Slashdot Mirror


Facebook "Trusted Contacts" Lets You Pester Friends To Recover Account Access

alphadogg writes "Facebook Thursday said it's making available globally a feature called 'Trusted Contacts' that lets users select three to five friends who can help users recover account access such as if they forget their password. Facebook said the idea is that once these friends are identified as 'trusted contacts' through the user's security settings, Facebook will provide each of them with a special code. 'Enter the codes from [at least 3 of] your trusted contacts, and you'll be able to access your account,' Facebook says. 'After you set your trusted contacts, we'll notify them so that they can be ready to help you if you ever need it.'"

114 comments

  1. Security by LordLucless · · Score: 5, Interesting

    That sounds like a really good idea; adding a human element to password recovery using already established trust relationships. Of course, slashdot wouldn't be slashdot if we didn't try and skew reader response by painting it as "pestering".

    --
    Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
    1. Re:Security by markus_baertschi · · Score: 4, Insightful

      I agree, I find this an excellent password recovery scheme. It does not protect against a bad choice in friends, but there are no technical protections possible against that. But for password recovery it is very good and quite safe against abuse by anonymous internet hackers.

    2. Re:Security by Chrisq · · Score: 3, Interesting

      It does not protect against a bad choice in friends

      I would imagine that Facebook account access is the least of your problems if you have a bad choice of friends.

    3. Re:Security by Anonymous Coward · · Score: 0

      Not only a good idea, but it's a really elegant solution for social networks. Nice work, Facebook!

    4. Re:Security by Anonymous Coward · · Score: 5, Insightful

      It's also excellent at providing Facebook data which of your friends are close friends. Very useful to charge advertisers more for fake likes from trusted friends who are more likely to have a bigger impact.

    5. Re:Security by teslar · · Score: 4, Interesting

      I suppose the one worry is that if someone has the ability to impersonate your e-mail and has access to your friends list, he could then impersonate you and ask *all* your friends for codes. The attacker doesn't need to know who the trusted friends are since your circle of friends would not easily be able to detect that everyone's been contacted. The attacker may mine the publicly available info on the friends to personalise the message a bit, if not, keep it short and very simple. It's not like this request would come in a long personal message anyway. It IS likely that it will come by e-mail though since you'll already be at the computer, trusted friends may be around the globe and so on. In short, you need your friends to be capable of detecting an impersonation attempt, even if brief and potentially conveying a sense of urgency. Remember, your trusted friends may be the same people who click on links that appear to be from you *because* they trust you. So in summary, while I do think this is pretty neat, I also wonder if this is not rather vulnerable to social engineering (perhaps not so much among the /. crowd - but generally)?

    6. Re:Security by LordLucless · · Score: 2

      Which is still a step above the current state of affairs. It relies on somebody being able to gain access to your email address; currently, if that happens, you're screwed anyway.

      --
      Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
    7. Re:Security by petermgreen · · Score: 1

      Worse than that with the rate at which many people change email addresses you probablly don't even actually need access to the victims real email address, just an address that looks sufficiently plausible that the contacts think it's the victim.

      If you are going to use this feature and want your account to remain secure you need to carefully instruct the friends on when they should and should not give out the code (preferablly in person only) and make sure that you can trust them to follow those instructions. Sadly I doubt that will happen in most cases.

      --
      note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
    8. Re:Security by Anonymous Coward · · Score: 0

      I agree, I find this an excellent password recovery scheme. It does not protect against a bad choice in friends, but there are no technical protections possible against that. But for password recovery it is very good and quite safe against abuse by anonymous internet hackers.

      Yes of course it is, because after all, hackers always use the front door, politely knocking three times.

      I don't care how much lipstick you want to slap on that pig when the best defense is to not own a pig at all.

    9. Re:Security by Isaac+Remuant · · Score: 3, Insightful

      There's already 5000 ways for them to discover what friends are more relevant to you, though.

      They can analyze your interactions, your views of someones profiles/walls, your clicks on their shares, your groupings or other customized settings...

      I don't think this is the sort of feature that will have so much adoption as to matter in that sense.

      --
      "Science can amuse and fascinate us all, but it is engineering that changes the world. " - Asimov.
    10. Re:Security by Isaac+Remuant · · Score: 1

      He said impersonate, not actually access. I'd imagine a decent email service would catch email spoofing though, and tricking 3 people without them getting in contact with the account holder doesn't seem likely either.

      --
      "Science can amuse and fascinate us all, but it is engineering that changes the world. " - Asimov.
    11. Re:Security by LordLucless · · Score: 1

      I guess, as long as your friends just send the reply email without noticing that it's addressed to someone else entirely.

      --
      Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
    12. Re:Security by Joce640k · · Score: 1

      I don't think 'pestering' people worries Facebook in the slightest.

      OTOH this is several orders of magnitude better than "What's your favorite color?". I almost like it.

      --
      No sig today...
    13. Re:Security by arth1 · · Score: 1

      It does not protect against a bad choice in friends, but there are no technical protections possible against that

      Sure there is. Ditch the "electronic friend" concept. It's as fake as "pages" on a web page. Real life doesn't translate into the bitworld, and trying to shoehorn the concepts in is just causing problems.
      Trust is to be earned, not given away for a smiley.

    14. Re:Security by daveewart · · Score: 3, Insightful

      Just because you trust someone to be _trustworthy_ doesn't mean that you trust their _opinions_. For example, I would trust some members of my family to not abuse having a house key, for example; wouldn't stop them from talking nonsense I don't agree with, though :-)

      --
      "If you think the problem is bad now, just wait until we've solved it." --- Arthur Kasspe
    15. Re:Security by nospam007 · · Score: 1

      "OTOH this is several orders of magnitude better than "What's your favorite color?". I almost like it."

      Nobody uses that anymore. It has been replaced by:
      "What is the air speed velocity of an African Swallow?"
      Ages ago.

    16. Re:Security by arth1 · · Score: 3, Informative

      Not only a good idea, but it's a really elegant solution for social networks. Nice work, Facebook!

      Either you're trolling, or you really have a weird definition of "elegant". This is highly exploitable through social engineering, and also is a very inelegant solution for those who currently don't have three trusted online "friends", or those who no longer trust one, and have to give them the digital equivalent of a face slap by removing the assigned trust.

      I think this is slightly more elegant:
      Write your password on a piece of cardboard. Fold it, and put it in an envelope. Mail it to a relative, saying it's your password for [service], and not to be opened unless you ask or you're dead.
      You don't need to hunt down three friends. You don't have to give facebook information about who you trust. And you're covered even if you die.

    17. Re:Security by Culture20 · · Score: 1

      I'm betting a From: "Lucless, Lord" would fool more than half of your list, especially if your friends use a client that only shows the portion in quotes without any digging. That's still good odds even if they're focusing on one account.

    18. Re:Security by Anonymous Coward · · Score: 0

      There's already 5000 ways for them to discover what friends are more relevant to you, though.

      They can analyze your interactions, your views of someones profiles/walls, your clicks on their shares, your groupings or other customized settings...

      I don't think this is the sort of feature that will have so much adoption as to matter in that sense.

      You don't think this sort of way will be, huh?

      Care to comment on "way" #5000 then, or the 4,999 behind that one?

      Not sure if it's simply pure ignorance or perhaps an exposure to Facebook radiation that has brought you to the conclusion that there will not be a 5,001, and 50,000 more ways after that.

      Bottom line is there is always a reason a business engages in cost activity, and it's usually to recover that cost, and more. If they had a way to extract whom you truly trust within your "inner circle" of 472 friends you hardly ever see IRL, then they wouldn't be asking for it now.

    19. Re:Security by fearofcarpet · · Score: 1

      But doesn't this approach just create another vector for social-engineering attacks? If any of my emails accounts are compromised, my phone is stolen, some malware gets a hold of my address book, etc., what stops a hacker from sending an email to everyone on my contact list asking for my secret Facebook codes? The chances are pretty high that the three extra-special friends on Facebook are also in your email/<insert social app> address lists.

      TFA says “Choose people you can reach without using Facebook, ideally over the phone or in person, since you’ll need to contact them when you can’t log in.” I think the odds are pretty high that someone you know in person or whom you talk to over the phone would not hesitate to send you the code after getting an email from "you" that says "Hey, I got locked out of FB, can you send me your code? Thanks."

      --
      Actually, I wrote my thesis on life experience.
    20. Re:Security by Anonymous Coward · · Score: 0

      isn't that the point here? there are now so many connections between people on facebook that facebook can't tell which ones are genuine...they need a new system to determine who is close friends with whom...

    21. Re:Security by Thud457 · · Score: 2

      OH YEAH, this is a BRILLIANT idea!
      Let's just add in another handful of vectors for phishing attacks. With people with less familiarity to your personal information and less incentive to exercise diligence.
      I see NO possible FLAW with that plan!&
      </boggle-eyed Homer simpson over the top sarcasm>

      --

      the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff

    22. Re:Security by PopeRatzo · · Score: 1

      there are now so many connections between people on facebook that facebook can't tell which ones are genuine...they need a new system to determine who is close friends with whom...

      Now tell me why I would want Facebook to know who my close friends are.

      --
      You are welcome on my lawn.
    23. Re:Security by Hotawa+Hawk-eye · · Score: 1

      Not only a good idea, but it's a really elegant solution for social networks. Nice work, Facebook!

      Either you're trolling, or you really have a weird definition of "elegant". This is highly exploitable through social engineering, and also is a very inelegant solution for those who currently don't have three trusted online "friends", or those who no longer trust one, and have to give them the digital equivalent of a face slap by removing the assigned trust.

      I think this is slightly more elegant:
      Write your password on a piece of cardboard. Fold it, and put it in an envelope. Mail it to a relative, saying it's your password for [service], and not to be opened unless you ask or you're dead.
      You don't need to hunt down three friends. You don't have to give facebook information about who you trust. And you're covered even if you die.

      If you're worried about what happens in the event of your death, shouldn't you give that envelope to your lawyer instead, to hold as part of your will? Wouldn't that make it covered by attorney-client privilege and accessible only to you or those to whom you've given power of attorney (or the person you indicated in your will, after your death?) Sure, it's not quite as easy to access (you'd hopefully have to satisfy a high bar in terms of proving who you are to get access to it) and may not be worth it for your Facebook password, but may be for other passwords (bank account, investment account, etc.)

    24. Re:Security by Anonymous Coward · · Score: 0

      adding a human element to password recovery

      It's reasonable from the security perspective, but more importantly, it reduces Facebook's support costs, and probably will provide better outcomes for users than Facebooks' staff can provide. It passes the solves-multiple-problems test, but improving Facebook's profit margin is certainly why it's here.

    25. Re:Security by Isaac+Remuant · · Score: 1

      I'm downplaying the effectiveness. I'm not saying FB is not out to get every last bit of info out there. If you're very privacy conscious, there's quite a number of things you should be looking out before this one.

      Btw, Thanks for the free insult, it's always good to see ACs being tough guys.

      --
      "Science can amuse and fascinate us all, but it is engineering that changes the world. " - Asimov.
    26. Re: Security by Anonymous Coward · · Score: 0

      Why would they open it if you're dead? Because you're so elegant

    27. Re:Security by knorthern+knight · · Score: 1

      > I think this is slightly more elegant:
      > Write your password on a piece of cardboard. Fold it, and put it in an envelope. Mail
      > it to a relative, saying it's your password for [service], and not to be opened unless
      > you ask or you're dead. You don't need to hunt down three friends. You don't have
      > to give facebook information about who you trust. And you're covered even if you die.

      Wrong, wrong wrong.
      1) Your relative may die, or lose contact with you

      2) or the relationship may sour. And he's got your password(s). Dumb.

      Use a safety-deposit box instead. You're not relying on a human being, which makes this better.

      --

      I'm not repeating myself
      I'm an X window user; I'm an ex-Windows user
    28. Re:Security by Luckyo · · Score: 1

      It appears to be like leaving your spare keys with a friend you trust that lives nearby. Makes sense.

    29. Re:Security by knorthern+knight · · Score: 2

      > I'm downplaying the effectiveness. I'm not saying FB is not out to get
      > every last bit of info out there. If you're very privacy conscious, there's
      > quite a number of things you should be looking out before this one.

      If you're very privacy conscious... then you're not on Facebook in the first place.

      --

      I'm not repeating myself
      I'm an X window user; I'm an ex-Windows user
    30. Re:Security by netsharc · · Score: 1

      It'd be more interesting to send parts of the password to different people. So for example 3 people out of a group of 7 would have to join their parts to get the whole password. Redundancies are there in case some of the people fall off the face of the planet. Ideally you'd find 7 people where no three of them would join up to conspire against you -- that is admittedly very hard.

      I'm sure there's a mathematical function to split up a piece of information so that 3 out of 7 pieces is enough to restore it. How to do it is an exercise left for the reader.

      --
      What time is it/will be over there? Check with my iPhone app!
    31. Re:Security by networkBoy · · Score: 1

      There is a crypto system for that. Schneier explained it in Applied Crypto.

      Basically the trick is that of 7 keyholders you need at least 5 (or some other number) that will all enter their key to sign or authenticate data. This can be extended to the signature applied to null (or any other chosen value) being used as the key for an encrypted volume.

      It is the system we use at my work to sign software. There are M keyholders with a minimum number of N required to sign the software.

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    32. Re:Security by Anonymous Coward · · Score: 0

      Ha! Sounds like distributed incompetence to me.

    33. Re:Security by dmitrygr · · Score: 2
      --
      -------
      1. Enjoy your job
      2. Make lots of money
      3. Work within the law

      Choose any two.
    34. Re:Security by arth1 · · Score: 1

      Wrong, wrong wrong.
      1) Your relative may die, or lose contact with you

      2) or the relationship may sour. And he's got your password(s). Dumb.

      1: You would know that, and can change the safeholder.
      2: You would know that, and can change the password.
      3: Yes, you are.

    35. Re:Security by arth1 · · Score: 1

      If you're worried about what happens in the event of your death, shouldn't you give that envelope to your lawyer instead, to hold as part of your will?

      Hell, no. I have just gone through the death of a family member. With no disputes, the lawyer ended up with more money from the estate than most of the bereaved did.
      I want a will that says "Any person who engages a lawyer inherits exactly nothing".

      As the saying goes, first we start by...

    36. Re:Security by LordLucless · · Score: 1

      but improving Facebook's profit margin is certainly why it's here.

      Well, yeah. But that's not a bad thing. This is capitalism working exactly as it's supposed to: company desires to increase profit, company creates a feature that benefits those using their services, company increases profit. It's wins all round, and is a refreshing change from the usual perverted capitalism we see these days, that revolves around captive audiences and legislative lock-ins.

      --
      Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
    37. Re:Security by Anonymous Coward · · Score: 0

      The only people interested in locking you out of your facebook profile are your "friends". Or at least that sounds like something a highschooler (or below) would do. Given who's at risk, I seriously doubt people will entrust the recovery codes to 3+ friends who are in completely different social circles and don't know each other.

    38. Re:Security by DerekLyons · · Score: 1

      Let's just add in another handful of vectors for phishing attacks. With people with less familiarity to your personal information and less incentive to exercise diligence.

      Again, that comes down to your choice of friends - something there's really no technical solution for.
       
      This trusted contact scheme would work well for me, because I'll just mark as trusted the people who either a) already have keys to my house, or b) know the location my spare key is hidden.* Every one of them are type that, when they get the email from Facebook are going to call me and ask what's up before authorizing the release of the code.
       
      * Given sufficient time, another geocacher might find it. Anyone else? Extraordinarily unlikely.

  2. Collusion? by heypete · · Score: 5, Insightful

    While I'd hope that people would trust their friends to not abuse a privileged position in order to gain access to one's account, it's probably a good idea to pick friends from different, non-overlapping social circles to make it difficult for them to know who other "trusted" people for one's account are.

    1. Re:Collusion? by mwvdlee · · Score: 1

      Non-overlapping social circles give Facebook more information than overlapping social circles.
      If enough people use this feature, overlapping gives them circles of friends, non-overlapping gives them a network of interconnected circles of friends.

      Imagine a group of six friends, each chosing only eachother as "trusted contacts"; facebook will know only the small circle.
      Imagine a number of six-friend groups, each chosing a one of each group as a "trusted contact"; facebook will still be able to reconstruct a number of small circles.

      --
      Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
    2. Re:Collusion? by heypete · · Score: 1

      Ok, but what information does that give Facebook? They already know people's social connections due to people "friending" each other.

      My point was more "Leaving aside the privacy issues related to the use of Facebook and its specific implementation, in general people should choose diverse 'trusted contacts' from separate social groups so the odds of multiple friends colluding to get enough codes to gain access to one's account is minimized."

    3. Re:Collusion? by Anonymous Coward · · Score: 0

      If you assume an adversarial relationship with Facebook to begin with, you'd probably be best off not using it at all.

      Hence, I don't see an issue.

    4. Re:Collusion? by MadKeithV · · Score: 1

      I find that 5 friends from a non-existent social circle are even more secure.

    5. Re:Collusion? by Anonymous Coward · · Score: 0

      I am forced to use it. Given a choice, I'd use something less nasty like VK (ironic that given the location).

      However, if I want to know about events, I have to have FB. If I want to deal with some private groups, I have to have FB for their discussion forums. If I want a job, I have to have FB because they want friend access, or want my username and password before my resume hits anyone's desk. If I want to listen to music on some larger music networks, I need a FB account.

      FB is such a core in communication that yes, one *can* not use it, but it would just be like having no Internet access -- it can severely cripple a person's social and professional life.

  3. Is this new? by Nbrevu · · Score: 5, Funny

    Facebook [..] Lets You Pester Friends.

    Wasn't that already its primary use?

    1. Re:Is this new? by Anonymous Coward · · Score: 0

      No, the primary use is the poke them. Err, is that even an option any more? I'm confused.

  4. Re:Does anybody care? by Anonymous Coward · · Score: 1
    I use Facebook quite actively, which means that I check my account perhaps 10-12 times per day. Why?
    1. It's an easy way to keep in touch with people I know, even though I don't know the email addresses or phone numbers of most of them. Actually, even when I do have their phone number or mail address: most people check their Facebook account more frequently than their mail account, and many even have access to Facebook from their cell phone. (The chat technology is actually just XMPP, so it isn't "evil" in any way either).
    2. It's where most people upload their photos. For instance, I was recently on a three-week interrail trip to Japan with three friends, and all of them uploaded their best images from the trip to Facebook. The same happens with family trips, special parties, etc.
    3. It's where half of my party invitations come in. If you're hosting a party with >20 people, it's simply easier to make a Facebook event, invite people, and see who says they're attending/maybe/not attending than actually calling/texting one and one person in order to invite them and check if they can make it.
    4. It's a decent way to procrastinate. People are always posting silly Youtube-videos, interesting articles, and whatnot, so if you're taking a 10 minute break from work, it's a decent way to relax.

    I'm not trying to convince you to start using Facebook; I'm just saying that yes, some people on Slashdot use Facebook, and we have our reasons.

  5. Teen Drama in 5 4 3 2 1 by phizi0n · · Score: 1

    I'm sure there will be plenty of young people pranking each other by hijacking their friends' accounts (or former friends) with this.

    1. Re:Teen Drama in 5 4 3 2 1 by Grantbridge · · Score: 3, Interesting

      There are plenty of young people pranking each other by hijacking their friend's accounts without this! Leaving yourself logged in on a laptop/phone is considered permission to update your status to something "hilarious". I don't think this is going to increase hijacking.

    2. Re:Teen Drama in 5 4 3 2 1 by mwvdlee · · Score: 1

      For that to happen, the "friends" must have (A) physical access to the device and (B) a logged-in account.
      With this "Trusted contacts", the friends need neither to hijack an account, they just needed to be sufficiently trusted in the past.

      I'm much more worried about previously trusted ex-girlfriends getting together... (or rather; I would be).

      --
      Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
    3. Re:Teen Drama in 5 4 3 2 1 by Anonymous Coward · · Score: 0

      Why would you delegate your 5 ex girlfriends as the gatekeeper to your Facebook page? I don't trust any of my ex's, let alone give them all access. Your comment is bad and you should feel bad.

    4. Re:Teen Drama in 5 4 3 2 1 by Hotawa+Hawk-eye · · Score: 1

      1) Get your friends together for a party (especially a bachelor or bachelorette party.)
      2) You and your friends get drunk.
      3) Your (drunk) friends decide it would be "fun" to access into your Facebook account and post naughty message as you.
      4) ???
      5) Prof... *ring ring* Hi, Grandma. What? There's a picture of my naughty bits on my Facebook page? No there isn't! *check* What the?!

  6. Re:Does anybody care? by Tridus · · Score: 3, Insightful

    Probably nobody does in that cave you're hiding in, but out here in the world? Yeah, there's a couple people still using it, give or take millions.

    --
    -- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
  7. better solution by Anonymous Coward · · Score: 0

    remember your unique password^H^H^H^Hphrase so recovery is never needed. when you login 10 times a day, every day, how long does it take to remember: correct horse battery staple.

    people already use friends to hijack accounts, this will be NO DIFFERENT.

  8. This is a social gimmick by EmagGeek · · Score: 5, Interesting

    It creates yet another layer of "friendship exclusivity" in the Facebook social world. You have "friends" already, but now you can have "OMG BFF!" people as well, and some will feel accepted or rejected based on whether they are one of your "chosen few."

    This is, of course, the intent - to create more hype and drama, and even more important, yet another vehicle for narcissism to flourish.

    1. Re:This is a social gimmick by DKlineburg · · Score: 1

      Or they as said above will continue building a bigger database about you, your friends, and anything you do. The data isn't evil, what they do with it might be.

      --
      Memory is deceptive because it is colored by today's events. - Albert Einstein
    2. Re:This is a social gimmick by Isaac+Remuant · · Score: 1

      mmm... I saw it more in terms of some sort of extra authentication and it doesn't seem to be obligatory so I don't know why people are complaining that much.

      --
      "Science can amuse and fascinate us all, but it is engineering that changes the world. " - Asimov.
    3. Re:This is a social gimmick by mrbester · · Score: 1

      Best part is you have to wait until you receive the codes (how?) from these friends in order to access your account. What if one friend is off line because they've gone backpacking in the wilds of NoInternetLand for a month? What if they take their time responding (you're BFFs but you had a disagreement)? What if you don't receive the response?

      You're stuffed using this method as there are too many points of failure.

      --
      "Wait. Something's happening. It's opening up! My God, it's full of apricots!"
    4. Re:This is a social gimmick by Anonymous Coward · · Score: 0

      Someone who goes so far as putting 'Geek' in their nickname, their online identity, is griping about social networking and friends. Shocker!

      Hurr durr basement dwellers still don't get Facebook. Shocker!

    5. Re:This is a social gimmick by MiKM · · Score: 1

      According to the summary and article, you only need three of five codes. I suppose of 3 of your friends are out-of-contact, then you're SOL for the time being, but I suppose that is better than having a weaker, easier-to-compromise system. When choosing your five friends, it might be wise to select people from different circles of friends to decrease the likelihood that multiple trusted contacts are out-of-reach at once.

    6. Re:This is a social gimmick by ddrueding80 · · Score: 1

      Close, but not quite. This creates another tier so that Facebook knows which of your 12 million friends are your closest. This is valuable information that they will be able to capitalize on.

    7. Re:This is a social gimmick by LordLucless · · Score: 1

      It creates yet another layer of "friendship exclusivity" in the Facebook social world. You have "friends" already, but now you can have "OMG BFF!"

      Actually, you could do that already, far more effectively, using Facebook groups. My friends can see what I post, but by OMG BFFs (although, I called them "acquaintances" and "friends" respectively) can see my real world contact details, and other info.

      --
      Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
  9. But... by shitzu · · Score: 5, Funny

    But I do not have 3 friends you insensitive clods!

    1. Re:But... by Anonymous Coward · · Score: 0

      You're joking, but I actually don't. I don't like facebook, but I have two friends who insist on using it so I have a profile with just the two of them added as friends.

    2. Re:But... by MMC+Monster · · Score: 1

      You don't need three friends.

      You just need three Facebook Friends.

      --
      Help! I'm a slashdot refugee.
    3. Re:But... by Voyager529 · · Score: 1

      Best. Response. Ever.

  10. Re:Does anybody care? by Mike+Frett · · Score: 1

    I don't know about him, but I'm very happy in my Cave.

  11. Re:SSteps...ecurity by djsmiley · · Score: 1

    1. Hack account
    2. Add your own friends
    3. Set as trusted friends...
    4. Success?

    --
    - http://www.milkme.co.uk
  12. Re:Does anybody care? by Isaac+Remuant · · Score: 3, Insightful

    Yes. There is a real world outside of your room. People socialize. It might be hard to recognize it from the center of the universe you are in but it happens.

    --
    "Science can amuse and fascinate us all, but it is engineering that changes the world. " - Asimov.
  13. Nuclear Launch Codes by rodrigoandrade · · Score: 2

    Isn't this security measure a bit overkill for a stupid social network site??

    What's next? All 3 to 5 friends will have to enter their codes simultaneously to recover the lost account?

    1. Re:Nuclear Launch Codes by gnasher719 · · Score: 1

      What's next? All 3 to 5 friends will have to enter their codes simultaneously to recover the lost account?

      No. Three out of five friends need to enter codes. I thought most people posting on Slashdot would know about codes where n out of m keys are needed to uncover a secret. (For example, for 3 out of 5 the keys would be points on something similar to a 2nd degree polynomial; with two points you have no idea what the polynomial is, with three or more points you can reconstruct it).

    2. Re:Nuclear Launch Codes by Anonymous Coward · · Score: 1

      It's not overkill at all. It's a relatively simple decentralized scheme for doing password resets. It sits between the reset processes that that only require the user and the ones that require someone at FB to do something. It should take a significant load off of the people at FB, probably be quicker for the user, and might even provide a gentle shaming of people who lose their password too often. It seems like a pretty smart plan.

    3. Re:Nuclear Launch Codes by Etcetera · · Score: 1

      If it's good enough for the root zone of DNS, it's good enough for my friends list.

    4. Re:Nuclear Launch Codes by Hotawa+Hawk-eye · · Score: 1

      What's next? All 3 to 5 friends will have to enter their codes simultaneously to recover the lost account?

      No. Three out of five friends need to enter codes. I thought most people posting on Slashdot would know about codes where n out of m keys are needed to uncover a secret.

      And if you don't, there's a Wikipedia page listing a number of different systems.

    5. Re:Nuclear Launch Codes by Anonymous Coward · · Score: 0

      Good God man! Don't you see this for its value to FaceFook? This is yet another way to establish a hierarchical measure of your personal social network nodes. Understanding the assignment of trust is valuable and it can be studied, manipulated and monetized. There are already simple technological solutions to the problem of recovering a lost password; an alternative email address, a PIN or security questions suffice nicely. No one here actually believes it would be an improvement to distribute access to others... do they?

      This is perfect fodder for politicos. Knowing who you trust in order to sway you could be a key to unlocking the billions spent on political advertising for the FaceBookees.

  14. Almost had the best Slashdot title ever by Anonymous Coward · · Score: 1

    s/Friends/Chums/

    You were so close.

  15. It's not about YOU stupid. by hebertrich · · Score: 1

    Having " friends" instead of having a system saves FB money. Just another scheme .. ok now

    It's all about profit. Now that the ice is broken ,i ask : when will FB users catch on and ask for their share of the money their data makes ?
    Yes YOUR data makes THEM money , you get nothing in return . The Service ? LOL it's the tool they use to get your data that earns them money , it's not a service for you it's their tool to rake in the dough . They make billions with YOUR data . Wake up and send a letter to FB asking your share of the earnings. What they sell is YOU after all. Why not ask for fair return ? You accept to give them data , they need to accept to pay YOU for it.
    All services that say " access to the service " is their way of repaying you are simply exploiting you. They count the smokescreen protects them from you finding out that their " service " is the tool they use to gather data and sell you . Wakee wakee . Cat's out the bag. Ask for your share of the profits everytime they sell your data. Why would anyone accept their lives be scrutinised , analysed then sold for free ? If i put it that way it don't sound good does it ? But that's what each and everyone participating in " social networks " or where the " service " is the reward falls for.

    Ask for your share of what's rightly your's.

    1. Re:It's not about YOU stupid. by RackinFrackin · · Score: 2

      you get nothing in return

      FB users get a significant amount of utility out of Facebook, and of course it comes at a cost. It looks extremely lop-sided because there's only one facebook and there are a billion or so users, but saying that users get nothing from it is just as stupid as saying that it costs users nothing.

    2. Re:It's not about YOU stupid. by Anonymous Coward · · Score: 0

      On a scale from 0.0 to 1.0 they get something like 0.000000000000001 utility out of Facebook, but since it doesn't cost a monthly fee that's enough a reason for them to use it.

    3. Re:It's not about YOU stupid. by Anonymous Coward · · Score: 0

      That makes no sense at all.

  16. Brain Fart by StoneyMahoney · · Score: 2

    This is supposed to be a security... enhancement?! How many people do you know on Facebook who would "recover" your password, change your profile picture to the photo they took of you in drag being touched up by a biker, change your status to Dead and start inviting people to your funeral? Because that's the vast majority of my friends - I'd trust them with my life but wouldn't dream of trusting them with £5. Or my beer. Or access to my Facebook accou - ohhhhhhh wait!

    1. Re:Brain Fart by Anonymous Coward · · Score: 2, Insightful

      I know lots of those people, but they are not my trusted friends. If you have no true trusted friends, don't set any on facebook. It's not mandatory.

    2. Re:Brain Fart by Anonymous Coward · · Score: 0

      All three of these people would have to collaborate, and I doubt facebook is telling those three who the other two who received codes are.

    3. Re:Brain Fart by briancox2 · · Score: 1

      I am not concerned with the quality of my friendships. I am concerned with the quality of the computer security practiced by those friends.

      How many compomised computers are there in the world? How many successful Facebook phishing campaigns have there been? The trackrecord of my friends asking for computer support because they didn't know what they were doing is alarming. I think that my personal security policy will remain unchanged because of this option: only trust ME!

      --
      We should learn what we need to know about issues, before we decide what we need to feel about them.
  17. Re:Does anybody care? by flimflammer · · Score: 1

    I'm curious if you wrote that with a big grin on your face or if you genuinely believe that Facebook is having issues with maintaining its dominance.

  18. Hijacking opportunities for malicious "friends". by genocism · · Score: 1

    Interesting, so three of your "best friends" could work together to reset your password and gain access to your facebook account? In middle and high school enemies and friend change quickly. This could create some nice hijacking opportunities for malicious "friends".

  19. Re:Does anybody care? by arth1 · · Score: 2

    Yes. There is a real world outside of your room. People socialize.

    Yes, there is a real world out there. As opposed to Facebook, which you mostly access from your room.

    Yes, people socialize. Have meals together, go dance, study together, play and sing, and much more. But it happens in "the real world outside of your room".

    Sure, you can use Facebook to facilitate much of that, but you can do that with a phone or a car or e-mail too. Yet that doesn't make people think that the phone or car or mail server is the venue.

  20. Once it starts to roll by Anonymous Coward · · Score: 0

    Assuming friends have overlapping friends and some of these overlapping friends are naturally trusted better than others, wouldn't once you get the ball rolling and get 3 passwords somehow, you be able to start getting passwords of a whole friends group soon?

    Of course getting 3 passwords may be hard. And even then its hardly a guarantee that those 3 will have the keys you need to unlock other accounts.

    And of course, you better make sure you can trust your trusted friends really well.

  21. Not worse than other password recovery schemes. by 140Mandak262Jamuna · · Score: 1
    Looks like Facebook gives special codes to three to five designated people. Then if you forget your facebook password, you contact them, may be outside facebook and through some kind of channel via face book and get the codes. If you are able to collect three such codes, facebook restores your password. This is not any worse than asking for the nickname of your younger brother or the name of your pet or the mother's maiden name. In fact facebook has thoroughly undermined these stupid security questions.

    For some reason the banks and credit card companies are very friendly on phone. They seem to trust the caller id and an actual human being on the phone.

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    1. Re:Not worse than other password recovery schemes. by Mr.+Slippery · · Score: 1

      For some reason the banks and credit card companies are very friendly on phone. They seem to trust the caller id and an actual human being on the phone.

      It's worth nothing that the ANI that your bank gets when you call their 800 number, is different than the "caller ID" service you might have on your home phone. Caller ID is much easier to spoof.

      --
      Tom Swiss | the infamous tms | my blog
      You cannot wash away blood with blood
  22. No Comment by Anonymous Coward · · Score: 0

    This is how it works for QQ/Weibo/etc in china. It's very *very* handy, so stop being whiny little babies. If even 1/10th of what you moan on and on about is an actual concern for you, why are you even on facebook. Of all the shit things people do to track you... *this* is what you complain about.

    This is a very useful (it saved me!) recovery scheme. I wish google had it. *That* account is valuable, not my facebook.

  23. Re:SSteps...ecurity by txibi · · Score: 1

    I don't get it... If I have already hacked the account why I need any of the other steps?

  24. sorry buddy by nimbius · · Score: 1

    I thought about helping you get back into your account...then i remembered that weird tirade about gay marriage and kenyan socialism you went on last year...and that time you wouldnt shut the fuck up about kony....and the farmville crap. Trust me, this is for your own good.

    --
    Good people go to bed earlier.
    1. Re:sorry buddy by Anonymous Coward · · Score: 0

      I thought about helping you get back into your account...then i remembered that weird tirade about gay marriage and kenyan socialism you went on last year...and that time you wouldnt shut the fuck up about kony....and the farmville crap. Trust me, this is for your own good.

      Aw. :-( Here let me fix that for you! :-)

      I thought about muffins you cook back into your oven...then i fried that weird muffin about cookie dough and kiwi salad you ate last year...and that time you wouldn't cook oranges the fuck up about caramelizing...and the tofu crap. Trust me, this is for your own waffles.

      There! :-) No need to thank me! Have a nice day! :-)

  25. Trusted friend passwords by Anonymous Coward · · Score: 0

    Got my three trusted Facebook friends ready to give me my password, the NSA, FBI, CIA.

  26. It's all about ads (again) by beaverdownunder · · Score: 1

    The three to five people you choose as 'Trusted Contacts' are likely to be the 'closest' to you and thus the most likely to share behaviour and preferences with you.

    Once you identify those people, Facebook can use their patterns to (presumably) target ads at _you_ better, and charge a premium to advertisers for this 'more accurate' imprint.

    Whether this works remains to be seen, but in any case this has nothing to do with convenience and much more to do with monetization.

  27. Deleting account after death by Anonymous Coward · · Score: 4, Insightful

    Sound like a good idea in theory, and it would also allow close friends to close an account of a departed one.

    I know previously this can be distressing to contact facebook admins, and convince them that this is a valid request.

    1. Re:Deleting account after death by TangoMargarine · · Score: 1

      They don't have some sort of semi-automatic system for that? Hell, one person I knew, they practically had her profile down before I found out she was dead mere days later.

      --
      Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
  28. Re:SSteps...ecurity by penix1 · · Score: 1

    Because it prevents the original owner from regaining control.

    --
    This is a sig. This is only a sig. Had this been an actual sig you would have been informed where to tune for more sigs.
  29. Re:Does anybody care? by Etcetera · · Score: 2

    Yes. There is a real world outside of your room. People socialize.

    Yes, there is a real world out there. As opposed to Facebook, which you mostly access from your room.

    Yes, people socialize. Have meals together, go dance, study together, play and sing, and much more. But it happens in "the real world outside of your room".

    Sure, you can use Facebook to facilitate much of that, but you can do that with a phone or a car or e-mail too. Yet that doesn't make people think that the phone or car or mail server is the venue.

    You mostly access Facebook from your room? ("In Korea, only old people use email...") I access Facebook from my car, from the office, from the park, from a bar, waiting in line at the DMV, via text, etc...

    It's a forum for electronic communication. Sure it's possible to primarily use it purely for random connections, but well over 90% of my Facebook friends I know (or have at least met) in person.

    If you're asking "Why Facebook them when I could just text them*?", you're doing social media wrong.

    *(outside of a disaster situation)

  30. hmm by Anonymous Coward · · Score: 0

    so inactives that have passwords will mysteriously come under default ownership of friends of old defunct account thus activating dormant accounts....

  31. Re:SSteps...ecurity by Alain+Williams · · Score: 1

    It is about the account owner forgetting his/her password.

  32. Re: SSteps...ecurity by Anonymous Coward · · Score: 0

    4. Get busted because now they know who you really are,
    (it's trivial for Graph to figure this out based on the friends you choose)
    5. Jailtime?

  33. I'm totally that guy by Anonymous Coward · · Score: 0

    "Rubber duck says he's your friend Adam. Grant access? y/n" Rubber duck strikes again!

  34. Useful in the event of death/accidents by phorm · · Score: 2

    I've heard a lot of complaints about people passing away, and their facebook account becoming inaccessible to friends or family. This would be useful in the event of a long-term disabling event or death, allowing a spouse or close friend to pass on information in the event of a tragedy (or just begin the process of closing out the account).

  35. Re:SSteps...ecurity by Aaden42 · · Score: 2

    Assuming they do in some fashion regain control of their account (and setting trusted friends doesn't prevent them from using some other password reset channel), they can simply un-trust your faux friends. Account security is restored. Granted there's a race condition if you can re-reset the password faster than they can un-trust you, but that seems like an *awful* lot of work to keep a Facebook account.

  36. Re: SSteps...ecurity by Anonymous Coward · · Score: 0

    My friends ex boyfriend did this last month to find where she was. He had previously setup several fake fb accounts and added them as friends, used them to reset her password, then used her messages to find where she was staying. I called the cops when he showed up at midnight yelling from the front yard and breaking our vehicles. Scary

  37. More Vulnerability by Anonymous Coward · · Score: 0

    This enables distributed spear phishing. No more serial bottle necks.

  38. Re:Does anybody care? by Anonymous Coward · · Score: 0

    Facebook = "out there in the world"?

    Get a life.

  39. Re: SSteps...ecurity by FatdogHaiku · · Score: 1

    4. Get busted because now they know who you really are,
    (it's trivial for Graph to figure this out based on the friends you choose)
    5. Jailtime?

    Unless your selected "friends" are just sock puppet accounts.
    Wonder where that idea came from...

    --
    You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
  40. Re:Does anybody care? by vux984 · · Score: 1

    If you're hosting a party with >20 people, it's simply easier to make a Facebook event, invite people, and see who says they're attending/maybe/not attending than actually calling/texting one and one person in order to invite them and check if they can make it.

    As someone who is not on facebook, I find that it must be highly annoying for people like you to invite me to places... you do your whole facebook thing, and then still have to manually get in touch with the people like me who don't have facebook (at least you know that I'm not on your friends list), and worse, those who do have it, but who have stopped checking it. (where you might assume they'll get the invite but they never respond..)

    But for what its worth I don't really care if it annoys you. My social life is already pretty booked, and if I miss an event where you couldn't be bothered to invite me in person ... well how close of a friend are you likely to be anyway?

    It's where most people upload their photos.

    I'm rarely interested enough in someone else's life to log into facebook to see pictures of what they did, so I don't miss it.

    Usually people show me their pictures when I see them in person anyway, which I find better since they tend to chat about the context of the picture (what happened, where it was, the adventures and mishaps... whatever) and I find that more interesting then the images.

    It's an easy way to keep in touch with people I know, even though I don't know the email addresses or phone numbers of most of them.

    Not having facebook means I do have the email addresses and phone numbers of people I want to keep in touch with.

    most people check their Facebook account more frequently than their mail account, and many even have access to Facebook from their cell phone

    maybe in your circle of friends. Not in mine. I know several have facebook on their phone, but just as many don't as they find the the crap-flow overwhelming, or its a work phone, or they just don't want facebook interupting them at work, etc. I've also got several friends that don't have accounts, or have created accounts but don't use them actively. So they can't reliably be reached. But they can all receive SMS. And most do have an email address on their phone... not to mention a phone number that I can just call them on.

    It's a decent way to procrastinate.

    Fair enough. But if you have internet access and still need help with that... lol. :p