Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Asking for Some New Users' Email Passwords

thedailybeast.com

Post reply on HN
Print view View original

101–110 of 377 posts

Re: Facebook Asking for Some New Users' Email Passwords

#101

Post by tantalor »

AnthonyMouse wrote: post #85
anoncake wrote: post #64

Earlier quoted context omitted.

That is a program though, not a website.

That's the problem now though. We've made it so apps have to be approved by gatekeepers, and are highly discouraged by the gatekeepers from sharing state with other apps on the same device. Then the recommendation if that's a problem for you is to use the web. But sometimes the web doesn't work, as is the case here, because it requires the user to trust third party code in real time and give sensitive data to third p…

> highly discouraged by the gatekeepers from sharing state

Source?

My understanding is the app permission model never asks for network access, so all "apps" are effectively web clients with a fancy UI.

Re: Facebook Asking for Some New Users' Email Passwords

#102

Post by davb »

hn_throwaway_99 wrote: post #18

All of these types of "hey, give us your password to this other system" are just training users to get phished. IMO the worst offender in this is Plaid, which has created a service where millions of people are giving their banking credentials so some random startup can mine your transaction data. And people think FB has privacy implications...

Monzo in the UK recently added a beta ("labs") feature in their app to check your Barclaycard balance from within the app. Sounded ideal as the Monzo app is the best banking app I've ever used. I figured they'd be using Open Banking (the new OAuth style authentication system rolling out across banks here).

I went to turn it on only to find that they use a third party who ask for all of your Barclaycard credentials (including your full "secret word", which you normally only enter a few characters from at login time). I've no idea why they'd go this route, but exactly as you say - it just trains users to get phished.

It also wasn't clear what this third party would do with the transaction information they scrape from your account. Overall a terrible idea.

Re: Facebook Asking for Some New Users' Email Passwords

#103

Post by Traster »

leCapitalist wrote: post #82
kyle-rb wrote: post #67

I just don't understand how this gets implemented without someone speaking up and saying "hey, wait, isn't this an insane thing to do?". I would guess it's some combination of the complainers being ignored, and people at a higher level thinking "well we're doing this in a secure way, as long as the user trusts us, and why wouldn't they trust us, we're Facebook!".

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

I find it fascinating how big tech companies are intent on spending enormous sums of money seeking out the top tech talent in the world. Then rather than listen to them when they voice concerns they try to beat them down into submission. I get that if you worked at a company whose core mission is evil that you just have to accept that when you sign up, but there's no reason facebook needs to be make these active moral choices to pursue things in the worst possible way and yet they consistently do.

Re: Facebook Asking for Some New Users' Email Passwords

#104

Post by UweSchmidt »

csallen wrote: post #58
newnewpdro wrote: post #52

Earlier quoted context omitted.

The general public is extremely myopic and lazy . They will hand over anything you ask for if it means they have to do less work in the short-term. Convenience trumps all. It's how we've ended up with people voluntarily purchasing, maintaining, carrying around at all times, keeping charged and powered on, their own personal surveillance devices running heaps of software they have no control over.

Counterpoint: Many people of the "general public" are at least vaguely aware of the fact that they're making risky decisions, but proceed regardless in order to reap the short-term rewards that you mention, calculating that the benefits are worth the hypothetical costs, and many of them will live and die having been right about making that tradeoff.

You would use an old bridge, trusting that someone somewhere is responsible for inspecting that bridge and guaranteeing that it holds.

In the same way, "we" are responsible that our software fundamentally works to a certain standard so that other people can trust using it.

Re: Facebook Asking for Some New Users' Email Passwords

#105

Post by Nullabillity »

Benjamin_Dobell wrote: post #83
tapland wrote: post #65

Earlier quoted context omitted.

Swedish payment processor Klarna does something similar to this as well. If bying something through the platform by direct bank transfer you are asked to sign to your bank to accept the payment using BankID [0], which is normal. What is not normal is that they grab your personal identification number and send a login request using BankID before you open your app. When authenticating the login you authorize one of Kla…

POLi in Australia also asks for your bank username and password, logs into your bank's online portal, and performs a bank transfer on your behalf; which is of course in violation of the bank's policies. It's truly insane, if I see any company accepting payment via POLi it's instant verification the company in question is clueless and that I should avoid using their services whenever possible, because they have zero i…

Trustly does this, too.

Re: Facebook Asking for Some New Users' Email Passwords

#106

Post by x38iq84n »

unionpivo wrote: post #94
Simple_Guy wrote: post #89

Earlier quoted context omitted.

Why is this insane? It's just asking. If you don't want to, don't give your pw to facebook. You make a proposition to an entity, they evaluate the risk-benefit and respond. Unless of course, you think adults are actually childiren and should be protected from themselves by the technocrats.

Ignoring their recent fail at logging passwords. It has been established as minimal practice, that NO ONE should be asking you about your password. If this would become a normal, it would also make regular people more likely to give out their passwords. And email is key to your online kingdom, so it's a big deal, if it gets compromised.

This is security by "no one should be asking for your password". The responsibility is with the user and they need to be taught "you must not disclose your password to just anyone who asks for it".

Re: Facebook Asking for Some New Users' Email Passwords

#107

Post by nothrabannosir »

davb wrote: post #102
hn_throwaway_99 wrote: post #18

All of these types of "hey, give us your password to this other system" are just training users to get phished. IMO the worst offender in this is Plaid, which has created a service where millions of people are giving their banking credentials so some random startup can mine your transaction data. And people think FB has privacy implications...

Monzo in the UK recently added a beta ("labs") feature in their app to check your Barclaycard balance from within the app. Sounded ideal as the Monzo app is the best banking app I've ever used. I figured they'd be using Open Banking (the new OAuth style authentication system rolling out across banks here). I went to turn it on only to find that they use a third party who ask for all of your Barclaycard credentials (i…

Degiro, an investment platform, do the same for your initial £100 deposit: you enter your bank's auth info and they do the wire transfer for you. It uses a 3rd party system called "SOFORT". Thereby training the public that passwords to a bank account should be given to random third parties, undoing years of pain staking training efforts.

If they asked for your PIN code, people would clearly balk. But somehow, passwords to a bank account are fair game. It's exasperating.

Re: Facebook Asking for Some New Users' Email Passwords

#108

Post by [deleted] »

Traster wrote: post #103
leCapitalist wrote: post #82

Earlier quoted context omitted.

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

I find it fascinating how big tech companies are intent on spending enormous sums of money seeking out the top tech talent in the world. Then rather than listen to them when they voice concerns they try to beat them down into submission. I get that if you worked at a company whose core mission is evil that you just have to accept that when you sign up, but there's no reason facebook needs to be make these active mora…

[deleted]

Re: Facebook Asking for Some New Users' Email Passwords

#109

Post by nchie »

tapland wrote: post #65
hn_throwaway_99 wrote: post #18

All of these types of "hey, give us your password to this other system" are just training users to get phished. IMO the worst offender in this is Plaid, which has created a service where millions of people are giving their banking credentials so some random startup can mine your transaction data. And people think FB has privacy implications...

Swedish payment processor Klarna does something similar to this as well. If bying something through the platform by direct bank transfer you are asked to sign to your bank to accept the payment using BankID [0], which is normal. What is not normal is that they grab your personal identification number and send a login request using BankID before you open your app. When authenticating the login you authorize one of Kla…

Wow, as someone who has used this service, thank you for the mentioning this, I had no idea!

Re: Facebook Asking for Some New Users' Email Passwords

#110

Post by another-dave »

aphextron wrote: post #28
tomc1985 wrote: post #19

Earlier quoted context omitted.

Amateur photographer here, Instagram is invaluable. Post only what you want the world to see, and so on...

Are you an amateur photographer? Or are you someone who posts images to a social media website for a dopamine hit? Perhaps there’s a value to gatekeeping. It can make us actually put effort and consideration into things. Modern web services like Instagram have allowed human fantasies to run wild, completely detached from reality. If you truly cared about your art and wanted it to be seen, you would devote yourself to…

Why would an amateur photographer feel that they have to work towards getting their work in a gallery?

Does an amateur baker have to have a stall at the farmers' market, an amateur knitter have to have an Etsy store?

Nothing wrong with just taking photos for the love of it (literally the definition of amateur) and sharing them with your friends because you think they'll appreciate them. Not every hobby has to be taken up with so much effort it's like a second job.

Post reply on HN