Facebook "Trusted Contacts" Lets You Pester Friends To Recover Account Access

alphadogg writes "Facebook Thursday said it's making available globally a feature called 'Trusted Contacts' that lets users select three to five friends who can help users recover account access such as if they forget their password. Facebook said the idea is that once these friends are identified as 'trusted contacts' through the user's security settings, Facebook will provide each of them with a special code. 'Enter the codes from [at least 3 of] your trusted contacts, and you'll be able to access your account,' Facebook says. 'After you set your trusted contacts, we'll notify them so that they can be ready to help you if you ever need it.'"

Comments

Security

[LordLucless]

That sounds like a really good idea; adding a human element to password recovery using already established trust relationships. Of course, slashdot wouldn't be slashdot if we didn't try and skew reader response by painting it as "pestering".

Re:Security

[markus_baertschi]

I agree, I find this an excellent password recovery scheme. It does not protect against a bad choice in friends, but there are no technical protections possible against that. But for password recovery it is very good and quite safe against abuse by anonymous internet hackers.

Re:Security

[Chrisq]

It does not protect against a bad choice in friends

I would imagine that Facebook account access is the least of your problems if you have a bad choice of friends.

Re:Security

[Anonymous Coward]

It's also excellent at providing Facebook data which of your friends are close friends. Very useful to charge advertisers more for fake likes from trusted friends who are more likely to have a bigger impact.

Re:Security

[teslar]

I suppose the one worry is that if someone has the ability to impersonate your e-mail and has access to your friends list, he could then impersonate you and ask *all* your friends for codes. The attacker doesn't need to know who the trusted friends are since your circle of friends would not easily be able to detect that everyone's been contacted. The attacker may mine the publicly available info on the friends to personalise the message a bit, if not, keep it short and very simple. It's not like this request would come in a long personal message anyway. It IS likely that it will come by e-mail though since you'll already be at the computer, trusted friends may be around the globe and so on. In short, you need your friends to be capable of detecting an impersonation attempt, even if brief and potentially conveying a sense of urgency. Remember, your trusted friends may be the same people who click on links that appear to be from you *because* they trust you. So in summary, while I do think this is pretty neat, I also wonder if this is not rather vulnerable to social engineering (perhaps not so much among the /. crowd - but generally)?

Re:Security

[Isaac Remuant]

There's already 5000 ways for them to discover what friends are more relevant to you, though.

They can analyze your interactions, your views of someones profiles/walls, your clicks on their shares, your groupings or other customized settings...

I don't think this is the sort of feature that will have so much adoption as to matter in that sense.

Re:Security

[daveewart]

Just because you trust someone to be _trustworthy_ doesn't mean that you trust their _opinions_. For example, I would trust some members of my family to not abuse having a house key, for example; wouldn't stop them from talking nonsense I don't agree with, though :-)

Re:Security

[arth1]

Not only a good idea, but it's a really elegant solution for social networks. Nice work, Facebook!

Either you're trolling, or you really have a weird definition of "elegant". This is highly exploitable through social engineering, and also is a very inelegant solution for those who currently don't have three trusted online "friends", or those who no longer trust one, and have to give them the digital equivalent of a face slap by removing the assigned trust.

I think this is slightly more elegant:
Write your password on a piece of cardboard. Fold it, and put it in an envelope. Mail it to a relative, saying it's your password for [service], and not to be opened unless you ask or you're dead.
You don't need to hunt down three friends. You don't have to give facebook information about who you trust. And you're covered even if you die.

Collusion?

[heypete]

While I'd hope that people would trust their friends to not abuse a privileged position in order to gain access to one's account, it's probably a good idea to pick friends from different, non-overlapping social circles to make it difficult for them to know who other "trusted" people for one's account are.

Is this new?

[Nbrevu]

Facebook [..] Lets You Pester Friends.

Wasn't that already its primary use?

Re:Teen Drama in 5 4 3 2 1

[Grantbridge]

There are plenty of young people pranking each other by hijacking their friend's accounts without this! Leaving yourself logged in on a laptop/phone is considered permission to update your status to something "hilarious". I don't think this is going to increase hijacking.

Re:Does anybody care?

[Tridus]

Probably nobody does in that cave you're hiding in, but out here in the world? Yeah, there's a couple people still using it, give or take millions.

This is a social gimmick

[EmagGeek]

It creates yet another layer of "friendship exclusivity" in the Facebook social world. You have "friends" already, but now you can have "OMG BFF!" people as well, and some will feel accepted or rejected based on whether they are one of your "chosen few."

This is, of course, the intent - to create more hype and drama, and even more important, yet another vehicle for narcissism to flourish.

But...

[shitzu]

But I do not have 3 friends you insensitive clods!

Re:Does anybody care?

[Isaac Remuant]

Yes. There is a real world outside of your room. People socialize. It might be hard to recognize it from the center of the universe you are in but it happens.

Deleting account after death

[Anonymous Coward]

Sound like a good idea in theory, and it would also allow close friends to close an account of a departed one.

I know previously this can be distressing to contact facebook admins, and convince them that this is a valid request.