was caught; exposed, if you wish. Especially given that they didn't roll out this feature to everyone, including you and me, which would result in immediate disaster.
  - floatingatoll 8y ago
    It wasn’t announced on their News site, and when the press asked about it, their first on the record statement is ‘we’ve coincidentally reached the same conclusion at just this same time and will shut it down sometime’. I do not give Facebook the benefit of the doubt here, but coincidence is technically possible.
ballenf 8y ago
Would be really interesting if one of those non-OAuth email providers scoured their logs to find the Facebook "logins" and see what, if any, requests FB made against the server after successful authentication.

dragonsngoblins 8y ago

And so what if they are going to stop? Why were they offering it in the first place? It is such an obviously terrible idea

jammygit 8y ago
'move fast and break things' ?
- lostlogin 8y ago
  What’s the phase after you’ve moved fast and broken the things?
  - Kliment 8y ago
    "fuck you, I got what I wanted"
  - helloindia 8y ago
    Done is better than perfect.
    - iainmerrick 8y ago
      Shurely “broken is better than slow”?
  - LiquidFlux 8y ago
    Forgiveness is easier to ask for than permission?
  - DCoder 8y ago
    "It's your problem now!"
  - scottie_m 8y ago
    “It was a mistake, and we’re sorry.” Repeat in an infinite loop because the collective media and societal memory is similar to a concussed bee’s.
HenrikB 8y ago
They did something similar around 2010 when they (repeatadly) asked users to enter their email address and password "to see if any of your contacts are on Facebook so you can connect with them" with a "don't sorry, we won't save your password" note next to it. What they didn't say was that they pulled in all of the user's contacts and added also them to their "super graph".

dhimes 8y ago

They shouldn't need to log in to the user's password account at all through OAuth or any other way! A side problem with this is that if it's truly easier for the user than clicking on an emailed link, then users are going to expect that from all of us. So you have to do the sleazy shit or from the users' point of view you are "behind" and less good. I wish there was some good way to educate the user to privacy dangers. I mean, we could make an online workshop but would have to support it by advertising because we would have to reach the people who don't realize there even could be a problem. And the people willing to drop $5 on it are the ones who don't need to (classic problem in education).

arrosenberg 8y ago
Sounds like the perfect job for Public Service Announcements. I remember when those were a regular thing on TV.

reaperducer 8y ago

"That said, we understand the password verification option isn't the best way to go about this, so we are going to stop offering it, now that we've been caught." Facebook always leaves that part out of its responses to these problems.

gowld 8y ago
Caught? They offered the feature directly to users. It wasn't a secret.
- ninju 8y ago
  Caught in terms being scolded for doing a insecure thing
- romwell 8y ago
  >Caught? They offered the feature directly to users. Who didn't know any better, nor why it is bad in general and how it can harm them specifically. So yes, FB was caught; exposed, if you wish. Especially given that they didn't roll out this feature to everyone, including you and me, which would result in immediate disaster.
- floatingatoll 8y ago
  It wasn’t announced on their News site, and when the press asked about it, their first on the record statement is ‘we’ve coincidentally reached the same conclusion at just this same time and will shut it down sometime’. I do not give Facebook the benefit of the doubt here, but coincidence is technically possible.

ballenf 8y ago

Would be really interesting if one of those non-OAuth email providers scoured their logs to find the Facebook "logins" and see what, if any, requests FB made against the server after successful authentication.