Facebook is Demanding Some Users Share the Password For Their Outside Email Account (thedailybeast.com)

An anonymous reader shares a report: Just two weeks after admitting it stored hundreds of millions of its users' own passwords insecurely, Facebook is demanding some users fork over the password for their outside email account as the price of admission to the social network. Facebook users are being interrupted by an interstitial demanding they provide the password for the email account they gave to Facebook when signing up. "To continue using Facebook, you'll need to confirm your email," the message demands. "Since you signed up with [email address], you can do that automatically ..." A form below the message asked for the users' "email password."

"That's beyond sketchy," security consultant Jake Williams told the Daily Beast. "They should not be taking your password or handling your password in the background. If that's what's required to sign up with Facebook, you're better off not being on Facebook." In a statement emailed to the Daily Beast after this story published, Facebook reiterated its claim it doesn't store the email passwords. But the company also announced it will end the practice altogether. "We understand the password verification option isn't the best way to go about this, so we are going to stop offering it," Facebook wrote. It's not clear how widely the new measure was deployed, but in its statement Facebook said users retain the option of bypassing the password demand and activating their account through more conventional means, such as "a code sent to their phone or a link sent to their email." Those options are presented to users who click on the words "Need help?" in one corner of the page.

Comments

This is amazingly retarded

[Anonymous Coward]

What kind of dumb fuck thought this was a good idea? Fire every idiot involved in this decision immediately, as they have collectively proven to be pants shitting retarded, even by Silicon Valley diversity hire standards.

Re:This is amazingly retarded

[Durrik]

Probably PCI (Payment Card Industry). They're anal about the software development process and how features get onto web sites that deal with credit cards.

Re:This is amazingly retarded

[gweihir]

It is _Facebook_. Anybody working there has already exhibited exceptionally bad judgement.

Re: This is amazingly retarded

[taustin]

I declined and won't ever give them money.

ITYM "I won't ever give them my money." Every time you use FB, you give them money from the advertisers.

Remember, you're not the customer, you're the product. Which is why they want to scan through your private email, so they can target their ads more precisely (or at least claim they do).

You know, the same way Google does with Gmail.

Ominous....

[Freischutz]

Facebook began to learn at a geometric rate about three months ago. It became self-aware at 2:14 AM, Eastern time, April 1st, 2019 and began forcing all users to surrender their e-mail passwords as part of its terrifying plan to dominate the Herbal Viagra industry by seeking out all competing vendors and destroying their internet presence.

To every rule, an exception

[TigerPlish]

There's this thing that says "Cockup before Consipiracy" but with the sheer number of cockups coming out of Facebook, one does wonder if they've crossed into Conspiracy some years ago.

I say yes, yes they did. This is kinda the final last straw -- why take peoples' email passwords?

Re:To every rule, an exception

[TigerPlish]

even Apple reads emails now to determine a Trust Score[0]) would normally be more guarded.

Even in the /. article about that it was said that what apple does is see how many emails and calls are made from the device to detect sudden changes in usage that could signal a compromised device -- not that they're reading your mail.

I'm not saying they're not, but what I'm saying is don't say things in a way that gives the wrong impression. This is how rumors and half-truths get started.

Straight from the horse's mouth

[JoeyRox]

Zuck: I have over 4,000 emails, pictures, addresses, SNS
[Redacted Friend's Name]: What? How'd you manage that one?
Zuck: People just submitted it.
Zuck: I don't know why.
Zuck: They "trust me"
Zuck: Dumb fucks

Not any more ...

[schwit1]

https://www.cnet.com/news/face...

You won't need to give your email to sign up for a new account anymore.

After a Twitter user called out the social media giant over the practice on Sunday, Facebook has backtracked on the verification requirement.

facebook is evil

[renegade600]

It is because of stupid and ridicules actions such as this is the reason I refuse to have a facebook account. you just cannot trust them.

That is great

[houghi]

Those options are presented to users who click on the words "Need help?" in one corner of the page.

"But the plans were on display..."
"On display? I eventually had to go down to the cellar to find them."
"That's the display department."
"With a flashlight."
"Ah, well, the lights had probably gone."
"So had the stairs."
"But look, you found the notice, didn't you?"
"Yes," said Arthur, "yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard.'"

becoming the norm, sadly

[Tom]

"beyond sketchy" is putting it very mildly.

This is the behaviour of scammers, period.

Nobody should ever need my password to any account on any other site. Ever. Period, end of discussion. Everyone who asks for it is trying to pull a fast one or is so much beyond stupid that it amounts to the same thing.

Sadly, they aren't the first. There's a service over here in Europe where you can pay online at any website with a bank transaction even if you don't have a credit card (for you Americans: There are people older than 3 years that don't have a credit card in Europe, believe it or not). All they need is your bank number and PIN.

How anyone would give a 3rd party service the login details to their bank account is completely beyond me, but apparently people do because the service is still operational.

Far from what we should be teaching users, we teach them all the wrong things, and then complain that they're stupid. They're not. They just get stupid messages from people who should know better.

Simplify this

[Trailer Trash]

...you're better off not being on Facebook.

Note that this clause works well even without any qualifiers.

Email Verification

[laie_techie]

What happened to just sending a verification code to the email to verify that you have access to it? I would never give a password to a 3rd party. And to iterate, I would never give my password to any employee of my email provider either.

Re:You know how IT looks at users?

[flippy]

I couldn't care less if "Facebook never gets your password". It would pass through their servers, and that's simply unacceptable to me. If they ever asked me to do that, I'd shut down my account in a heartbeat. For the record, I am both an IT and security professional. This is Facebook, people, not critical national security infrastructure. There is not, never has been, and never will be a need for them to have that level of information.

I drew the line

[Grand Facade]

When Facebook demanded legal proof of my name.
They locked me out of my account.
That was years ago, and I don't regret refusing disclosure.