Slashdot Mirror
Facebook Introduces One-Time Passwords
angry tapir writes "Worried about logging into Facebook from a strange computer? There's now a way to get into the popular social network without entering your regular Facebook password. It's called a temporary password. To use it, users must list their mobile phone numbers with their Facebook accounts. They can then text a number from their phones and Facebook sends back a temporary password that is good for 20 minutes. The service will be available worldwide in the next few weeks."
Now can we please get one-time credit card authorisation?
867-5309 will give you a password of "Jenny"
Stupidity only gets you so far, then you've gotta try
Yet another way for a big Internet organization to collect phone numbers.
Slashdot, fix the reply notifications... You won't get away with it...
I don't think you know what a pyramid scheme is...
Wouldn't stealing your phone also give them loads of other personal information? And the first thing you think of is they will have your facebook account?
Starmen.net
but that limited password better come with limited privledges to protect the account from getting jacked.
More to the point, if you need your phone anyway, why don't you just browse facebook on your phone, like all my friends already do?
a lot of people who use have smartphones with a facebook app, so if someone steals the phone they already have access to your fb account.
I don't think you know what a Pyramid scheme is either...
Let's wikipedia it:
What you're describing on the other hand is just exploitation.
I've never heard that one before.
Now can we please get one-time credit card authorization?
You mean like my Discover More Credit Card offers me?
You have the option of re-using the same one for a retailer or just continually requesting a new one if your dealings with them are infrequent or shady.
My work here is dung.
Public labs at a university. While I have a hard time thinking of any time that I -need- to log into Facebook and can't just use, say, a smartphone app. There are a lot of occasions where in university you realize that there is something you need to do online (such as quickly type and turn in a paper you just remembered is due in 2 hours) but you can't trust the security of a lab computer (its pretty easy to install hardware keyloggers that just go between the PS2 or USB port and capture keystrokes) so you end up logging into an unsecured machine.
Taxation is legalized theft, no more, no less.
I barely have time left for my Serious Business on /.!!
This is why my phone has a PIN on it and can be remotely wiped. Actually this isn't why. I'm a lot more worried about the banking app, my address book, my calendar and probably a dozen other things... This is a nice tangential benefit to having a PIN and remote wipe on my phone. Seriously though. You think the first thing someone is going to do on stealing your phone is see if they can use it to get into your Facebook account?
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
When people want more security on their facebook, they usually mean protection from Facebook and other corporations - not passwords themselves.
How about fixing the lack of privacy instead?
If you've got a touchscreen phone, that PIN may be much less secure than you think.
http://tech.slashdot.org/story/10/08/11/128244/Touchscreens-Open-To-Smudge-Attacks
upon the advice of my lawyer, i have no sig at this time
The worst thing about VBV was not actually having it set up properly and then having a merchant require it compared to others that didn't. I had this happen to me when I was overseas trying to get internet and all of a sudden I got slammed by this Verified by VISA thing that wasn't setup and I could get internet to get the details I needed to get it set up (catch 22). Sounds like a good idea until it gets inconsistently applied in practice.
I always wondered where this setting was...
And facebook gets your cellphone number. Good thing that fb is a reputable company ran by people of high integrity who would never abuse that information.
What they really need to do is add RSA Encryption to the account, then create an app for iPhone to get the key from. they could also create a dongle that people buy from for $6.95 and that way their accounts will be encrypted, and issue is solved. This is pretty much what Blizzard did with their WoW accounts.
Nom de dieu de putain de bordel de merde de saloperie de connard d encule de ta mere.
And facebook gets your cellphone number. Good thing that fb is a reputable company ran by people of high integrity who would never abuse that information.
How? It's a serious question. I had my phone number listed already, never saw any drawbacks. Of course, it can be abused, mostly by users, but that's when "don't be stupid" kicks in - don't befriend random people you know nothing about, adjust your privacy settings, etc. So how is Facebook going to abuse this information?
And facebook gets your cellphone number. Good thing that fb is a reputable company ran by people of high integrity who would never abuse that information.
So use a Google Voice number, which includes text messaging for free.
Be carefull putting your mobile number in Facebook. I currently work for one of the worlds largest mobile telecoms as a CSR, and we just had a bit of training where we learned that your cell phone bill can be charged by a 3rd party game if you click and play the wrong one. Every day I remove "mobile download" 3-rd party charges because there is little obvious warning about playing some game will add a 9.99 monthly subscription because they where able to retrieve your cell phone via FB.
It's just getting worse, I wish there was a better way to educate people. Not because I care about people, but because I'm tired of having to remove the subscriptions ten times a day every day lol.
Maybe we DID take the blue pill. You wouldn't remember anyway.
The scary Facebook lack of privacy is highly exaggerated. I've had my number listed on my profile page for over two years now. I don't do anything out of the ordinary other than keep my info private to my friends only. Amazingly, nothing bad has happened because I listed a phone number on my page that I actually want people to have.
Well, few reasons.
1) Merchants love it because the customer gets stiffed with the charges (you can't chargeback a merchant if it was done via 3DS (3D Secure, aka Verified by Visa and MasterCard's equivalent). I only do VBV on a merchant I know. Unknown merchants, I'd probably trust Paypal a bit more.
2) It seriously screws up with NoScript. I keep forgetting to enable the 3rd party site which usually results in screwing up the checkout process.
3) It makes it harder to do "one-click shopping". If you're a merchant that gets a lot of impulse buys, the more steps betwen "I want it" and "We got your order, it'll be shipped soon!" is more chances the user will cancel the order prior to completion. (And this is a very important point)
4) It's extremely insecure, and can offer a great way to phish. Heck, we've got previous Slashdot articles on the subject. Why "Verified by Visa" system is insecure and Net Shoppers Bullied into "Verified by Visa" program.
5) Forgetting your password can get your credit card locked out.
Quite honestly, 3DS is just another form of Wish-it-was two-factor security. It pretends to be more secure, but in reality it isn't.
There are two ways to do it properly - you could SMS people a password, but that screws with people like me who don't always carry their cellphone around, or perhaps build in an RSA key thingy inside the card itself. Chip cards (which have their own issues - really - the PIN's in the chip and the chip sends an "OK" or "Failed PIN" response - not any form of challenge-response packet to the bank, who should know your PIN, not your card) have powerful enough processors to do some RSA token like task. Given we can buy a calculator for under a dollar, there's no real reason why we can't have credit cards with two-factor support on them (and no PIN needs to be stored - the card will generate a code based on the entered PIN which the bank can validate).
Sorry, but deleting one's account is not actually a solution for people who want to access their account.
The Quirkz Handbook of Self-Improvement for People Who Are Already Pretty Okay
That's the one where they steal your cellphone number, and use it to track your movements, then wait until you're all alone and kidnap you, taking you to the desert and forcing you to build giant pyramids all day, right?
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Since facebook does not ever come into scrutiny for your private information, I think that giving them your name, address, birthdate, current living city, and now phone number is a great idea. Now all we need to do is give them our credit card numbers and we will be set. For a website that ensures your data stays private, would could go wrong?
The world is how you make it