Slashdot Mirror
Facebook is Demanding Some Users Share the Password For Their Outside Email Account (thedailybeast.com)
An anonymous reader shares a report: Just two weeks after admitting it stored hundreds of millions of its users' own passwords insecurely, Facebook is demanding some users fork over the password for their outside email account as the price of admission to the social network. Facebook users are being interrupted by an interstitial demanding they provide the password for the email account they gave to Facebook when signing up. "To continue using Facebook, you'll need to confirm your email," the message demands. "Since you signed up with [email address], you can do that automatically ..." A form below the message asked for the users' "email password."
"That's beyond sketchy," security consultant Jake Williams told the Daily Beast. "They should not be taking your password or handling your password in the background. If that's what's required to sign up with Facebook, you're better off not being on Facebook." In a statement emailed to the Daily Beast after this story published, Facebook reiterated its claim it doesn't store the email passwords. But the company also announced it will end the practice altogether. "We understand the password verification option isn't the best way to go about this, so we are going to stop offering it," Facebook wrote. It's not clear how widely the new measure was deployed, but in its statement Facebook said users retain the option of bypassing the password demand and activating their account through more conventional means, such as "a code sent to their phone or a link sent to their email." Those options are presented to users who click on the words "Need help?" in one corner of the page.
"That's beyond sketchy," security consultant Jake Williams told the Daily Beast. "They should not be taking your password or handling your password in the background. If that's what's required to sign up with Facebook, you're better off not being on Facebook." In a statement emailed to the Daily Beast after this story published, Facebook reiterated its claim it doesn't store the email passwords. But the company also announced it will end the practice altogether. "We understand the password verification option isn't the best way to go about this, so we are going to stop offering it," Facebook wrote. It's not clear how widely the new measure was deployed, but in its statement Facebook said users retain the option of bypassing the password demand and activating their account through more conventional means, such as "a code sent to their phone or a link sent to their email." Those options are presented to users who click on the words "Need help?" in one corner of the page.
What kind of dumb fuck thought this was a good idea? Fire every idiot involved in this decision immediately, as they have collectively proven to be pants shitting retarded, even by Silicon Valley diversity hire standards.
Oh, wait....
Facebook began to learn at a geometric rate about three months ago. It became self-aware at 2:14 AM, Eastern time, April 1st, 2019 and began forcing all users to surrender their e-mail passwords as part of its terrifying plan to dominate the Herbal Viagra industry by seeking out all competing vendors and destroying their internet presence.
So facebook "understand[s] the password verification option isn't the best way to go about this"? Yes?
Sorry, but anyone in a company that does not understand that this is a horrible idea before anyone can stop the intern to waste more than 10 minutes coding what should be printed in the dictionary next to "bad idea" deserves to be hit by lighning when taking a dump!
bickerdyke
Cue mass phishing in 3... 2...
There's this thing that says "Cockup before Consipiracy" but with the sheer number of cockups coming out of Facebook, one does wonder if they've crossed into Conspiracy some years ago.
I say yes, yes they did. This is kinda the final last straw -- why take peoples' email passwords?
The "Civilized World" jumped the shark ca. 1973.
Zuck: I have over 4,000 emails, pictures, addresses, SNS
[Redacted Friend's Name]: What? How'd you manage that one?
Zuck: People just submitted it.
Zuck: I don't know why.
Zuck: They "trust me"
Zuck: Dumb fucks
So every time they sign into my Gmail account I have to authorize it?
If you still use Facebook.
*Point*
*Laugh*
If your business uses Facebook.
*Point*
*Laugh*
*Do business elsewhere*
https://www.cnet.com/news/face...
You won't need to give your email to sign up for a new account anymore.
After a Twitter user called out the social media giant over the practice on Sunday, Facebook has backtracked on the verification requirement.
they got told to go fuck themselves when they started demanding a copy of my driving license or social security number or copy of my passport as id.
Most E-mail providers including Gmail are doing 2FA now, so even if Facebook gets your password they can't log into your account without the two-factor code.
Unless they were asking for this code too in which case they should all be set on fire.
And not have a research team that can learn about OAuth2?
Now if FB is excluding that, I won't know why.
And yes, API's alone can do OAuth style but you can just use SMTP/HTTP etc which is why at that level it hasn't happened.
seems like you can order them to do just about any stupid shit but do so over a screen and they will comply
from April Fool's Day?
It is because of stupid and ridicules actions such as this is the reason I refuse to have a facebook account. you just cannot trust them.
"But the plans were on display..."
"On display? I eventually had to go down to the cellar to find them."
"That's the display department."
"With a flashlight."
"Ah, well, the lights had probably gone."
"So had the stairs."
"But look, you found the notice, didn't you?"
"Yes," said Arthur, "yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard.'"
Don't fight for your country, if your country does not fight for you.
My butthoal brings David Boies to the bard,
and your mom is ah effin tard,
and your mom is ah effin tard,
I could do you but your butt is large.
"beyond sketchy" is putting it very mildly.
This is the behaviour of scammers, period.
Nobody should ever need my password to any account on any other site. Ever. Period, end of discussion. Everyone who asks for it is trying to pull a fast one or is so much beyond stupid that it amounts to the same thing.
Sadly, they aren't the first. There's a service over here in Europe where you can pay online at any website with a bank transaction even if you don't have a credit card (for you Americans: There are people older than 3 years that don't have a credit card in Europe, believe it or not). All they need is your bank number and PIN.
How anyone would give a 3rd party service the login details to their bank account is completely beyond me, but apparently people do because the service is still operational.
Far from what we should be teaching users, we teach them all the wrong things, and then complain that they're stupid. They're not. They just get stupid messages from people who should know better.
Assorted stuff I do sometimes: Lemuria.org
...you're better off not being on Facebook.
Note that this clause works well even without any qualifiers.
Do you have ESP?
Well that's how security professionals look at IT. This is most likely third-party authorization. Meaning Facebook never gets your password. The password is passed to GMAIL and then Google forwards a response to Facebook stating they are now approved. This is actually MORE secure. Also, The Daily Beast isn't a legitimate news source so maybe start there.
Since I'm guessing 90% of all FB users use GMail, they could just buy them from Google.
I don't respond to AC's.
When I signed up for facebook years ago, it asked for my email password.
No F'in way. The alternative then, as it is now is to reply to the verification email.
It's taken people this long to notice this stupidity?
The article didn't say one way or the other, but are we really sure this is from Facebook?
It is indeed beyond sketchy for a service to ask for password from any other service - even though we are talking about Facebook here I find it hard to believe they actually asked for this. I was thinking the popup could have been from some rogue ad or other malware.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
https://www.cnet.com/news/face...
You won't need to give your email to sign up for a new account anymore.
After a Twitter user called out the social media giant over the practice on Sunday, Facebook has backtracked on the verification requirement.
The fact that they did at one time is enough to condemn them.
And why isn't there more on LinkedIN's bullshit. I wouldn't sign up because they wanted access to my contacts list for my email. When are we all going to realize that ALL social media platforms and ALL websites that require registration of some sort is going to abuse and pimp our data?
What happened to just sending a verification code to the email to verify that you have access to it? I would never give a password to a 3rd party. And to iterate, I would never give my password to any employee of my email provider either.
You can't prevent morons from handing over their passwords. However, there's nothing stopping us from shoving hot pokers up the asses of those who ask in the first place.
Zuck should have his dick ripped off and stuffed down Priscilla's throat. Probably have to smash their daughter's head in to make sure the rot can't spread another generation.
And that has been my position all along.
No, you can't have the password for my email account, you don't need it and I refuse to give it to you.
Your desire to scrape my email for contacts, gather more information about me, and automatically add anybody who I've ever exchanged an email with to my fucking contacts.
This is just more bullshit of Facebook deciding they're entitled to all of your data -- fuck that and fuck Facebook.
The sooner Facebook dies the better.
Any, and I mean ANY, company that requests passwords for third-party accounts should never be trusted.
Facebook is evil. Do not trust Facebook.
How many of these people use the same password for Facebook and their Email anyhow?
I'm a good cook. I'm a fantastic eater. - Steven Brust
When Facebook demanded legal proof of my name.
They locked me out of my account.
That was years ago, and I don't regret refusing disclosure.
Rick B.
... than to ask permission beforehand. That seems to be Facebook's basic philosophy. Facebook tries to get away with as much as possible, and Facebook apologizes if it caught with its hand in the cookie jar.
It's time for Facebook to be eliminated. Burn it to the ground. Every hard drive, every SSD, every backup tape. Drop Zuckerberg into an oubliette. Enough is enough.
Maybe you can ridicule him on facebook.
I'm sure there are lots of MLM huns, paranoid uncles, and 19 year "activists" who will think you're hilarious.
Oh and can't forget the russians. Some of the best posters on dvachan make all the memes on facebook these days.
"AND CARAVANS!!!" lmao an old school meme. Ivan will know it.
Maybe it was a research experiment to see how stupid Facebook users are??? I can't believe that any "IT" professional would be stupid enough to think this was a good idea. (At least I hope that's true) As a security research study maybe ....
But, one time a boss strongly suggested we implement this on a site we were working on. I looked at him in the meeting and said, you know we can't do that, right?
And just another reason to have throw-away or alternate email accounts. My suggestion;
1) primary for family, close friends and business
2) hobbies, casual interests and other stuff
3) only used for verifications and sites that demand your email as the login ID.
And all of them on different providers, e.g. Gmail, Yahoo, hotmail, etc.
I'm tempted to change my pw to "GoFuckYourself", give it to FB, then change back to my real pw.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
We don't allow internet addresses to login to our email servers. A VPN is required to access email. Not on our LAN or on the VPN LAN and you cannot even get to the login ports (465/tcp and 993/tcp).
Even though I read through the article I somehow missed that part about a comment from Facebook. Guess I skimmed it too fast... crazy that is real.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
People are still using Facebook? Why? What value add does this platform offer to my life? I can think of a number of reasons not to use it, and this is just another one.
Facebook lost it's way a long time ago.
Confirming your email address isn't the real reason they do this. Facebook mines the metadata from the headers of all your emails to see who you communicate with and how often. LinkedIn does this too, adding people to your timeline that are not connected to you, but listed as "Your contact, so and so...". I get these in my stream from LinkedIn because OTHER people who I have communicated with in the past, for mundane reasons, gave LinkedIn their email account and password...usually it's real estate agents that do this.
What you're doing is giving Facebook and LinkedIn a vast treasure trove of data points and interconnected webs of data that exceed what you alone would give them. Think of all the emails you get that are group in nature, now they can connect the other people together without ever seeing any of them directly.
... you're better off not being on Facebook ...
Of all the many words the summary quoted from TFA, these seven are the only ones that really needed saying; and they sure as hell didn't need to be said here.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
Is not to play.
Facebook is a criminal identity theft cartel.
Corporatism != Free Market
... "<strike>If that's what's required to sign up with Facebook,</strike> you're better off not being on Facebook." ...
(Apparently, Slashdot markup purges actual strike-through markup.)
The byline of the article: Kevin Poulsen 04.02.19 7:22 PM ET.
Usually it's the company you work for or are interviewing to work for that demands your Social Media account info.
Hilarious that your Social Media Accounts are now demanding access to other account info as well :D
Does anyone actually read anymore or is it just knee-jerk reactions to click-bait pull words? Yes, Facebook DEMANDS you validate your e-mail address. Pretty much every site on the planet does. Facebook OFFERS to allow you to be an idiot and give them your password to do it. Exactly zero percent of this headline or the click-baity article is accurate.
What's slashdot.org 's policy /procedures for article submission?
To be clear this is an official request of the publication. Thank you
Is antisemtic, if fb wants your password, you give it to them, dont be a syrian
They used to do this, lot's of services did. You would sign up, and it would ask for your email address and email password, so that it could harvest your contacts and connect you to people on FB. I never did it, couldn't understand why anyone would, but in my experience, virtually all of my friends did this. I don't know if this is still the process when you sign up.
Does your ISP give out a few free email accounts?
Create a new account just for using social media.
Ever have to hand it over? Then the social media brand get nothing but your used once for social media email.
Domestic spying is now "Benign Information Gathering"
The password is iadmittohavingchildpornographyonmycomputer.
Not that I'm on Facebook or have ever had an account. But I find it amusing since I check my e-mail through SSH (with keys only) and using ALPINE. So yeah, there isn't even a password for my e-mail because I choose to run my own SMTP server. At home. Where it belongs.
For ANY dealing online, they get my hotmail account, not my real email account info. Let all the spam, junk, maleware go there.
They aren't demanding it. They're asking for it as a convenient option for morons.
If you accept, they take your creds, log in, and you're Facebook account is activated / email validated. Then Facebook violates your shit behind your back.
If you decline, you get the email, click the link, and you're Facebook account is activated / email validated. Then Facebook violates your shit behind your back, but presumably not your email account.
I've never been fond of Facebook, but this is very disturbing and disgraceful, even for them. Whoever implemented this should be in jail.
Way I see it, at this point, anyone using Facebook is getting exactly what they deserve (i.e., taken advantage of and exploited at every opportunity, including many that we haven't even thought of yet).
It's not about right or wrong, it's about what you can get away with.
"SO we bide our time, waiting for a purer kick to bloom and the future is still bleak, uncertain and beautiful" -GSYBE
Remember the time when Facebook asked you to send nude pics so they can verify that its yours and protect it from malicious ex-boy/girlfriend of yours?
Man, if we use the logic of firing anyone involved, that also includes Zuckerberg. There's no way the CEO and founder doesn't know about this.