More Ways to Stay Secure (Facebook introduces one-time passwords, global logout)

http://blog.facebook.com/blog.php?post=436800707130

by Timothee • 16 years ago

34 25 16 years ago

blog.facebook.com

ax0n3• 16 years ago

"Secure" and "Facebook" in the same headline. Please allow me to regain my composure. To elaborate, I measure security by three metrics: Confidentiality, Integrity, and Availability. Facebook has been fighting Confidentiality tooth and nail since its inception. Therefore, I say Facebook wholly fails the security test.

If you want confidentiality, you have to be certain to share only that which you are comfortable being made totally public. This goes for information written or spoken pretty much anywhere. Long gone are the days of ephemeral communication.

For what it's worth, Facebook's Availability (uptime) is pretty good, and these measures have the potential to improve Integrity, but only if implemented and used properly both by Facebook and the end users.

Timothee2• 16 years ago

Putting aside one's opinion on Facebook's stance around privacy, I think Facebook is one of the sites with the best measures to insure integrity of the site, at least for a consumer site.

A few times, I was warned that someone tried to accessed my account from a different computer, and went through a multi-step process to prove that I was indeed me. And, though it was multiple steps, it wasn't too much of a hassle actually.

Another time, one of my friends' account was compromised by a scammer and I got the account shut down in a couple of hours.

Recent activity and global logout is pretty useful. I imagine Facebook will offer a two-factor authentication at some point down the road.

tptacek3• 16 years ago

A nonsensical comment. Software security is one of the many things that can be purchased using money. Facebook has a lot of money, and they have used it to buy serious software security talent. I trust Facebook with my data more than I trust WePay. And I like WePay.

Groxx2• 16 years ago

Trust them to do what, precisely? Give it away for free, when they change your security settings to "public" by default, while doing a good job at preventing people from hacking in to get almost identical information?

SteveArmstrong• 16 years ago

Doesn't this mean that if someone steals your phone, they can easily log into your facebook and take over the account (change your real password and e-mail)?

Timothee2• 16 years ago

That's a good point, unfortunately not mentioned in the post. One could assume/hope that this one-time password doesn't give you access to that kind of functions.

If anything though, it makes it easier for your friends to log into your account and prank you: "Do you mind if I borrow your phone for a minute?" And then log in on their laptop.

146• 16 years ago

You need your existing (real) password to change your password; e-mail is still possible to change. Probable attack vector is to do "lost password" link and then change it, but the same is applicable to anyone with a smartphone too (it just now applies to anyone with any phone hooked up to FB).

DavidSJ• 16 years ago

If they have your phone, they can likely read your email and have your password reset or email address changed anyways.

ashearer• 16 years ago

It wouldn't even have to be stolen. All someone would need is access to the phone for less than a minute, which is harder to detect than if it was stolen outright. Though smartphones already have other privacy risks and are therefore protected, people with regular mobile phones weren't previously at risk, and probably have no idea that letting someone borrow their phone for a minute (or leaving it unattended) now means giving full access to their Facebook account, continuing even after the phone is returned.

cosgroveb• 16 years ago

I was very pleasantly surprised to see the Activity in my account a few days ago. I know Gmail got there first a long time ago but it's very nice to have.

Now if I ever use it... It is hard to get to. I find that I peek at my Gmail activity more with the link on the bottom.

lwhi2• 16 years ago

So now your Facebook account is only as secure as your phone; after all, a chain is only as a strong as the weakest link.

csytan• 16 years ago

I don't know the full details of this, but I'm not too worried. I doubt they will let you change your email/main password using the one time password.

danielha• 16 years ago

If someone stole my phone, the last thing I'd give a crap about is my Facebook account.

When someone steals your phone, you can suspend your mobile service. You can also disassociate the number from Facebook.

lwhi2• 16 years ago

Chances are you wouldn't even know your phone has gone missing.

The perpetrator 'borrows' your phone .. sends a one shot password request .. logs in to your account and deletes the message. You find your phone where you left it and are non-the-wiser.

ammmir• 16 years ago

otp is great stuff, but it's a long way from becoming mainstream if it's kept hidden and difficult to use. first hurdle is getting people to understand why they would want to use it.

on an unrelated note, is anyone tackling comment spam by ignorant humans that's not relevant to the article? just look at the comments on the blog post to see what i mean.

gcr3• 16 years ago

This is not two factor authentication, this is merely trading one factor (your password) for another factor (your telephone). In proper two-factor authentication, you should be required to enter your real password into your phone and THEN get a one-time password back out (your telephone is a trusted device).

My teenage friends trade phones all the time and they constantly nab them out of pockets, backs, purses, etc. for a few seconds. This change makes it trivially easy to steal someone's credentials.

tptacek3• 16 years ago

Since they didn't call it two-factor authentication, it's not fair to whack them for not implementing two-factor authentication. It's "I'm at someone else's computer" authentication, and it's a fine idea.

Within the next 2 years, most everyone's phone will already be logged in to Facebook, as smartphones become as cheap as iPods, mooting the latter concern. Regardless, if you can't safely use the feature, you'd be well advised not to use it.

Groxx2• 16 years ago

I remember claims that, by now a couple years ago, cell phones would cost $10 and the batteries would last for weeks.

My phone dies in 3 days if I have bluetooth on, and it cost $60 for the one-step-above-dirt phone after a 2 year contract got me a discount.

Also, how many people do you think are "well advised" of safely using security features? Even simple ones? Who don't see Facebook as one gigantic privacy / security geyser? ie, non-security-aware-geek-types? This is a minor, arguable security improvement and a major feel-good for people who don't know any better, and not much else.

gcr3• 16 years ago

I don't see how perpetuating the problem (every phone device is going to be insecurely logged in within the next 2 years) moots the concern. "Everyone does it!" is no excuse for a poor security model.

asmosoinio• 16 years ago

--- Simply text "otp" to 32665 on your mobile phone, [...]. We're rolling this out gradually, and it should be available to everyone in the coming weeks. ---

To everyone in what countries? I guess US users only?

abraham• 16 years ago

I would presume anyone who has mobile support for Facebook.

More Ways to Stay Secure (Facebook introduces one-time passwords, global logout)

Related Stories