5 ms·

Why would Facebook need to verify a phone number? It's a social network, used for jokes, farmville and whatnot. Most people I know that are on FB don't even use

Why would Facebook need to verify a phone number? It's a social network, used for jokes, farmville and whatnot. Most people I know that are on FB don't even use their 'real' name. IF someone provides a telephone number in his account details, FB can treat it like a string. I understand why FB would like to 'verify a number', but why should we allow that to happen? Why is this a valid reason to ask for permissions on my phone?

tedunangst 12y ago
If you don't let people use two factor auth, they bitch about your lack of security. If you let people use two factor auth, they bitch that you're collecting phone numbers. Can't win.
- detaro 12y ago
  What Facebook 2FA uses SMS and the app? All I know is either sending codes per SMS you enter on the web page or using a code generator app. Setting it up doesn't even require the Facebook app, let alone it reading SMS. Am I missing something? (I don't use Facebook much)
  - tedunangst 12y ago
    Not sure. I neither provided Facebook with my phone number, nor use Android, so I can't say whether it could verify for your phone number like that or not. But reading SMS codes seems like something an app could do instead of making the user enter it by hand.
- darklajid 12y ago
  The problem is scope. TFA is nice. Maybe mandatory when you're providing a service that passes a certain threshold? But that permission obviously isn't the right answer. FB should ask for permissions to read _all_ SMS to make TFA via SMS a tiny bit more comfortable? No. TFA solutions exist. Google Authenticator (I wouldn't trust Google with anything, but that's "open" as far as I know) or the Yubico aequivalent are perfectly fine choices for T/HOTP. If you want to send SMS instead (why??), let the user enjoy their platform's copy/paste support to give you the code. There is not a single reasonable argument, why Facebook (or.. any. Seriously: I cannot think of ONE reason) should be able to read your text messages. Bringing up TFA is probably (hey, not my native language, I certainly never joined a debating group or whatnot) a failure to argue the point and has a nice latin name or something. Maybe about a true of false Scotsman or what do I know.. If I say "FB shouldn't read texts" that has no relation to "FB should not implement TFA". Nor is it reasonable to imply that they cannot, without that permission.
  - tedunangst 12y ago
    > FB should ask for permissions to read _all_ SMS to make TFA via SMS a tiny bit more comfortable? If Android had a permission called "Only read one text message to verify your phone number" maybe Facebook could use it. Honestly, I don't know what Facebook is trying to do, but similar arguments come up frequently with Android apps. The permission model is IMO broken, because it requires upfront permission for everything the app may ever want to do. There's no way to install something, minus SMS permission. Maybe Facebook is evil and does want to read all of your texts and upload them to advertisers. Maybe they don't. It's hard to determine that simply from the requested app permissions, given the poor granularity of those permissions.
- dredmorbius 12y ago
  False dichotomy. If the ONLY 2FA you offer is predicated on phone-number sharing then people have a legitimate right to bitch about it. I've been locked out of my G+ account (due to accessing it via Tor): https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_kill_your_google_account_access_it_via_tor/ https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_... https://news.ycombinator.com/item?id=9060922 https://news.ycombinator.com/item?id=9060922 I found that: 1. The account recovery stuff wasn't set up properly. 2. Google won't provide access to back-up codes at all unless you provide them a phone number. https://plus.google.com/104092656004159577193/posts/EmEk18bLP9t https://plus.google.com/104092656004159577193/posts/EmEk18bL... No, it's not a "you can't win" situation. It's a case of not offering reasonable choices. (Discussed in context of Google as, while I cannot keep Facebook from sucking up my personal information, I can avoid putting it there myself.)

tedunangst 12y ago

If you don't let people use two factor auth, they bitch about your lack of security. If you let people use two factor auth, they bitch that you're collecting phone numbers. Can't win.

detaro 12y ago
What Facebook 2FA uses SMS and the app? All I know is either sending codes per SMS you enter on the web page or using a code generator app. Setting it up doesn't even require the Facebook app, let alone it reading SMS. Am I missing something? (I don't use Facebook much)
- tedunangst 12y ago
  Not sure. I neither provided Facebook with my phone number, nor use Android, so I can't say whether it could verify for your phone number like that or not. But reading SMS codes seems like something an app could do instead of making the user enter it by hand.
darklajid 12y ago
The problem is scope. TFA is nice. Maybe mandatory when you're providing a service that passes a certain threshold? But that permission obviously isn't the right answer. FB should ask for permissions to read _all_ SMS to make TFA via SMS a tiny bit more comfortable? No. TFA solutions exist. Google Authenticator (I wouldn't trust Google with anything, but that's "open" as far as I know) or the Yubico aequivalent are perfectly fine choices for T/HOTP. If you want to send SMS instead (why??), let the user enjoy their platform's copy/paste support to give you the code. There is not a single reasonable argument, why Facebook (or.. any. Seriously: I cannot think of ONE reason) should be able to read your text messages. Bringing up TFA is probably (hey, not my native language, I certainly never joined a debating group or whatnot) a failure to argue the point and has a nice latin name or something. Maybe about a true of false Scotsman or what do I know.. If I say "FB shouldn't read texts" that has no relation to "FB should not implement TFA". Nor is it reasonable to imply that they cannot, without that permission.
- tedunangst 12y ago
  > FB should ask for permissions to read _all_ SMS to make TFA via SMS a tiny bit more comfortable? If Android had a permission called "Only read one text message to verify your phone number" maybe Facebook could use it. Honestly, I don't know what Facebook is trying to do, but similar arguments come up frequently with Android apps. The permission model is IMO broken, because it requires upfront permission for everything the app may ever want to do. There's no way to install something, minus SMS permission. Maybe Facebook is evil and does want to read all of your texts and upload them to advertisers. Maybe they don't. It's hard to determine that simply from the requested app permissions, given the poor granularity of those permissions.
dredmorbius 12y ago
False dichotomy. If the ONLY 2FA you offer is predicated on phone-number sharing then people have a legitimate right to bitch about it. I've been locked out of my G+ account (due to accessing it via Tor): https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_kill_your_google_account_access_it_via_tor/ https://www.reddit.com/r/dredmorbius/comments/2w618r/how_to_... https://news.ycombinator.com/item?id=9060922 https://news.ycombinator.com/item?id=9060922 I found that: 1. The account recovery stuff wasn't set up properly. 2. Google won't provide access to back-up codes at all unless you provide them a phone number. https://plus.google.com/104092656004159577193/posts/EmEk18bLP9t https://plus.google.com/104092656004159577193/posts/EmEk18bL... No, it's not a "you can't win" situation. It's a case of not offering reasonable choices. (Discussed in context of Google as, while I cannot keep Facebook from sucking up my personal information, I can avoid putting it there myself.)