Facebook Asking for Some New Users' Email Passwords

Post by Scorpiion » Wed, Apr 03, 2019, 8:27 AM UTC

tapland wrote: post #74

Scorpiion wrote: post #69

Earlier quoted context omitted.

I tried to find more information about this statement: "When authenticating the login you authorize one of Klarnas third parties to log into your bank account as you, allowing them to pull records of all your financial transactions, account statements etc.“ Do you have any source to verify this claim? That they can and do pull down this information. I would like to know if they really have all that information or not…

I don't know if they do have it, but it is absolutely possible after the login. I saw it reported in an IT-security facebook group and made my own purchase from a site that use them (gottebiten.se), paying directly from bank account. The login was indeed done by a Klarna 3rd party using my ID number, and not from my device. You have to confirm once more for the payment to be sent.

Post by thinkingemote » Wed, Apr 03, 2019, 8:29 AM UTC

thesimon wrote: post #132

nothrabannosir wrote: post #107

Earlier quoted context omitted.

Degiro, an investment platform, do the same for your initial £100 deposit: you enter your bank's auth info and they do the wire transfer for you. It uses a 3rd party system called "SOFORT". Thereby training the public that passwords to a bank account should be given to random third parties, undoing years of pain staking training efforts. If they asked for your PIN code, people would clearly balk. But somehow, passwor…

> It uses a 3rd party system called "SOFORT" Which is Klarna. > Thereby training the public that passwords to a bank account should be given to random third parties, undoing years of pain staking training efforts. Accounts details are relatively fine to enter on other sites, just entering 2FA tokens should be limited for transactions that you really want to confirm.

Post by Tepix » Wed, Apr 03, 2019, 8:35 AM UTC

ma2rten wrote: post #9

In the old days didn't lots of people give their email passwords to Facebook, so that it can scan their contact and invite everyone to Facebook?

Post by nstart » Wed, Apr 03, 2019, 8:36 AM UTC

Traster wrote: post #103

leCapitalist wrote: post #82

Earlier quoted context omitted.

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

I find it fascinating how big tech companies are intent on spending enormous sums of money seeking out the top tech talent in the world. Then rather than listen to them when they voice concerns they try to beat them down into submission. I get that if you worked at a company whose core mission is evil that you just have to accept that when you sign up, but there's no reason facebook needs to be make these active mora…

Post by tinus_hn » Wed, Apr 03, 2019, 8:38 AM UTC

AndyMcConachie wrote: post #78

kyle-rb wrote: post #67

I just don't understand how this gets implemented without someone speaking up and saying "hey, wait, isn't this an insane thing to do?". I would guess it's some combination of the complainers being ignored, and people at a higher level thinking "well we're doing this in a secure way, as long as the user trusts us, and why wouldn't they trust us, we're Facebook!".

Move fast and break things!