Slashdot Mirror
Facebook's New Tool Looks To Replace Traditional Two-Factor Authentication (thenextweb.com)
Facebook today unveiled a new feature to let its 1.79 billion users reset passwords for other websites using its platform, an effort to further entrench the social network in people's digital lives. From a report: Delegated Recovery, as it's being called, looks to be a step forward for those afraid of losing their devices when using two-factor authentication (2FA) -- which, should be most of us. The security feature addresses the common concern of losing the device tied to your account. With Delegated Recovery, Facebook lets users set up an encrypted recovery token for sites like GitHub, and stores it at Facebook. If you lose the login information for GitHub, you'd simply log in to Facebook and send the stored token to the site to prove your identity and regain access. The token is encrypted, and Facebook can't access the information stored on it. Facebook also promises not to share it with third-party websites (aside from those you authorize).
Fakebook wont share it unless the gov makes them.
Because their word is known as truth.
Not increase it. There is NO WAY I'd link Facebook in with any security process I have or use. NO WAY .
...Facebook also promises not to share it with third-party websites...
That sounds like a marketing interpretation of a privacy policy that probably is as leaky as a sieve.
Helping to reduce security, one password at a time.
Really? Facebook is just providing this service with no upside to themselves? I'm not buying it.
It's too easy to get you facebook account deleted or locked out for it to be useful for this.
Facebook is getting into aspects which a social networking service has little business being involved in. A while back somehow a family members account became locked, to get it back up and running they were requiring photo ID. Its social contact website not a bank account.
"Facebook also promises not to share it with third-party websites (aside from those you authorize)." What this will turn out to mean is that you can't get access to the features and anything useful on 3rd party websites unless you authorize them access to your account.
I mean it was the exact next story after this one on the front page. And I'm supposed to *rely* on this service to gain access to lost 2FA tokens somehow?
And since when do I trust Facebook with anything? I hardly trust them to keep the privacy settings where I put them.
Because having an "oh shit" lever you can pull in one, central location, to unlock all your accounts, totally doesn't fly in the face of everything you're trying to accomplish with 2FA.
Facebook also promises not to share it with third-party websites (aside from those you authorize)
lolz. I am sure the NSA will love this shit.
The best way to avoid this problem is to use SMS for 2 factor authentication. Almost all common services support it, and if you lose your phone, a new phone will work just as well.
Why would I trust Facebook with this instead of just buying a YubiKey? Is there somewhere the YubiKey won't work and this would?
Posted a picture of breastfeeding instead of someone being decapitated, eh?
Does anyone else see this as a honeypot for <Insert your favorite state run organization here> to gain access to all your accounts?
So it's a bit like a password manager stored in the cloud. What they're really trying to do is the Microsoft Password service of yesteryear where one uses a single password to log-in to everything. The internet has gotten a lot more dangerous since those days and everyone with half a clue knows password re-use is a poor practice.
The most disturbing part of this is, it empowers Facebook to spy on what people do at other web-sites: If tracking netizens via 'Like' buttons was morally dubious, even though people opted-in to that tracking, providing this service and the abuse of monopolistic power it allows, should disgust all netizens.
Relevant 60 second read: http://sites.psu.edu/ntsh/2010...
It will be better to purchase from an owner who is a good farmer and a good builder.
Even ignoring that problem, at a glance, it seems like there are so many problems with that idea that I almost don't know where to begin. It assumes we trust Facebook to keep the token secure (we don't). It means that if somebody hacks your Facebook account, now they have access to all your accounts (yikes). And so on.
A better solution is to add your home phone and office phone as alternate second factors.
Check out my sci-fi/humor trilogy at PatriotsBooks.
#NotMySSO
And nothing is better than not even being on Facebook. Avoid it at all costs if you can.
If only they had waited two months more before posting TFA it would have been worth reading.
Or a U2F key in a secure location (like a safe deposit box).
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
Better than the old tool, the jewbastard shyster Zuckerberg.
It means that if somebody hacks your Facebook account, now they have access to all your accounts (yikes)
For similar reasons, I'm still not sold on the idea of cloud-based password managers. That seems like a problem just waiting to happen.
slashdot: A failed experiment.
Do I even need to bother with a list?
My concern was not losing it, but how to make it work with Quicken.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Already apps that allow you to encrpyt your secrets that generate tokens. Authy is an example. Not paid in any way to plug it just really practical.
It's too easy to get you facebook account deleted or locked out for it to be useful for this.
But is it really? I mean the only people I know of who get their account deleted or locked out are trolls, SJWs, activists, and people who just plain shit on their terms of service for shits and giggles.
2FA is used for logging in. Delagated Recovery is used for account recovery. How can one replace the other?
Portable, Convenient, Private. Pick two.
Just to play the part of the Devil's Advocate (possibly more literally true than frequently the case):
1) Systems are already using Facebook for authentication and authorization. Thus far they have been using unofficial work-arounds by playing with messaging and other credentials. Providing an official way is more secure, better tracked and audited, and easier to standardize.
2) Is this really substantially less secure than using your phone number and smartphone for 2 factor authentication. Assuming it is (and I'll admit that it probably is) is it THAT much less secure in practice?
The token is encrypted, and Facebook can't access the information stored on it. Facebook also promises not to share it with third-party websites (aside from those you authorize).
Can anyone name ONE privacy related promise that Facebook has kept?
For similar reasons, I'm still not sold on the idea of cloud-based password managers. That seems like a problem just waiting to happen.
If you have a highly secure password/passphrase, which you really should, what's the risk? Unless the encryption is not as good as I've been led to believe, it's not hard to make a password that would take hundreds to thousands of years to crack with current technology. Change your master password every ten or twenty years and you should be OK even if someone gets hold of your encrypted password storage.
The token is encrypted, says Facebook. But how does one decipher it in order to use it? By sending a passphrase to Facebook? Better not forget it.
Or perhaps they mean it is an opaque reference but it can be used as is. A kind of cookie, if you prefer.
>> It's too easy to get you facebook account deleted or locked out for it to be useful for this.
> But is it really? I mean the only people I know of who get their account deleted or locked out are
> trolls, SJWs, activists, and people who just plain shit on their terms of service for shits and giggles.
Blame the victim, why don't you. Read this horror story... https://thenextweb.com/faceboo...
Guy mysteriously gets his account disabled and is forbidden from creating a new one. This is straight out of Kafka...
> According to the company's responses, Facebook's decision is final. There's
> no way I can get back on the service and there's no way I can get my data
> back and there's no way I can know why I've become ineligible for an account.
Imagine you had all your calendar, contact, and password info on Facebook, and woke up one day to find out that you were locked out, with no access to that info. There are almost 1.8 billion users vulnerable to that scenario, of being locked out of Facebook at Zuckerberg's whim...
I don't know why they "trust him"... dumb fucks. http://www.theregister.co.uk/2...
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
True, if we are talking about computer security. Got to be careful at conferences and in public to avoid lawsuits due to the word's double meaning.
Where do I sign up? No, wait...
Facebook
I guess I just don't get it. I have a password. It's a password. Is it somehow difficult to remember my password? So difficult that I need Facebook to store something for me?
Riddle me this: what's wrong with the sticky note on my desk? Or the piece of paper in my drawer? Or the notepad in my safe-deposit box?
Is this for people who have zero experience being responsible for anything? Can't store your own shit, need someone else to store it for you?
Sounds like this is absolutely nothing more than two passwords -- the one that I use every day remains the same, and then there's this alternate, much bigger one, that we'll call a "token" that's stored by facebook. Why can't I write down this very long token, and store it in my basement for ten years?
Why is life so hard for so many people?
This is also a principle thing. Forget privacy and governments and sharing. The best technology for the job of remembering a password isn't yet another provider. This is a backup-password, it's redundant anyway. Write it down, put it into a box, and leave it the hell alone next to your great grandfather's watch and your marriage licence and your incorporation documents and your mortgage agreement, and your insurance policy, and the warranty for your dishwasher and the certificate of authenticity for your bronze anubis statue.
Wanna-be-really-clever? Write it onto a card and stick it behind one of the dozen pictures you have hanging on your walls.
I am suspicious of the notion that "The Cloud" is automatically superior in every way. I've seen the arguments that cloud services typically have high availability, are managed by smart teams, are accessible from everywhere. But the people saying this are likely IT pros doing the grunt work.
I don't trust the company itself not to get sold and change the terms of service, go POOF!, or turn back every single cracking attempt (the bad guys only need to succeed ONCE). If I host my own password manager it is entirely up to me and I present a much smaller attack surface compared to a centralized repository sitting on the open internet.
slashdot: A failed experiment.
I suppose it depends on the cloud service. You can never be certain it's going to remain available forever; as you say companies and services come and go. I think you can tell from reviews whether the quality of a service is good. And services that work like LastPass (which is the one I'm familiar with) don't require access all the time anyway. There's a copy of the vault on whatever device you installed it on, and it just uses that, and the cloud is for synchronization. What happens if their service goes away entirely I'm not sure.
If I host my own password manager it is entirely up to me and I present a much smaller attack surface compared to a centralized repository sitting on the open internet.
That is true, but you're also substituting your own equipment, services, and skills instead of the provider's. A well respected service is likely to do a better job with both protection and availability for anyone other than experienced computer security professionals. I'm not one of those so I leave it to the pros, but maybe you are.
Most smartphones do not require a password for Facebook after the first login. So if you lost your phone, you effectively lost all f your accounts protected by Delegated Recovery. This may be somewhat mitigated if the phone was locked and properly encrypted with a short timeout on the screen lock.
This is a BAD idea. The government will use secret FISA court orders to force Facebook to hand over your tokens, enabling the government to log into your non-Facebook accounts.
Nice try, Facebook.