Slashdot Mirror
Facebook's Account Kit Login System Works Via Phone Numbers, No Passwords Needed (softpedia.com)
An anonymous reader writes: At this year's F8 developer conference, Facebook announced a new tool called Account Kit, which can be used by app developers to support phone number-based login systems. Every time the user wants to login, they have to enter their phone number. Facebook will then send them a verification code via SMS, which they have to enter on the site. The system was already tested live, and Facebook expects it to be widely adopted, allowing sites to offer users accounts that don't require them to memorize a new password. Each developer has a 100,000 free confirmation SMS messages per month quota. Facebook claims to support SMS login operations for over 230 countries and regions, and in 40 different languages.
Everything is being tied back to real identity and it's becoming more and more difficult to publish anything without leaving a trail back to yourself.
Passwords serve a useful purpose. People lose phones all too frequently, and many aren't well-secured. Passwords are a bad authentication mechanism on their own, but they do improve security in two factor authentication. Otherwise, it's possible to do a lot more damage from a lost phone. Knowing a password greatly increases your confidence that the person is who they say they are. I hate the idea of removing either factor in two factor authentication.
That it's possible to intercept SMS, either through the air or from the handset. Feck it, most android apps are spyware/adware with a bunch of permissions it they have no legitimate use for
I imagine that by giving them my number, I'll also be agreeing to have it passed onto "carefully selected partners" who will send me information about products I may be interested in.
Summation 2
great, so someone steals my phone and has automatic access to the logins too.
The user will receive a code via sms which then he will have to manually enter ? If that is so, it is a much worse - less practical - tactic than just entering my password. Unless, the app will automatically read the sms and enter the code. Plus I don't understand why this new method is needed, most apps and browsers offer the option to save my credentials, why would we need a new method ?
They don't even have to steal your phone. They could forge or order a duplicate SIM card, or install malware on your phone. You wouldn't know that someone is using your login.
Governments all over the world are working hard to close those loopholes. Soon you won't be able to buy a phone or sim card without id, and all the devices already out there will suddenly have their network access revoked until you register them with government issued id. If a tin pot dictatorship like pakistan can pull this off, anybody can.
100% correct. I have been saying this for years: eventually you will only be able to connect to the Internet with "approved" and "registered" devices. This is already happening in the mobile world.
If you have someones cell phone you already have access to most things anyway. Most services (including email) on mobile devices leave the user logged in or for convenience by saving their credentials locally.
This doesn't seem like a simple way to send 100,000 to anyone who I might be wanting to abuse, does it?
In any case I hope they have tried to engineer some security and sanity checks into the system.
I would not want to be the unfortunate sod who has got a new cell phone and found out that the previous owner of that number has enabled this feature and forgot to update their facebook profile when they changed cell phones - getting random authentification texts via facebook for the rest of my life doesn't seem very pleasant.
No, facebook. You can't have my phone number....
yvan eht nioj
And I'm sure we can agree that this is an absolutely horrible use case.
yvan eht nioj
This sort of authentication is very common in China, where your phone number is your identity for many purposes. With WeChat payments, your payment identity is even your phone number.
People who arrive at online connectivity via smartphones and messaging software don't have an email address and don't want one; their identity is their phone number. With all the problems that has, but those aren't problems they see at first (email also is not lacking in problems).
So this is Facebook aiming at being the auth service, and entry point to the Internet, for people who are newly connected to the Internet via smartphones. The next billion to be networked.
This is not aimed at anyone who uses slashdot - if you read this, you're just not one of the people described above.
"For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled"