13 ms·
I was banned because of a security flaw in Facebook’s password recovery system
- stareatgoats 4y agoI'm currently in much the same limbo: some geezer with an IP from the other side of the world logged into my fb account, changed password and phone number and likely did a bunch of unsavory stuff that broke the fb "community guidelines". My account has now been "under review" since Saturday which means I can't log in, and my messenger, my fb profile and the associated businesses and groups that I manage have all disappeared from fb. Having googled around my initial hopes that it will soon be resolved has flatlined: there seems to have been a surge of this lately and nobody that I have seen have had their access back (the reviewers have been fired?). I will likely loose my WhatsApp as well, judging by the reports. Of course I realize that as an unpaying user of Meta products people might say "serves you right for being stupid". But I don't buy that. Fb is the de facto online directory of ordinary people (not counting much of the HN crowd as "ordinary" here). It's totally unreasonable (understatement) that fb can effectively erase me and my online history and business without recourse because their systems leak and they don't have manpower who can do a human review of the facts in the case. In the short term I'll be looking for other solutions, in the longer term I'll be supporting calls for making services like fb a public utility, with certain legal obligations (like not erasing online presences).
- yieldcrv 4y agoreminds me of how the most effective and quickest way to delete a facebook account is to post porn
- avh3 4y agolol
- ciupicri 4y agoSince you're admitting that there's lots and lots of people on Facebook, from where do you expect it to get the manpower required to review (properly) all the many cases that might appear?
- brookst 4y agoTheir profits?
- reaperducer 4y agofrom where do you expect it to get the manpower required to review (properly) all the many cases that might appear? Meta had $116,610,000,000 in revenue last year. It can find a way. It's always so baffling to see people on HN rush to defend these massive companies, pretending that they're resource-strapped like two guys in a startup working out of a garage.
- ciupicri 4y agoIt's always so baffling to see people on HN not understanding that the sole purpose of a business is to make money, lots of money. Also why are you talking about revenue and not profit? Last, but not least, let's not forget the recent lay offs.
- 988747 4y ago1. Yes, businesses exist to make money, but if they can't provide good enough service then they will soon be out of business. 2. Revenue is how much money company can spend on various things, they just need to prioritize which things are the most important for them. Facebook obviously do not prioritize customer support. 3. Recent layoffs mean then now have more free cash to hire support people :)
- reaperducer 4y agoIt's always so baffling to see people on HN not understanding that the sole purpose of business is to make money, lots of money. It's always so baffling to see people on HN parrot this line as if it was fact or truth, when it's far from either. Yes, there are lots of businesses that exist only to make money. But there are millions more businesses that exist for other reasons. And, no, I'm not talking about non-profits. Kelloggs, for example, was founded to improve the nutrition of people at a health retreat. The whole moustache-twirling moneybag-hoarding billionaire thing used to be a cartoon, because it was so misaligned with the reality of society. But in the Silicon Valley bubble, this has been turned on its head and elevated into some desirable goal, as if the only way to judge a company's value is by dollar signs. It is not. (It wasn't even Silicon Valley that started this flip. It goes back to the 80's, as parodied by the character Gordon Gekko in the film Wall Street.)
- reaperducer 4y agoI've been locked out of Facebook for so long (due to 2FA issues), I'd just like to delete my account. But that's not possible if I can't log in. I've always wondered how someone who is locked out of a service like Facebook is supposed to delete their content. Let's say that I'm a resident of some location with better-than-average digital privacy rights. If I can't log in to Facebook, how can I get my stuff deleted? How do people handle this in places like the EU (or maybe California)?
- ceejayoz 4y ago> How do people handle this in places like the EU (or maybe California)? Written requests to their privacy officer. datarequests@support.facebook.com It can be a bit of a pain; https://ruben.verborgh.org/facebook/emails/2019-02-15-dpo/ https://ruben.verborgh.org/facebook/emails/2019-02-15-dpo/
- jorvi 4y agoI’ve tried this, they indeed illegally stonewall you.
- counttheforks 4y agoReddit is worse. They will just flat out ignore you. HN isn't much better. I've emailed them asking for my data to be removed, as is my right as an EU citizen and dang simply refused saying it wouldn't be fair to other users. As if that overrides the law.
- joxel 4y ago[dead]
- prmoustache 4y ago> It's totally unreasonable (understatement) that fb can effectively erase me and my online history and business without recourse because their systems leak and they don't have manpower who can do a human review of the facts in the case. What prevents you from recreating a new account? When I left facebook I did a backup of it. Why aren't you making regular backups if your business depend on it? > In the short term I'll be looking for other solutions, in the loger term I'll be supporting calls for making services like fb a public utility, with certain legal obligations (like not erasing online presences). Public utility? Really? If anything it is contamination and pollution that prevent decent options of having room to be the public utility of choice.
- zht 4y agoFacebook, based on various opaque signals that they have, will ask new accounts to verify their identity with ID. Can we please stop blaming the victim?
- prmoustache 4y agoCan we call a victim someone who decide to agree to stupid rules (Term of services)? Like we say, play stupid games, win stupid prizes. If my business rely on a service, I need a name for an account manager that can hear my complaints and activate whatever workflow to fix my problems.
- pixl97 4y agoWhen the power dynamic is one where one party is a multibillion corporation with tens of thousands of employees and the other is an individual, I would almost in every case call the individual the victim. Simply put every business will behave in this manner eventually if not subjugated by monetary penalty of state regulation. That or you can scurry around every year to a new provider as the company you're doing business with is bought up by monopoly movers in the market leaving an ever decreasing pool of choices.
- GlickWick 4y agoRead the article. You get banned again if you make a new account. They likely have some complex digital fingerprinting that lets them re-id you. Maybe if you used entirely new hardware etc you might be able to pull it off, but the average user is just hosed if this happens to then.
- joshuaissac 4y agoIf you live in the EU or the UK, this might also be a personal data breach that Facebook must report to the relevant national data protection authority, because it gave your private data to an unauthorised third party (if the release of that data could risk your rights or freedoms). Failure to notify so can result in fines of up to 2% of global turnover. You may need to contact your national data protection authority directly if Facebook has not notified them.
- Thaxll 4y ago> The most likely scenario is that my email password was compromised and there’s a backdoor to disable 2FA after doing a password reset request which is a huge security flaw that shouldn’t exist. So you don't know if your gmail account was hacked or accessed? I would be worry about that.
- jcforbes 4y agoNot gmail, I run my emails through a personal server. I can't find any evidence that it was compromised and I, stupidly, didn't check access logs before they cycled out. I just can't think of any other way that they were able to do the password reset without access to my email. Obviously I immediately changed my password.
- raesene9 4y agoThe update near the bottom around problems with other sites that the author used Facebook sign-in for, is why I almost always avoid those SSO style logins. SSO is handy for security until your SSO provider breaks or (as in this case) bans you. Given that most consumers have very limited recourse to fix issues with their account, I'd say that for most consumers they're possibly more of a risk than a benefit.
- coffeeling 4y agoDefinitely agree with this and avoid SSO like the plague.
- reaperducer 4y agoSSO is handy for security until your SSO provider breaks or (as in this case) bans you. Imagine if one day Mr. Musk decided to kick everyone off of Twitter who didn't align with his politics or philosophy. Think of the millions of accounts that people suddenly got locked out of because they used "Sign in with Twitter." These situations used to be so theoretical that they were dismissed as hyperbole. But it's a lot less outlandish a thought these days.
- hoseja 4y agoSuddenly banning people you disagree with from the private company you own is the greatest egomaniacal sin.
- _fat_santa 4y agoMy rule for using SSO is that it's ok for apps and accounts you don't really care about but not ok for anything you rely on. Like for example I have a weather.com account through Apple Private Relay. If apple were to ban me and I lost access to my weather.com account, I wouldn't loose any sleep.
- Waterluvian 4y agoIf users are the product, then I guess it’s unsurprising if Facebook doesn’t care that its rejection rate is slightly above 0%.
- duxup 4y agoAlso the users rejected are probably assumed to be “bad” in some way as well. They already decided if the user should be locked out if some set of circumstances occurred.
- spencerchubb 4y agoThe author of the article was also a business owner that spent thousands advertising on Meta apps.
- nhioh34rtjklf 4y agoI doubt Meta cares. I manage social media pages for small / medium sized businesses for a living. They regularly break stuff that businesses rely on, even stuff related to advertising, and they don't care. Most recently, it was the rollout to "new pages experience" and meta business suite. It was slow, buggy, and broken. And they one day they forced it on practically everyone.
- Savageman 4y agoIt's a pain to get something done in case anything decided by "the system" happens... I've been unable to add my main email address in Facebook because "The account that owns the email address you entered has been disabled.". If I check my emails history, apparently someone named "Kyle" (not me) tried to create/activate an account in 2016 and now I'm prevented to use it... Forever?
- theandrewbailey 4y ago> In other news, I’ve discovered a new level of this hell. Because I used Facebook as a login service for my account with the DMV I am now unable to pay my vehicle taxes nor renew my registration/tags online. It's ironic that Jeff Atwood phrased OpenID/third party logins as an internet driver's license. 10 years later, we've learned the pitfalls of such a system, namely that your login is at the mercy of organizations without customer support, and they can turn you off for no personally attributable reason. https://blog.codinghorror.com/your-internet-drivers-license/ https://blog.codinghorror.com/your-internet-drivers-license/
- koolba 4y agoIt’s not as bad if you control the domain as you could always setup a new provider. Note that I didn’t say “own” as the risk of the domain being seized will always be present. All in all, it’s no different than delegating to your email provider to prove your identity via a password reset / login link.
- orangepurple 4y agoAt least there is legal remedy for domain seizure
- marcosdumay 4y agoHum... Or maybe we should have the government arrange the logins for public services, since it's already in charge of tracking your identity and already has the procedures for it. But well, that may be too radical an idea to be executed. I'm sure privatizing logins is the way to go.
- darreninthenet 4y agoIIRC they have this in South Korea..?
- codetrotter 4y agoIn Norway we have MinID. > MinID provides access to online public services at a substantial level of security (level 3). https://eid.difi.no/en/minid https://eid.difi.no/en/minid > MinID is issued by the Directorate of Digitization and can be ordered from the year you turn 13. https://minid.no/en/about-minid/ https://minid.no/en/about-minid/ There is also BankID which we can use in order to log in to all public services. > BankID is an electronic credential for secure identification and signing on the web. https://www.bankid.no/en/private/ https://www.bankid.no/en/private/ > Work on developing BankID as a joint infrastructure started in 2000, and the first customers got BankID in 2004. In 2014, BankID Norway AS was established. In 2018 BankID merged with Vipps and BankAxept in order to improve product offering and prepare for competition against global tech firms. https://www.bankid.no/en/private/about-us/ https://www.bankid.no/en/private/about-us/ I have both MinID and BankID and I can use either of them for things like taxes and such. Statens Vegvesen, who are in charge of driver licenses and more, allow us to sign in with BankID and a couple of other methods, but not with MinID from what I can tell. Norge.no, which is a guide developed by the Norwegian Digitalisation Agency, has the following to say about MinID and BankID: > Electronic IDs are available at different security levels, and thus give access to slightly different types of services. > MinID is at a medium-high security level ("Significant"), and can be used for many public services, but not for health services at helsenorge.no, for example. > BankID, Buypass and Commfides, which can also be used for public services, are at the highest security level (“High”) and give access to all public services. https://www.norge.no/en/minid https://www.norge.no/en/minid
- gchokov 4y agoI doubt Zuck banned you, but if you say so..
- jcforbes 4y agoIt's a catchy name and the top level domain was available, unlike facebookbannedme.com.
- hyzyla 4y agoIt's one of the things, that I would like government to regulate in some way. Sometime, loosing account looks like destroying someone's job or business by some random corporation without even explain or ability to dispute.
- submeta 4y agoHere is a TL;DR of the text: The author claims that he was permanently banned from all Meta products (including Facebook, Messenger, Instagram, and WhatsApp) due to a security flaw in Facebook's password recovery system. Despite having two-factor authentication turned on, the author believes that his email password was compromised and there is a backdoor to disable 2FA after a password reset request. The author has tried to resolve the issue and appeal the decision with no success and has lost his personal and business accounts. The author suggests having a backup admin for your Facebook page, and he has found other instances of similar bans happening to other people. The text ends with an update, where someone from Meta reached out to the author on Reddit to help resolve the issue.
- ajross 4y agoAlso worth pointing out that Facebook's own communication doesn't mention any such thing, and claims simply to have banned the account for content reasons. Which, given that the report here is anonymous, seems at least not implausible. There's a real name in one of the screenshots, but a quick search doesn't find any other content associated with it. Folks need to recognize that this kind of content, presented without verification, tends strongly to be one-sided and at least partly misleading.
- jcforbes 4y agoBanned for content reasons.... because somebody accessed my account and posted who-knows-what on it. Did you not see the screenshot showing a login attempt from Vietnam? What other content would you like to find with my name on it? My website, jcforbes.com (which currently has nothing on it)? You could search my name with the NC department of commerce and find my business name easily. I presented all evidence in form of screenshots... exactly what do you think I'm hiding?
- blitzar 4y ago[flagged]
- recklesstodd 4y agoSomething similar is happening to my account. One week ago, I was asked to reset my password which I did. Two days later my account was suspended for the first time. I was asked to upload a face picture and my account was unblocked. Yesterday my account was suspended again for the same reason and was unblocked today. I use a password manager and 2FA so I doubt someone managed to access my account. I’m afraid to definitely lose my account
- gocartStatue 4y agoDo you use it through an app, or web browser? I had the same situation. Always from safari on iOS.
- recklesstodd 4y agoI use it from Safari on iOS. Did you manage to fix it?
- LaserToy 4y agoLooks like you are in us. Drag them into small court by claiming $9999 in damages. They will have to send a human or pay. I guess if they just pay, you can do it per product. Class action might be possible as well
- criddell 4y agoI haven’t looked at the TOS, but users are likely required to engage in binding arbitration. That’s not necessarily bad though.
- kouteiheika 4y ago> That’s not necessarily bad though. Indeed: https://www.shuchow.com/so-i-took-a-huge-corporation-to-arbitration/ https://www.shuchow.com/so-i-took-a-huge-corporation-to-arbi...
- rationalist 4y agoWouldn't FB/Meta be required to actually send someone to court to tell the judge that the user "agreed" to binding arbitration first?
- criddell 4y agoThey would likely immediately file to dismiss based on the TOS. It would be an uphill battle to convince a judge that you shouldn’t go through arbitration first.
- rationalist 4y agoHow would someone convince the court that you never agreed to the TOS? For example, I created my account before there was a TOS, and FB used easily-bypassable ways to get users to agree to a TOS, and eventually they stopped asking me, leading me to believe they think I agreed. Without my wet signature on anything, how can they prove I agreed to something when they can just flip a bit and claim their records show I did? I guess the user would get a notice that FB/Meta filed something and that they could respond saying that's not true?
- NhanH 4y agoSomething similar happened to my mom's account in 2019: someone created a new account trying to impersonate her, then somehow trigger either password recovery or some sort of report that ends up locking her out. And despite having 2FA AND submitted her passport as photo ID a couple of years prior, we ended up losing access to that account, along with 10 years of photos. At that time, our attempt at recovery went into limbo when support asked us to upload new photo + passport , which we did, and then nothing happened. The account was then suspened or something about 90 days later. Since that account should still have alot of photos for us, I'd really appreciate if someone from meta can help us recover it. I wrote on HN asking for help back then: https://news.ycombinator.com/item?id=21234651 https://news.ycombinator.com/item?id=21234651 .
- trhr 4y agoIf you take one lesson away from this, it should be "you don't own it, or exercise even trivial control over it, unless it's sitting in your garage, on bare metal, in a state with permissive gun laws."
- bluetidepro 4y agoPosting on FANG support (aka HN) was the right call. Your likeliness of getting actual help now goes up about 1-4% with every point/like.
- gocartStatue 4y agoI also got locked out because of „suspicious activity” (browsing fb through mobile browser on ios). Twice. The first time around I got unbanned after several days, sending them my selfie etc. The second time is now. They require phone number to send me a code, so I can „ask them to reconsider”. But I don’t receive the code. After several tries the page says „too many requests, wait 24h”. I obviously have 2FA using authenticator. Got no other email than „you got 30 days to take action”. The only reason I’m even trying is messenger and a few sad groups that are funny from time to time. Meh.
- mkl95 4y ago> So there it is, a complete trifecta of business resources destroyed. Messenger chat history is gone, friends and contacts that I don’t even have phone numbers for are gone, and don’t even have a way to know that I’m alive until I hopefully run into them at work functions this year. I would expect governments to step in when a flaw like this is detected. It could ruin thousands of lives.
- logicalmonster 4y ago> It could ruin thousands of lives. It's not "could". It has ruined thousands of lives. How many depressed people out there have had their last little connection with humanity severed because of a dumb algorithm? How many small businesses have died because a random business account was shut down overnight with no recourse? I'm convinced that there's been at least some suicides over the problems caused to peoples' lives from the deliberate decision to not provide human customer service in some fashion from these Silicon Valley giants. The really infuriating part is that this isn't even a selfish decision about money, which would be evil, but at least understandable on some level. Customer service can be revenue neutral or even a profit center if these companies were willing to charge a fee for actual good, human support to resolve the most important issues.
- jonathanstrange 4y agoMy take on this and other stories like this is that you really should never ever use a company like Facebook as a vital component of your business. There have been so many stories about this, just browse Reddit forums and other sources for experiences with Facebook's Kafkaesque advertising manager, for example. It can work for years and suddenly your account is cancelled. It's fine to use such companies and their services as one leg of a business with many legs, but never rely on them solely. This is just a matter of common sense. The same applies to Amazon, Youtube, etc. Even if they're fine now they can and will unilaterally change their conditions and employ algorithms with false positives. Your business can become the victim of algorithmic discrimination and plain old bugs anytime.
- idopmstuff 4y agoFacebook is my e-commerce business' main avenue of customer acquisition. It wouldn't make any sense to avoid using something that is clearly a profoundly valuable asset because something could go wrong at some point. Even if they shut off my access tomorrow, I've still gained the thousands of customers who I acquired - they've already generated a profit for me, and I can keep reaching out to them via marketing emails to make more sales. Same thing with Amazon - it's been one of the easiest ways to sell. I listed my stuff, spent a little on ads, and things have just been slowly and steadily up and to the right since then. Even if they kicked me off tomorrow, I've still made good money in a very time-efficient manner. It's one thing to say you should get Fastmail instead of Gmail, but to just say you should avoid using services that are valuable for your business because you might lose access later is cutting off your nose to spite your face.
- mekoka 4y ago> Thats it, done, finito, gone. I searched high and wide for further contact methods. For a way to talk to a human. There is none. At all. I've experienced this as well. Facebook seem to have gone through some lengths to insulate themselves from interactions with the public. They're now too big to trust with anything important to you. You'll get no support if you get in trouble. Some months after a family member passed away, his Facebook account was hacked and the thief started posting stuff. It's been almost a year that I've been trying to close that account, or at least memorialize it. I've provided everything requested by their circuitous knowledge base to prove that the person has indeed died and even personal documents proving that we're related. For reasons known only to them, the help desk decided that something is missing. They wouldn't say what and just became totally unresponsive. There's no way to talk to anyone.
- tlogan 4y agoWe have the same problem. Does anybody know if there some legal way to force them to close or memorialize account if loved one who passed away? We sent multiple requests via their page and nothing. It is really really depressing.
- denton-scratch 4y agoNot for a minute defending Faceache; but to rely so heavily on one company (FB, Insta, WA) for services that are business-critical, but that you're not paying for, strikes me as reckless. I don't mean to blame the victim; it's clearly not his fault. But placing so much reliance on a provider of free services that lacks a proper support channel, isn't a great plan. I also note that the author relies on gmail - which has very similar problems.
- ChicagoBoy11 4y agoTrue but this take is a bit naive. I used to live in Brazil, where Whatsapp is the defacto communication method, for example. You might stand on principle all you want, but if you don't have that as a primary communication channel for a service/end-user oriented business -- even if you have all the alternatives imaginable!!! -- you are going to have a RIDICOUSLY hard time. Just on my personal life with folks there, if I were to just not participate in Whatsapp it is not an understatement that the social fabric of my life would significantly change. For the worse.
- TomSwirly 4y agoFacebook, Google, etc advertise their services to all of us, aggressively. They set up a system where they have crowded out most of the other ways to get the attention of potential customers, so businesses who choose not to use them are giving up most of their reach. They then set up these complex, automated systems that decide to destroy people's accounts; they have no support personnel and no one to ask; they refuse to follow even their own rules in these matters. And yet the first person you blame is... the victim. Blaming the victim is in fact defending Facebook. > I also note that the author relies on gmail - which has very similar problems. And your solution is... what? For two decades, I ran my own mail server, just for this reason. I finally gave up this year, because Google finally made it impossible for me to deliver email to them no matter what I did. I resent it bitterly.
- denton-scratch 4y ago> And your solution is... what? Well, like you, I ran a personal mailserver for nearly 20 years. Initially I had trouble delivering to gmail and Hotmail; those problems resolved themselves after a few years. My ISP now hosts my mail, using the same infrastructure that I used to use: Postfix, SpamAssassin, Dovecot, Sieve. I use my own domain. Obviously email isn't the same as social media. I never liked the social media landscape; I've always seen the internet as fundamentally distributed, and I always regarded MySpace/Facebook et al as a trap. I have an old Google account, but I never use it. Otherwise the only social media account I've ever had is HN. I'm not in business, I'm not selling anything. Also I'm rather reclusive; I don't need a large circle of friends, about three has mostly been enough for me. So I'm not like everybody else, and I can see that for some people, there isn't much alternative to the giants. I'm against designating them "critical infrastructure". That would simply deepen the moat. If they really are critical infrastructure, then they should be provided by the government. What they do that's useful isn't hard; what's hard is the part that isn't useful - advertising, and constant user-engagement. I think something like Mastodon probably has the potential to defeat the giants. It's truly distributed, and not under central control. Mastodon seems to be designed as an alt-Twitter, based on short messages. That doesn't suit me, but I expect something like a long-form Mastodon will rock up sooner or later. Regarding victim-blaming: this is like making a deal with gangsters. I have every sympathy with the victims; but if you place your business in the care of a giant, with no proper support channel, that don't take money off you for the service, then your only recourse is to ask for your money back (i.e. zero). You can't even sue for breach of contract. That's an extremely squishy foundation to build a business on. Facebook has lasted rather well; Twitter seems to be going down the tubes. MySpace died a long time ago. But Facebook will fade away - they all fade away. What lasts isn't websites and services; it's protocols.
- mqus 4y ago> In other news, I’ve discovered a new level of this hell. Because I used Facebook as a login service for my account with the DMV I am now unable to pay my vehicle taxes nor renew my registration/tags online. Obviously I can do this in person, but who wants to GO to the DMV? Not I, that’s for sure. How does a government agency even allow something like "sign in with Facebook"? Sure it's convenient but this case shows why this is stupid. Also, isn't this a privacy issue? I'm not an american but it baffles me that something like this is possible.
- ridgered4 4y agoMy state's DMV sells personal data to private companies.
- hooby 4y agoI feel that all of these "locked out" reports - whether they are from Google or Facebook or something else, suffer from the same problem: The problem is not, that a false positive happens, or the user does get locked out by an algorithm, etc. - that sort of thing is impossible to avoid entirely. You have to stop bad actors, and you'll never be 100% accurate with that. Imho the big problem is, that people who get locked out wrongly, have no recourse. There's no support, neither free nor paid, no avenue, absolutely nothing they can do, to get help. THAT's the problem. People have to resort to trying to go viral, because only then their problem will get fixed. As a company, that's probably not what you want. To see your false positives cause waves all over the internet... You'd probably want to see those problems be solved silently. But that would require that you offer an avenue for the user to get their problem solved quietly - doesn't it?
- ryandrake 4y agoI guess the problem is: If the company offers recourse for good actors, then bad actors would make use of it, too. So, to stop bad actors from using recourse, the company would need to be able to differentiate between bad actors and good actors. And if they could do that, they wouldn't have the problem in the first place.
- hooby 4y agoFirst of all, I don't think bad actors are as willing to invest time/work into this as good actors - for them it's not worth the effort in most cases. In this specific case, if keeping the account for a longer time had been the goal, the bad actor wouldn't have gotten the account suspended immediately by violating the Terms of Use, nor would they have used a Vietnam IP to do so. Secondly - whenever such a thing does go viral, and Facebook comes under pressure - they all of sudden become very able to tell: - that the person who has been using the account for years without incident, with an US IP address, who can provide 2FA codes, controls the original sign-up email, can produce credit card statements for payments the account made, sent in a copy of their drivers license, is probably the good actor - that the person who (within just a few hours) reset the password, changed the email, disabled 2FA, and caused the suspension - all from a Vietnam IP - is probably the bad actor. Facebook doesn't have that problem because they are unable to differentiate between bad actors and good actors... Facebook has that problem because they don't want to differentiate good and bad actors - because that costs man-hours and thus money. The support teams dealing with that stuff are probably under-staffed, under-paid, lack the tools/knowledge for deeper investigation, and are being pressured to close as many tickets as fast as possible.
- javajosh 4y agoThe poor state of identity management should give us all pause. The condition for trust is a username/password pair. I think that's not enough - and also too much! Instead we should make a software application that lets each client generate a public/private keypair that never leaves the device. Well, the public key part leaves. No usernames, no signup, just encrypted messages sent from a public key to a public key, as God intended.
- lyvxh 4y agoWebAuthn (or the new iOS "Passkeys" feature which is based on WebAuthn under the hood) does this.
- megous 4y agoUnfortunately this tech requires special HW. It would be nice if I could just upload a key pair into a browser, name it, lock it with some password, and easily manage which key pair authorizes what accounts, create subkeys locally for access to specific limited list of accounts while traveling, etc. It would be a massive improvement over status quo and would pretty much end credential stuffing for once, but no. You have to buy expensive shit that gets lost easily or broken, that you can't backup online and recover in an instant you need it. I just refuse to be forced into someone's idiotic security requirements that completely forego any other considerations user may have, other than this stupidly absolute focus on security. Every time I imagine this glorious new world of webauthn replacing everything... it's just not appealing. I lose the HW key, so I need to buy a new one. I can do it online, except I can't because I need the lost HW key to confirm the card payment or login to my bank account and initiate a transfer. I have to go buy it to some physical shop or pay on delivery. Most don't carry it. Now this happens on a vacation, where it's generally easier to lose things, and gerneally impossible to buy things like HW security keys. It would be possible to have a SW based solution, by emulating the USB FIDO interface, or whatever, but I really don't want to get locked into a solution where there's a constant threat that some services will just start requiring HW key attestation. So, no. Security is important to me, but so is reasonably doable disaster recovery not requiring anything more than an internet connected computer and things I can remember.
- zirgs 4y agoYet another reason to not use services that require to use one account for many completely unrelated things. You say something wrong on FB and now you can't log into a completely unrelated service. This is why I will never use gmail. Yeah - my current email provider might scan my mailbox, but it will not ban me for saying something wrong on youtube or twitter. And I never post anything on facebook to not lose access to my VR headset.
- rd 4y agoI was also banned by Facebook, but more so locked out by a shitty 2FA setup. I ported my old iPhone over to a new one, forgot the 2FA doesn’t come with google Authenticator, and even with the recovery codes in-hand, Facebook had no option to recover account. I gave up on it for two years - finally, I reached out to a friend of mine who literally just started working there (I’m 19, he’s 21), and he raised an internal support ticket which generated temporary 2FA codes for me in 6 hours, and I was back in my account. Actually shocking how much nepotism can help you solve these problems. Good luck OP.
- fleddr 4y agoI once also had an issue with my FB account and the most stunning thing I learned is that there's no way to contact FB. None. This company that "connects the people of the world" has no email, phone, chat...nothing. It's not like you can talk to them yet they won't listen, no...you can't talk to them at all. This specific example is especially criminal, as the person is a paying customer (invested in ads).
- rograndom 4y agoI went through the same thing (https://news.ycombinator.com/item?id=34031217 https://news.ycombinator.com/item?id=34031217), and just finally got the last piece, WhatsApp, unblocked a couple of days ago. My situation was unique because my Facebook account administered the pages of government agencies and they were very helpful in putting pressure through back channels to get it sorted out. It still took over 30 days after they acknowledged that they dropped the ball to get the account back, and 60 days to get everything back and running. But I'll pass along this link to my AG as they're collecting stories like this, and there's hundreds we've found so far.
- aubanel 4y agoI've got a funny version of this one: In university, there was a page giving reviews of the canteen's daily soup. The english translation of this name could be "How does the canteen's soup taste today?". My friends were running it, and one day to piss them off I started another page, "How does the canteen's soup really taste today?". And as expected,they asked all their followers to go report my competitor page. So fast forward to now, 4 years later. Maybe a last report was the final straw, and I've just received a notification that my page would be shutdown... And at the same time, surprise! My personal Facebook account gets deactivated too for violating community standards! An automatic email notifies me that my account is deactivated, so I reply something like "please don't delete my account, all I did was post soup reviews that went against the deep state of soup reviews". Probably Facebook is also controlled by the soup-review-deepstate, because their next automatic email mentions that my account is now deleted. So in that process, I didn't get to talk to any human, and my account created over 10 years ago gets deleted along with all my Messenger history, and thousands of memories. But in the end, I'm not unhappy: at least I won't lose anymore time scrolling on that hell of a an empty network.
- jareklupinski 4y ago"no soup for you!"
- schwank 4y agoI had a similar issue and ended up deplatformed by FB. I hadn't logged in for a couple of years, but some friends had tagged me in an event photo. Figured I might go checkout what was posted over time. When attempting to log in, my password was not recognized. I successfully reset my password, but upon logging in I was presented with a validation prompt demanding I get several people to vouch for me, from a selection of 6. Only problem was I only knew one of those people. At that point my entire profile vanished from FB. Friends and family no longer see me in their lists, even my wife. There's no way to contest this or get support, so I vanished. Later I found out an astroturf profile of me was created, but its not me (I have a globally unique name). There's no way I will ever use a Meta product or account in the future based on this experience.
- jcforbes 4y agoWell this explains going from 400 hits to 10,000 hits in the last 12 hours.