Slashdot Mirror
Facebook Introduces One-Time Passwords
angry tapir writes "Worried about logging into Facebook from a strange computer? There's now a way to get into the popular social network without entering your regular Facebook password. It's called a temporary password. To use it, users must list their mobile phone numbers with their Facebook accounts. They can then text a number from their phones and Facebook sends back a temporary password that is good for 20 minutes. The service will be available worldwide in the next few weeks."
Now can we please get one-time credit card authorisation?
Yet another way for a big Internet organization to collect phone numbers.
Slashdot, fix the reply notifications... You won't get away with it...
Wouldn't stealing your phone also give them loads of other personal information? And the first thing you think of is they will have your facebook account?
Starmen.net
but that limited password better come with limited privledges to protect the account from getting jacked.
This is why my phone has a PIN on it and can be remotely wiped. Actually this isn't why. I'm a lot more worried about the banking app, my address book, my calendar and probably a dozen other things... This is a nice tangential benefit to having a PIN and remote wipe on my phone. Seriously though. You think the first thing someone is going to do on stealing your phone is see if they can use it to get into your Facebook account?
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
And facebook gets your cellphone number. Good thing that fb is a reputable company ran by people of high integrity who would never abuse that information.
What they really need to do is add RSA Encryption to the account, then create an app for iPhone to get the key from. they could also create a dongle that people buy from for $6.95 and that way their accounts will be encrypted, and issue is solved. This is pretty much what Blizzard did with their WoW accounts.
Nom de dieu de putain de bordel de merde de saloperie de connard d encule de ta mere.
And facebook gets your cellphone number. Good thing that fb is a reputable company ran by people of high integrity who would never abuse that information.
How? It's a serious question. I had my phone number listed already, never saw any drawbacks. Of course, it can be abused, mostly by users, but that's when "don't be stupid" kicks in - don't befriend random people you know nothing about, adjust your privacy settings, etc. So how is Facebook going to abuse this information?
There's always the option of not putting sensitive information out there for the world to see on Facebook, and there is always DON'T USE THE SAME PASSWORD FOR SOCIAL NETWORKING AS IMPORTANT LOGINS. But hey that is too simple, I think I'll just give Facebook another piece of information about me that can be exploited...
Be carefull putting your mobile number in Facebook. I currently work for one of the worlds largest mobile telecoms as a CSR, and we just had a bit of training where we learned that your cell phone bill can be charged by a 3rd party game if you click and play the wrong one. Every day I remove "mobile download" 3-rd party charges because there is little obvious warning about playing some game will add a 9.99 monthly subscription because they where able to retrieve your cell phone via FB.
It's just getting worse, I wish there was a better way to educate people. Not because I care about people, but because I'm tired of having to remove the subscriptions ten times a day every day lol.
Maybe we DID take the blue pill. You wouldn't remember anyway.
The scary Facebook lack of privacy is highly exaggerated. I've had my number listed on my profile page for over two years now. I don't do anything out of the ordinary other than keep my info private to my friends only. Amazingly, nothing bad has happened because I listed a phone number on my page that I actually want people to have.
Well, few reasons.
1) Merchants love it because the customer gets stiffed with the charges (you can't chargeback a merchant if it was done via 3DS (3D Secure, aka Verified by Visa and MasterCard's equivalent). I only do VBV on a merchant I know. Unknown merchants, I'd probably trust Paypal a bit more.
2) It seriously screws up with NoScript. I keep forgetting to enable the 3rd party site which usually results in screwing up the checkout process.
3) It makes it harder to do "one-click shopping". If you're a merchant that gets a lot of impulse buys, the more steps betwen "I want it" and "We got your order, it'll be shipped soon!" is more chances the user will cancel the order prior to completion. (And this is a very important point)
4) It's extremely insecure, and can offer a great way to phish. Heck, we've got previous Slashdot articles on the subject. Why "Verified by Visa" system is insecure and Net Shoppers Bullied into "Verified by Visa" program.
5) Forgetting your password can get your credit card locked out.
Quite honestly, 3DS is just another form of Wish-it-was two-factor security. It pretends to be more secure, but in reality it isn't.
There are two ways to do it properly - you could SMS people a password, but that screws with people like me who don't always carry their cellphone around, or perhaps build in an RSA key thingy inside the card itself. Chip cards (which have their own issues - really - the PIN's in the chip and the chip sends an "OK" or "Failed PIN" response - not any form of challenge-response packet to the bank, who should know your PIN, not your card) have powerful enough processors to do some RSA token like task. Given we can buy a calculator for under a dollar, there's no real reason why we can't have credit cards with two-factor support on them (and no PIN needs to be stored - the card will generate a code based on the entered PIN which the bank can validate).
Sorry, but deleting one's account is not actually a solution for people who want to access their account.
The Quirkz Handbook of Self-Improvement for People Who Are Already Pretty Okay
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!