Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Asking for Some New Users' Email Passwords

thedailybeast.com

Post reply on HN
Print view View original

171–180 of 377 posts

Re: Facebook Asking for Some New Users' Email Passwords

#171

Post by rogual »

unionpivo wrote: post #94
Simple_Guy wrote: post #89

Earlier quoted context omitted.

Why is this insane? It's just asking. If you don't want to, don't give your pw to facebook. You make a proposition to an entity, they evaluate the risk-benefit and respond. Unless of course, you think adults are actually childiren and should be protected from themselves by the technocrats.

Ignoring their recent fail at logging passwords. It has been established as minimal practice, that NO ONE should be asking you about your password. If this would become a normal, it would also make regular people more likely to give out their passwords. And email is key to your online kingdom, so it's a big deal, if it gets compromised.

At the very least, your mail client has to ask you for your email password. Might sound like I'm splitting hairs but I don't think most users have a strong sense of why that's different from Facebook doing it. And with wizzy online features crammed into more and more desktop software (seen Photoshop lately?) you can't really fault them for it.

Re: Facebook Asking for Some New Users' Email Passwords

#172

Post by usrusr »

ForHackernews wrote: post #160
hn_throwaway_99 wrote: post #18

All of these types of "hey, give us your password to this other system" are just training users to get phished. IMO the worst offender in this is Plaid, which has created a service where millions of people are giving their banking credentials so some random startup can mine your transaction data. And people think FB has privacy implications...

They do this because banks refuse to implement a properly-secured read-only API for granting access to transaction data. (I think maybe Chase now finally has one) Maybe if the banks realize their customers are handing over their credentials in large numbers, it will light a fire under them to build a real solution.

> Maybe if the banks realize their customers are handing over their credentials in large numbers

Or they might pop a bottle of Champaign over that, in jurisdictions where the bank is by default responsible for all the account abuse risk unless they can prove that the user has shared credentials.

Re: Facebook Asking for Some New Users' Email Passwords

#173

Post by ndnxhs »

pas wrote: post #168
ndnxhs wrote: post #97

Earlier quoted context omitted.

People with any sense of ethics don't work at Facebook.

Maybe, but that's very counter-productive actually. If you want to do ethical stuff FB is a perfect place to try to influence what happens.

Unless you have been doing deeply corrupt work for them for years you are not going to be making any change at that megacorp. I know someone who worked there and they just remove anyone who does not conform.

Re: Facebook Asking for Some New Users' Email Passwords

#174

Post by bhnmmhmd »

sqldba wrote: post #161
Traster wrote: post #103

Earlier quoted context omitted.

I find it fascinating how big tech companies are intent on spending enormous sums of money seeking out the top tech talent in the world. Then rather than listen to them when they voice concerns they try to beat them down into submission. I get that if you worked at a company whose core mission is evil that you just have to accept that when you sign up, but there's no reason facebook needs to be make these active mora…

Top tech talent generally have no idea how businesses make money. So of course you’d ignore them.

This.

I studied Electrical Engineering and in my experience, the only thing my classmates cared about was the technical aspects of the field, and often they couldn't see the big picture. Great talents of course, but more like robots, not even capable of understanding the humanitarian aspects of life. Such a waste.

Disclaimer: It's just my experience, not necessarily true for all engineers and engineering schools.

Re: Facebook Asking for Some New Users' Email Passwords

#175

Post by anoncake »

pas wrote: post #168
ndnxhs wrote: post #97

Earlier quoted context omitted.

People with any sense of ethics don't work at Facebook.

Maybe, but that's very counter-productive actually. If you want to do ethical stuff FB is a perfect place to try to influence what happens.

At the same time, you help Facebook do what it currently does, i.e. unethical stuff. I dont think an individual engineers ability to influence a company they dont own outweighs their contributions.

Re: Facebook Asking for Some New Users' Email Passwords

#176

Post by robteix »

leCapitalist wrote: post #82
kyle-rb wrote: post #67

I just don't understand how this gets implemented without someone speaking up and saying "hey, wait, isn't this an insane thing to do?". I would guess it's some combination of the complainers being ignored, and people at a higher level thinking "well we're doing this in a secure way, as long as the user trusts us, and why wouldn't they trust us, we're Facebook!".

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

I mostly agree but don’t underestimate the effect that drinking the kool-aid can have on your ability to tell if something is wrong or not.

I’ve worked in these megacorps and I understand how easy is to believe everything they do is awesome.

“We’re just doing it to make it easier for our users” or “we’re Facebook, we know how to securely handle their passwords”

It’s very easy to _believe_ these things when you’re in the inside being showered with money and being told how amazing you are all the time.

Re: Facebook Asking for Some New Users' Email Passwords

#177

Post by usrusr »

kyle-rb wrote: post #67

I just don't understand how this gets implemented without someone speaking up and saying "hey, wait, isn't this an insane thing to do?". I would guess it's some combination of the complainers being ignored, and people at a higher level thinking "well we're doing this in a secure way, as long as the user trusts us, and why wouldn't they trust us, we're Facebook!".

"If it's good enough for immigration, it's good enough for account setup. Isn't facebook something like a nation?"

Maybe they hired someone who worked at border controls?

Re: Facebook Asking for Some New Users' Email Passwords

#178

Post by dvfjsdhgfv »

robteix wrote: post #176
leCapitalist wrote: post #82

Earlier quoted context omitted.

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

I mostly agree but don’t underestimate the effect that drinking the kool-aid can have on your ability to tell if something is wrong or not. I’ve worked in these megacorps and I understand how easy is to believe everything they do is awesome. “We’re just doing it to make it easier for our users” or “we’re Facebook, we know how to securely handle their passwords” It’s very easy to _believe_ these things when you’re in…

But frankly, when you think about it, the only amazing thing about FB is how it got popular, that's all. As for the user experience it's very far from amazing, in spite of all the tech used. It's slow, and on mobile not only slow but also resource hungry, it has several glitches, plus there is a ton of things that annoy users.

Now, I can understands that someone working for SpaceX can think they're all amazing, but if you work for FB? It's like working for MS in late 90s - maybe good for you cash-wise, and that's pretty much it.

Re: Facebook Asking for Some New Users' Email Passwords

#179

Post by fareesh »

How is this even implemented safely?

The passwords have to be forwarded over to the email provider, so they are flying around log files, unsafe in the database. There's actually a programmer somewhere who can read all of them and put them in a text file and take them home.

Re: Facebook Asking for Some New Users' Email Passwords

#180

Post by [deleted] »

daemin wrote: post #169
Benjamin_Dobell wrote: post #83

Earlier quoted context omitted.

POLi in Australia also asks for your bank username and password, logs into your bank's online portal, and performs a bank transfer on your behalf; which is of course in violation of the bank's policies. It's truly insane, if I see any company accepting payment via POLi it's instant verification the company in question is clueless and that I should avoid using their services whenever possible, because they have zero i…

Which is amusing / horrifying because Australia already has good ways to transfer money between bank accounts. BSB/Acct# for normal transfers and BPay for bills.

[deleted]
Post reply on HN