Slashdot Mirror
Facebook Adds Two-Factor Authentication
angry tapir writes "To help its hundreds of millions of users prevent unauthorized access to their accounts, Facebook has added an optional verification step to its log-in process. The new security feature, called Login Approvals, is a form of two-factor authentication."
That's like putting a steel door on a straw house...
As someone pointed out in the article comments; This enforces fb's agenda to have its users submit as much personal info as possible to them.
Give us your telephone number.
This isn't creepy at all.
Finally had enough. Come see us over at https://soylentnews.org/
"Because if they steal your private data, we can't sell it to them!"
This is where services like text+ shine: get an SMS throw away number and those future call center initiated contacts will get spam filtered.
This is Facebook, so the two factors are username and password.
"National Security is the chief cause of national insecurity." - Celine's First Law
To help its hundreds of millions of users prevent unauthorized access to their accounts
Is access by FB employees and TLA agents a form of authorized access or unauthorized?
Free, as in your money being freed from the confines of your account.
I wonder if that's available in the UK. It would be nice to know that its costing them money every time you log in.
Asking two different passwords isn't considered "two-factor" authentication.
There are three factors:
1) What I know (passwords, pin)
2) What I have (tokens, smartcards)
3) What I am (retina scan, fingerprint)
For two-factor authentication you will need to have two of the three factors. Facebook uses a password and a code. It doesn't matter if they're different, it's still just one factor (what you know).
Just give them your mother's maiden name and your SSN and get it over with. Might as well just have your paycheck auto-deposited into their accounts. That's what they really want. Please someone tell me this Facebook is a fad. Maybe between Facebook outright selling your privacy and the hackers stealing your identity the faceless masses of people using this thing will get burned enough to run off somewhere else. It's time to seriously setup the next Facebook for the sheeple, then get anonymous to attack the existing Facebook and steal everyone's info. Then when the sheeple respond with the inevitable knee-jerk reaction and leave Facebook, they'll only be looking for the next shiny/shiny to play with. So if you had FaceBook II setup and raring to go, instant net millionaires we will be. Who's with me? Any decent web coding monkeys out there?
This aint Daytona and you aint Dale Earnhardt. So stop trying to draft on Interstate 40.
So... rather then provide a fob or phone app to provide a "one-time" number that constantly changes, they'll SMS it to your phone. Well, it's not exactly instant and depending on network load can take a while (ok the 4 hour delays at new year are a bit of an exception from the norm). It seems to me that the "one-time" number has to remain valid for quite a while and every second would increase the vulnerability.
So now I have to trust them not to give out my phone number?
I heard that the two form authentication will involve both your password and verification that you've posted a derogatory story about Google to your blog.
Facebook already has millions of mobile numbers from its users. Just about everyone I know updates their facebook via sms or mobile app. In fact, the app on the HTC phone that my brother uses didnt even beat around the bush. When he connected the first time he created the account from his phone using what i suppose is his phone#@carrier address
"To help its hundreds of millions of users prevent unauthorized access to their accounts..."
Gee, that's nice Farcebook. Now, what exactly are you going to do about your privacy policies that change with the wind, forcing users to constantly monitor their settings to prevent "authorized" access?
Hard to feel safe in the car when you don't trust the driver no matter how many seat belts you have on.
So Facebook gets to ask it's unsuspecting users for their mobile phone numbers in addition to the other data they now spew out into the eager hands of crackers and marketeers?
Sweet.
"we will text your phone."
Because our admins are too stupid to remember that in the USA it costs money to receive text messages and not everyone is a tween that has unlimited texting on their phones K?
Do not look at laser with remaining good eye.
This sounds like a ploy to harvest phone numbers from well meaning (if ill informed) users who care about security and who previously hadn't surrendered their phone number to facebook.
Is there a valid reason for not offering the same service via email? Using, you know, the email address that facebook already has on record.
Yeah, we have two factor authentication. Don't worry, your account is safe. Nobody can access it except you, and us, and some of it from out advertisers, but nothing to worry about. Now give us more information we can sell.
Love
Facebook.
This will only insure that the data they collect on you is actually from you... there-by making it more valuable to the tens of thousands of businesses they then turn around and sell the information to.
Worth noting - when you supply a phone number (btw, my Google Voice number didn't work at all for this.. had to use my actual mobile #).. they immediately publish it on your profile.
Thanks Facebook! (i immediately removed it and disabled the feature)
Blessed be he who reads this post, Cursed be he who tells my boss.
that this is about getting the phone numbers - another way to access users and feed them delicious Facebook and approved 3rd party apps goodness, I'm sure.
Is it only me ..... facebook is trying to harvest personal phone number?
Kind of feels like that a scene in The Simpsons where Burns and Smithers walk through several layers of heavy security with lots of big heavy doors, only to end up in a little shed with an open door and a broken window. As long as I can click on a link and give an app the ability to write on my wall as me, with no explicit permissions to do so, I don't think extra password security is all that meaningful.
Except in this case the number needs to stay valid, otherwise you can't receive a text later on if you want to log in to facebook elsewhere.
Have you noticed how every news we get about "Two Factor Authentication" ALWAYS means "Mobile Phone Authentication"?
I don't know if you read TFA, I did so just to confirm it but could see it coming from miles away. It has come to be that you don't really have to ask what kind of "Two Factor Authentication" they are scheming because it always always always means "Mobile Phone Authentication"
But... the future refused to change.
Two factor login?
Q1: We will trawl your personal data to sell to advertisers, log in here...
Q2: Are you sure you want your details to be sold to advertisers? Log in here...
Take Nobody's Word For It.
2 factor is useless if you never log the hell out of facebook. I just want my flippin session to timeout after 30 min >_>
That's no good for those of us who don't have texting service on our phones. Who needs texting with a data plan (and IM readily available)?
"Who controls the past controls the future. Who controls the present controls the past." -- George Orwell
Its because most people already have a mobile phone, and thus they can offer this for free. They already have email verification though the "I forgot my password" process, so that wouldn't be newsworthy. What's the alternative, sending everyone a SecureID card? Should every website make you carry a keyfob to use it?
You're special forces then? That's great! I just love your olympics!
From the article:
Even interns like myself are tasked with big projects to help improve account security. Instead of working on mundane tasks and simple problems, interns are given high-impact assignments that reach out to hundreds of millions users every time they use Facebook.
They tasked an INTERN with security?!?
The covert threat is: you either submit your mobile phone number or we will not protect you anymore.
I keep the details I hand to FB to an absolute minimum, and my phone numebr is certainly not going to be added. The problem I see is that I have no way to disable SMS spam, so once FB decided to resell data again I might as well get a new number (with all the associated costs).
It would be smarter if they finally implemented OpenID support, because you can then simply choose the service that you deem safest. But hey, that would not supply even more private data, would it?
Nice try FB, but ab-so-lu-te-ly no way. I wonder how many idiots will fall for this..
Insert
I'd rather they allow authentication via google ID, so I can use google's more versatile two-factor auth.
Great way to encourage people to link their phone numbers with their accounts.
facebook.com still points to http://www.facebook.com/ by default, I'll wait for the headline when THAT changes.
And years ago have you ever noticed how "Two Factor Authentication" ALWAYS meant "token generator keyfob"? What's your point?
If openid were adopted more widely, you'd only need the one keyfob (or not at all depending on your provider)
Though as it looks like facebook is likely to fill the niche that openid was intended for if things continue as they are, if facebook did this, that may be sufficient.
Not always. http://tiqr.org/ sounds interesting (droid and iDevice only atm)
At work, we have a server that has sensitive information on it and is only accessible to 2 people. The only service it runs is ssh. The server can be accessed from the outside, but it only whitelists a few ip address, and every other ip address is denied. Only a few people are given access to the server, and password authentication is not allowed, but rather they must use public key authenication. The 2 system admins keep the private keys themselves, and private keys are protected with a strong password. Is this 2-factor authenication, because it's something you have (private-key), and something you are (a certain ip address)? Isn't it technically 3-factor authenication because you also have to have a password to unlock the private key (something you know) ?
||facebook.com^$third-party,domain=~fbcdn.net,domain=~facebook.com
||facebook.net^$third-party,domain=~facebook.com,domain=~fbcdn.net
||fbcdn.net^$third-party,domain=~facebook.com,domain=~facebook.net
It's easy to get different email addresses, but difficult to get multiple phone numbers. Maybe this is to address advertisers concerns that their user base isn't as big as they claim.
Even interns like myself are tasked with big projects to help improve account security. Instead of working on mundane tasks and simple problems, interns are given high-impact assignments that reach out to hundreds of millions users every time they use Facebook.
No offence, but I don't like the idea of Facebook interns working on security features when the core developers themselves can't seem to do it right.
They can go to hell. I don't want them having my phone number. Fail, fail, fail.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
They requested my phone number for YouTube. The only thing I cared about on it was my favorites list, which wasn't that big and I was able to download it with some careful copy-paste in the browser.
I haven't logged into my YouTube account since then.
Giving them a phone number probably creates an "existing business relationship", which allows them to telemarket you.
Anonymous delivers!
But... the future refused to change.
It’s great that Facebook is strengthening security by using two-factor authentication. People share so much personal information on Facebook that relying on a single layer of password protection is simply not enough. However, sending a code by SMS text message is not very secure because they are sent in clear text. If the user were to lose their phone or have it stolen, anybody could read that text message and fraudulently authenticate.
More websites need to use two-factor authentication like Facebook is doing, but a more secure and easier-to-use approach is to send an image-based authentication challenge to the user’s phone, like Confident Technologies provides: http://bit.ly/dMNzB5. A grid of pictures is displayed on the user’s smartphone and to authenticate, the user must correctly identify the pictures that fit their pre-chosen, secret categories. Even if someone else had possession of your phone, they wouldn’t be able to authenticate because they wouldn’t know your secret picture categories.