5 ms·

Alright - It's nice to know that Facebook has an industrial strength login system. Nobody would know that unless, like here, someone like you chimed in to menti

Alright - It's nice to know that Facebook has an industrial strength login system. Nobody would know that unless, like here, someone like you chimed in to mention it. (And thanks for that) My point was more that - as a user you should not expect a site like Facebook (or Twitter or FourSquare) to spend as much time firming up their login system as you would your bank. The fact that you actually do so is a nice bonus. But users would be well-served by not expecting the same level of attention to security from social sites and treat them accordingly. (And sorry if I came off as being unfair to Facebook. I meant my comment to apply to that genre of sites in general)

mkjones 15y ago
It's true that a lot of sites don't go to the trouble of implementing particularly secure login systems (it's a lot of work!). Sadly I think this includes many banks. One way around this is using SSO with a site who does spend a lot of resources on making their login system secure. For example, using Facebook Connect is a great way to get all that security (plus all our fake account detection) and the added bonus of not having to store (and properly hash) passwords. If only RockYou, Gawker, Sony and others whose credential databases have been compromised had done something like that... Fortunately, we have an answer even to problems like that with 3rd parties: http://bucks.blogs.nytimes.com/2012/04/02/how-facebook-tries-to-protect-users-online-credentials/ http://bucks.blogs.nytimes.com/2012/04/02/how-facebook-tries.... I've spent multiple nights up late trying to crack hashed passwords on a big dump before attackers can, so we can help the victims who shared credentials between the compromised site and Facebook secure their accounts. I'd love to raise awareness around the stuff we do to protect users. We've done blog posts and people have written articles, and users often see this stuff when e.g. they're traveling (ever been asked to identify photos of your friends?). What else do you think we could do? Here are some example articles about what we do around login security - if you're interested, check out http://www.facebook.com/security http://www.facebook.com/security to see other related stuff. https://www.facebook.com/note.php?note_id=10150172618258920 https://www.facebook.com/note.php?note_id=10150172618258920 https://blog.facebook.com/blog.php?post=389991097130 https://blog.facebook.com/blog.php?post=389991097130 https://www.facebook.com/note.php?note_id=425136200765 https://www.facebook.com/note.php?note_id=425136200765
- tjoff 15y ago
  For example, using Facebook Connect is a great way to get all that security (plus all our fake account detection) and the added bonus of not having to store (and properly hash) passwords. With the downside of compromising your users integrity and open your users up to even more tracking as well as relying on a 3rd party for a system-critical component and force your users to sign up for a facebook account. Storing and properly hash passwords is not hard to do. While I appreciate the work you do, facebook connect (as well as most, if not all, similar solutions) just sickens me and any service that exclusively rely on it is just pathetic (for the reasons above). Todo: Create multiple fake facebook accounts for such services, can't believe I haven't done this already. If you would just care to acknowledge that there might be potential issues with the things you mention your posts wouldn't seem like pure PR-statements.
  - mkjones 15y ago
    > With the downside of compromising your users integrity and open your users up to even more tracking as well as relying on a 3rd party for a system-critical component and force your users to sign up for a facebook account. Obviously using Connect means that there's a 3rd party with some data about your users. IMO that's worth the tradeoff, but if you feel differently, then don't bother with Connect (though I'm curious what concrete concerns you have, more specific than just "opening them up to even more tracking"). As far as reliability goes, I agree that minimizing external dependencies is a good idea. Again, this is a tradeoff - you're saying "I want to work on things that are specific to my app or site, not this boring login stuff that has already been solved." I suspect that in reality, our uptime is good enough that sites are more likely to notice issues from their own (or their hosting provider's) instability than from ours. But you're right - this does introduce the possibility of login being broken for your site if Facebook is broken. Hopefully the benefits Connect offers outweigh this risk, but again, you're fee to not use it. > Storing and properly hash passwords is not hard to do. Perhaps it's not that hard, but many still people fail to do it properly. And it's still not a silver bullet - even properly hashed passwords, when exposed from a compromised DB, can be reversed. Regardless, this is only a small part of the problem - dealing with stolen (e.g. phished) credentials is another, arguably more important, problem that's much more difficult. > Todo: Create multiple fake facebook accounts for such services, can't believe I haven't done this already. Please don't do that. We're pretty aggressive about proactively seeking out fake accounts and getting rid of them, and as a result I imagine this would end up being a pain in the ass for you. I'm curious what threat this mitigates?

mkjones 15y ago

It's true that a lot of sites don't go to the trouble of implementing particularly secure login systems (it's a lot of work!). Sadly I think this includes many banks. One way around this is using SSO with a site who does spend a lot of resources on making their login system secure. For example, using Facebook Connect is a great way to get all that security (plus all our fake account detection) and the added bonus of not having to store (and properly hash) passwords. If only RockYou, Gawker, Sony and others whose credential databases have been compromised had done something like that... Fortunately, we have an answer even to problems like that with 3rd parties: http://bucks.blogs.nytimes.com/2012/04/02/how-facebook-tries-to-protect-users-online-credentials/ http://bucks.blogs.nytimes.com/2012/04/02/how-facebook-tries.... I've spent multiple nights up late trying to crack hashed passwords on a big dump before attackers can, so we can help the victims who shared credentials between the compromised site and Facebook secure their accounts. I'd love to raise awareness around the stuff we do to protect users. We've done blog posts and people have written articles, and users often see this stuff when e.g. they're traveling (ever been asked to identify photos of your friends?). What else do you think we could do? Here are some example articles about what we do around login security - if you're interested, check out http://www.facebook.com/security http://www.facebook.com/security to see other related stuff. https://www.facebook.com/note.php?note_id=10150172618258920 https://www.facebook.com/note.php?note_id=10150172618258920 https://blog.facebook.com/blog.php?post=389991097130 https://blog.facebook.com/blog.php?post=389991097130 https://www.facebook.com/note.php?note_id=425136200765 https://www.facebook.com/note.php?note_id=425136200765

tjoff 15y ago
For example, using Facebook Connect is a great way to get all that security (plus all our fake account detection) and the added bonus of not having to store (and properly hash) passwords. With the downside of compromising your users integrity and open your users up to even more tracking as well as relying on a 3rd party for a system-critical component and force your users to sign up for a facebook account. Storing and properly hash passwords is not hard to do. While I appreciate the work you do, facebook connect (as well as most, if not all, similar solutions) just sickens me and any service that exclusively rely on it is just pathetic (for the reasons above). Todo: Create multiple fake facebook accounts for such services, can't believe I haven't done this already. If you would just care to acknowledge that there might be potential issues with the things you mention your posts wouldn't seem like pure PR-statements.
- mkjones 15y ago
  > With the downside of compromising your users integrity and open your users up to even more tracking as well as relying on a 3rd party for a system-critical component and force your users to sign up for a facebook account. Obviously using Connect means that there's a 3rd party with some data about your users. IMO that's worth the tradeoff, but if you feel differently, then don't bother with Connect (though I'm curious what concrete concerns you have, more specific than just "opening them up to even more tracking"). As far as reliability goes, I agree that minimizing external dependencies is a good idea. Again, this is a tradeoff - you're saying "I want to work on things that are specific to my app or site, not this boring login stuff that has already been solved." I suspect that in reality, our uptime is good enough that sites are more likely to notice issues from their own (or their hosting provider's) instability than from ours. But you're right - this does introduce the possibility of login being broken for your site if Facebook is broken. Hopefully the benefits Connect offers outweigh this risk, but again, you're fee to not use it. > Storing and properly hash passwords is not hard to do. Perhaps it's not that hard, but many still people fail to do it properly. And it's still not a silver bullet - even properly hashed passwords, when exposed from a compromised DB, can be reversed. Regardless, this is only a small part of the problem - dealing with stolen (e.g. phished) credentials is another, arguably more important, problem that's much more difficult. > Todo: Create multiple fake facebook accounts for such services, can't believe I haven't done this already. Please don't do that. We're pretty aggressive about proactively seeking out fake accounts and getting rid of them, and as a result I imagine this would end up being a pain in the ass for you. I'm curious what threat this mitigates?