4 ms·
I think they should have used that information differently. Given they know that you are already logged into your gmail, any visitor to your machine will theref
by nchuhoai 15y ago
I think they should have used that information differently. Given they know that you are already logged into your gmail, any visitor to your machine will therefore know how to reset the password to his advantage.
Instead, they should have make a block, so that you are forced to logout of your gmail and login to your gmail to enhance security.
- joshmlewis 15y agoif they did this you might as well just go to your email and click on the link
- nchuhoai 15y agoWhat i am saying is that you are forced to re-login to prevent someone stealing your facebook account when he has access to your computer. given that most people stay logged into their gmail, i think this would actually be helpful
- yuliyp 15y agoIf you're logged into your e-mail, then someone can go to Facebook, and start password recovery, and then go to your e-mail and click the recovery link. If you're not logged in, then the OpenID authentication will require you to enter your e-mail. This isn't a weakness, just a convenience.
- nchuhoai 15y agoHow is that not a weakness if anyone who has access to your computer can set an arbitrary password on your facebook account? (given you are logged into your gmail). I think it would be a nice feature if facebook would use that information to force a relogin