Slashdot Mirror
Facebook is Demanding Some Users Share the Password For Their Outside Email Account (thedailybeast.com)
An anonymous reader shares a report: Just two weeks after admitting it stored hundreds of millions of its users' own passwords insecurely, Facebook is demanding some users fork over the password for their outside email account as the price of admission to the social network. Facebook users are being interrupted by an interstitial demanding they provide the password for the email account they gave to Facebook when signing up. "To continue using Facebook, you'll need to confirm your email," the message demands. "Since you signed up with [email address], you can do that automatically ..." A form below the message asked for the users' "email password."
"That's beyond sketchy," security consultant Jake Williams told the Daily Beast. "They should not be taking your password or handling your password in the background. If that's what's required to sign up with Facebook, you're better off not being on Facebook." In a statement emailed to the Daily Beast after this story published, Facebook reiterated its claim it doesn't store the email passwords. But the company also announced it will end the practice altogether. "We understand the password verification option isn't the best way to go about this, so we are going to stop offering it," Facebook wrote. It's not clear how widely the new measure was deployed, but in its statement Facebook said users retain the option of bypassing the password demand and activating their account through more conventional means, such as "a code sent to their phone or a link sent to their email." Those options are presented to users who click on the words "Need help?" in one corner of the page.
"That's beyond sketchy," security consultant Jake Williams told the Daily Beast. "They should not be taking your password or handling your password in the background. If that's what's required to sign up with Facebook, you're better off not being on Facebook." In a statement emailed to the Daily Beast after this story published, Facebook reiterated its claim it doesn't store the email passwords. But the company also announced it will end the practice altogether. "We understand the password verification option isn't the best way to go about this, so we are going to stop offering it," Facebook wrote. It's not clear how widely the new measure was deployed, but in its statement Facebook said users retain the option of bypassing the password demand and activating their account through more conventional means, such as "a code sent to their phone or a link sent to their email." Those options are presented to users who click on the words "Need help?" in one corner of the page.
What kind of dumb fuck thought this was a good idea? Fire every idiot involved in this decision immediately, as they have collectively proven to be pants shitting retarded, even by Silicon Valley diversity hire standards.
Facebook began to learn at a geometric rate about three months ago. It became self-aware at 2:14 AM, Eastern time, April 1st, 2019 and began forcing all users to surrender their e-mail passwords as part of its terrifying plan to dominate the Herbal Viagra industry by seeking out all competing vendors and destroying their internet presence.
So facebook "understand[s] the password verification option isn't the best way to go about this"? Yes?
Sorry, but anyone in a company that does not understand that this is a horrible idea before anyone can stop the intern to waste more than 10 minutes coding what should be printed in the dictionary next to "bad idea" deserves to be hit by lighning when taking a dump!
bickerdyke
There's this thing that says "Cockup before Consipiracy" but with the sheer number of cockups coming out of Facebook, one does wonder if they've crossed into Conspiracy some years ago.
I say yes, yes they did. This is kinda the final last straw -- why take peoples' email passwords?
The "Civilized World" jumped the shark ca. 1973.
Zuck: I have over 4,000 emails, pictures, addresses, SNS
[Redacted Friend's Name]: What? How'd you manage that one?
Zuck: People just submitted it.
Zuck: I don't know why.
Zuck: They "trust me"
Zuck: Dumb fucks
If you still use Facebook.
*Point*
*Laugh*
If your business uses Facebook.
*Point*
*Laugh*
*Do business elsewhere*
https://www.cnet.com/news/face...
You won't need to give your email to sign up for a new account anymore.
After a Twitter user called out the social media giant over the practice on Sunday, Facebook has backtracked on the verification requirement.
Most E-mail providers including Gmail are doing 2FA now, so even if Facebook gets your password they can't log into your account without the two-factor code.
Unless they were asking for this code too in which case they should all be set on fire.
from April Fool's Day?
It is because of stupid and ridicules actions such as this is the reason I refuse to have a facebook account. you just cannot trust them.
"But the plans were on display..."
"On display? I eventually had to go down to the cellar to find them."
"That's the display department."
"With a flashlight."
"Ah, well, the lights had probably gone."
"So had the stairs."
"But look, you found the notice, didn't you?"
"Yes," said Arthur, "yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard.'"
Don't fight for your country, if your country does not fight for you.
"beyond sketchy" is putting it very mildly.
This is the behaviour of scammers, period.
Nobody should ever need my password to any account on any other site. Ever. Period, end of discussion. Everyone who asks for it is trying to pull a fast one or is so much beyond stupid that it amounts to the same thing.
Sadly, they aren't the first. There's a service over here in Europe where you can pay online at any website with a bank transaction even if you don't have a credit card (for you Americans: There are people older than 3 years that don't have a credit card in Europe, believe it or not). All they need is your bank number and PIN.
How anyone would give a 3rd party service the login details to their bank account is completely beyond me, but apparently people do because the service is still operational.
Far from what we should be teaching users, we teach them all the wrong things, and then complain that they're stupid. They're not. They just get stupid messages from people who should know better.
Assorted stuff I do sometimes: Lemuria.org
...you're better off not being on Facebook.
Note that this clause works well even without any qualifiers.
Do you have ESP?
Well that's how security professionals look at IT. This is most likely third-party authorization. Meaning Facebook never gets your password. The password is passed to GMAIL and then Google forwards a response to Facebook stating they are now approved. This is actually MORE secure. Also, The Daily Beast isn't a legitimate news source so maybe start there.
Since I'm guessing 90% of all FB users use GMail, they could just buy them from Google.
I don't respond to AC's.
When I signed up for facebook years ago, it asked for my email password.
No F'in way. The alternative then, as it is now is to reply to the verification email.
It's taken people this long to notice this stupidity?
The article didn't say one way or the other, but are we really sure this is from Facebook?
It is indeed beyond sketchy for a service to ask for password from any other service - even though we are talking about Facebook here I find it hard to believe they actually asked for this. I was thinking the popup could have been from some rogue ad or other malware.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
What happened to just sending a verification code to the email to verify that you have access to it? I would never give a password to a 3rd party. And to iterate, I would never give my password to any employee of my email provider either.
Google had bypasses for 2fa for companies.
I have 2fa setup and recently aithoriZed a third party to access my Google photo albums.
Did this on purpose so I can dymaically update my digital photo frames. However that company now has a unique password only.
Facebook also can get such access until you revoke it in Google.
i thought once I was found, but it was only a dream.
How many of these people use the same password for Facebook and their Email anyhow?
I'm a good cook. I'm a fantastic eater. - Steven Brust
When Facebook demanded legal proof of my name.
They locked me out of my account.
That was years ago, and I don't regret refusing disclosure.
Rick B.
... than to ask permission beforehand. That seems to be Facebook's basic philosophy. Facebook tries to get away with as much as possible, and Facebook apologizes if it caught with its hand in the cookie jar.
It's time for Facebook to be eliminated. Burn it to the ground. Every hard drive, every SSD, every backup tape. Drop Zuckerberg into an oubliette. Enough is enough.
Bingo. This can't be real. The fact that Facebook is bad enough for people to believe it (even momentarily) says plenty - about Facebook and about our own susceptibility to paranoid fantasies - even if this was just meant as a joke.
Posted from my Android phone. Oh, I can change this? There, that's better...
But, one time a boss strongly suggested we implement this on a site we were working on. I looked at him in the meeting and said, you know we can't do that, right?
I'm tempted to change my pw to "GoFuckYourself", give it to FB, then change back to my real pw.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
Even though I read through the article I somehow missed that part about a comment from Facebook. Guess I skimmed it too fast... crazy that is real.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
People are still using Facebook? Why? What value add does this platform offer to my life? I can think of a number of reasons not to use it, and this is just another one.
Facebook lost it's way a long time ago.
Confirming your email address isn't the real reason they do this. Facebook mines the metadata from the headers of all your emails to see who you communicate with and how often. LinkedIn does this too, adding people to your timeline that are not connected to you, but listed as "Your contact, so and so...". I get these in my stream from LinkedIn because OTHER people who I have communicated with in the past, for mundane reasons, gave LinkedIn their email account and password...usually it's real estate agents that do this.
What you're doing is giving Facebook and LinkedIn a vast treasure trove of data points and interconnected webs of data that exceed what you alone would give them. Think of all the emails you get that are group in nature, now they can connect the other people together without ever seeing any of them directly.
... you're better off not being on Facebook ...
Of all the many words the summary quoted from TFA, these seven are the only ones that really needed saying; and they sure as hell didn't need to be said here.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
Is not to play.
Facebook is a criminal identity theft cartel.
Corporatism != Free Market
... "<strike>If that's what's required to sign up with Facebook,</strike> you're better off not being on Facebook." ...
(Apparently, Slashdot markup purges actual strike-through markup.)
The byline of the article: Kevin Poulsen 04.02.19 7:22 PM ET.
Usually it's the company you work for or are interviewing to work for that demands your Social Media account info.
Hilarious that your Social Media Accounts are now demanding access to other account info as well :D
Does anyone actually read anymore or is it just knee-jerk reactions to click-bait pull words? Yes, Facebook DEMANDS you validate your e-mail address. Pretty much every site on the planet does. Facebook OFFERS to allow you to be an idiot and give them your password to do it. Exactly zero percent of this headline or the click-baity article is accurate.
Not sure what you're on about. Facebook will literally demand a scan of your drivers license and lock you out if you don't provide one. I've seen it myself. Once you balk and walk away they'll fold in a week or two and stop asking, like some one who just said they'd end the relationship if you didn't do anal.
They're asking because some people will give it to them. Hell, maybe even most people will give it to them.
Does your ISP give out a few free email accounts?
Create a new account just for using social media.
Ever have to hand it over? Then the social media brand get nothing but your used once for social media email.
Domestic spying is now "Benign Information Gathering"
For ANY dealing online, they get my hotmail account, not my real email account info. Let all the spam, junk, maleware go there.
They aren't demanding it. They're asking for it as a convenient option for morons.
If you accept, they take your creds, log in, and you're Facebook account is activated / email validated. Then Facebook violates your shit behind your back.
If you decline, you get the email, click the link, and you're Facebook account is activated / email validated. Then Facebook violates your shit behind your back, but presumably not your email account.
It's not about right or wrong, it's about what you can get away with.
"SO we bide our time, waiting for a purer kick to bloom and the future is still bleak, uncertain and beautiful" -GSYBE