5 ms·

Facebook Roulette pits you against three friends, the loser's account is deleted

59 points by ssclafani 15y ago

dandelany 15y ago
Cute. But Facebook would never allow it. You think they have a delete_user_account() method in their developer API? ;)
- lsc 15y ago
  You can't delete a facebook account, as far as I can tell, but you can change the data, the email, and randomize the password, which is pretty similar. Seems to me like that's what they were talking about with the 'last words'
  - DTrejo 15y ago
    Can also make the account do spammy things or change to a fake name, which could speed the banning.
  - JeremyBanks 15y ago
    You have been able to actually delete an account for a while. It's described underneath deactivating on this page: https://www.facebook.com/help/?faq=13016 https://www.facebook.com/help/?faq=13016
    - lsc 15y ago
      "There was a problem reaching the FAQ you requested" I think you actually want http://www.facebook.com/help/?page=842 http://www.facebook.com/help/?page=842 and thanks, I didn't know about that. I'm going to go do that now; I 'deactivated' my account some time ago and facebook is still spamming me, and people are still trying to message me on facebook.
  - mkjones 15y ago
    I work on security at FB, and I suspect if someone actually tried this, they'd run into a fair amount of friction. A bunch of accounts logging in from a new place and immediately changing emails / passwords is pretty suspicious. Even if they did get into the loser's account, I think we offer pretty good tools for the account owner to reclaim it even if the password or email have been changed.
- deleted 15y ago
  [deleted]
- ktsmith 15y ago
  Says you have to hand over your password so I think that implies that they would be doing it directly via facebook and not the API.
  - rhizome 15y ago
    All four will lose. 4.8: "You will not share your password, (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account."
    - ktsmith 15y ago
      Much more importantly the least harmful thing to come from this would be FB account deletion. Chances are for most people that FB password is used somewhere else and more harm could come from it since everything an attacker needs to know about their victim is in their FB profile. I was going to mention that in my initial comment but it seemed obvious.
mkelly 15y ago
...Except it takes 30 days of no account activity to take effect.
stretchwithme 15y ago
This is self limiting.
healthyhippo 15y ago
I'm loving the author's repeated statements in the comments, "To be clear, this is a concept, not a real game."
Tichy 15y ago
For a "chance" to win a trip? No way. They'd have to offer something with real value, like an iPod.
- eipipuz 15y ago
  My sarcasm-o-meter is failing, is this for real?
leon_ 15y ago
Why does the loser get the reward?
deleted 15y ago
[deleted]
bmunro 15y ago
So you give your username and password to some Russians. And you trust them to: - not spam your friends - not mine your details/friends details for data for phishing and other scams. - not attempt to use your password (or variations of) on other websites. Sounds like a smart thing to do.
- kahawe 15y ago
  I never understood how it could get to the point where people would actually enter username and password for something on a completely different website... like e.g. those free SMS websites asking for your yahoo, facebook etc logins to "find friends" and then spam everyone in your address book and countless other sites doing the same thing. Even facebook has a "feature" like that - does no one think about the implications when they do that at all??
  - dspillett 15y ago
    > Even facebook has a "feature" like that - does no one think about the implications when they do that at all?? No, generally people don't and are not encouraged to enough, and I take it as one of the signs that facebook really doesn't care about security any more than it needs to in order to be able to give appropriate sounding lip service when they are asked a question. Handing out your authentication credentials to a third party in exchange for a little convenience is more often than not a ridiculous action, and anyone who encourages such behaviour (by providing such a feature) is simply irresponsible.
    - kahawe 15y ago
      > Handing out your authentication credentials to a third party in exchange for a little convenience is more often than not a ridiculous action, and anyone who encourages such behaviour (by providing such a feature) is simply irresponsible. Yes, absolutely, exactly my point! But obviously it has not hindered lots of websites to STILL do that and obviously lots (or enough) people buy into it. THAT I cannot understand...
      - 15y ago
ballard 15y ago
Marketing! FTW!
dstik 15y ago
This sounds like a similar yet not as well executed idea as Crispin Porter and Burger King's Whopper Sacrifice (http://news.cnet.com/delete-10-facebook-friends-get-a-free-whopper/ http://news.cnet.com/delete-10-facebook-friends-get-a-free-w...) from a few years ago.

59 points by ssclafani 15y ago

dandelany 15y ago

Cute. But Facebook would never allow it. You think they have a delete_user_account() method in their developer API? ;)

lsc 15y ago
You can't delete a facebook account, as far as I can tell, but you can change the data, the email, and randomize the password, which is pretty similar. Seems to me like that's what they were talking about with the 'last words'
- DTrejo 15y ago
  Can also make the account do spammy things or change to a fake name, which could speed the banning.
- JeremyBanks 15y ago
  You have been able to actually delete an account for a while. It's described underneath deactivating on this page: https://www.facebook.com/help/?faq=13016 https://www.facebook.com/help/?faq=13016
  - lsc 15y ago
    "There was a problem reaching the FAQ you requested" I think you actually want http://www.facebook.com/help/?page=842 http://www.facebook.com/help/?page=842 and thanks, I didn't know about that. I'm going to go do that now; I 'deactivated' my account some time ago and facebook is still spamming me, and people are still trying to message me on facebook.
- mkjones 15y ago
  I work on security at FB, and I suspect if someone actually tried this, they'd run into a fair amount of friction. A bunch of accounts logging in from a new place and immediately changing emails / passwords is pretty suspicious. Even if they did get into the loser's account, I think we offer pretty good tools for the account owner to reclaim it even if the password or email have been changed.
deleted 15y ago
[deleted]
ktsmith 15y ago
Says you have to hand over your password so I think that implies that they would be doing it directly via facebook and not the API.
- rhizome 15y ago
  All four will lose. 4.8: "You will not share your password, (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account."
  - ktsmith 15y ago
    Much more importantly the least harmful thing to come from this would be FB account deletion. Chances are for most people that FB password is used somewhere else and more harm could come from it since everything an attacker needs to know about their victim is in their FB profile. I was going to mention that in my initial comment but it seemed obvious.

mkelly 15y ago

...Except it takes 30 days of no account activity to take effect.

stretchwithme 15y ago

This is self limiting.

healthyhippo 15y ago

I'm loving the author's repeated statements in the comments, "To be clear, this is a concept, not a real game."

Tichy 15y ago

For a "chance" to win a trip? No way. They'd have to offer something with real value, like an iPod.

eipipuz 15y ago
My sarcasm-o-meter is failing, is this for real?

leon_ 15y ago

Why does the loser get the reward?

deleted 15y ago

[deleted]

bmunro 15y ago

So you give your username and password to some Russians. And you trust them to: - not spam your friends - not mine your details/friends details for data for phishing and other scams. - not attempt to use your password (or variations of) on other websites. Sounds like a smart thing to do.

kahawe 15y ago
I never understood how it could get to the point where people would actually enter username and password for something on a completely different website... like e.g. those free SMS websites asking for your yahoo, facebook etc logins to "find friends" and then spam everyone in your address book and countless other sites doing the same thing. Even facebook has a "feature" like that - does no one think about the implications when they do that at all??
- dspillett 15y ago
  > Even facebook has a "feature" like that - does no one think about the implications when they do that at all?? No, generally people don't and are not encouraged to enough, and I take it as one of the signs that facebook really doesn't care about security any more than it needs to in order to be able to give appropriate sounding lip service when they are asked a question. Handing out your authentication credentials to a third party in exchange for a little convenience is more often than not a ridiculous action, and anyone who encourages such behaviour (by providing such a feature) is simply irresponsible.
  - kahawe 15y ago
    > Handing out your authentication credentials to a third party in exchange for a little convenience is more often than not a ridiculous action, and anyone who encourages such behaviour (by providing such a feature) is simply irresponsible. Yes, absolutely, exactly my point! But obviously it has not hindered lots of websites to STILL do that and obviously lots (or enough) people buy into it. THAT I cannot understand...
    - 15y ago

ballard 15y ago

Marketing! FTW!

dstik 15y ago

This sounds like a similar yet not as well executed idea as Crispin Porter and Burger King's Whopper Sacrifice (http://news.cnet.com/delete-10-facebook-friends-get-a-free-whopper/ http://news.cnet.com/delete-10-facebook-friends-get-a-free-w...) from a few years ago.