Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Asking for Some New Users' Email Passwords

thedailybeast.com

Post reply on HN
Print view View original

201–210 of 377 posts

Re: Facebook Asking for Some New Users' Email Passwords

#201

Post by wellreally »

Traster wrote: post #103
leCapitalist wrote: post #82

Earlier quoted context omitted.

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

I find it fascinating how big tech companies are intent on spending enormous sums of money seeking out the top tech talent in the world. Then rather than listen to them when they voice concerns they try to beat them down into submission. I get that if you worked at a company whose core mission is evil that you just have to accept that when you sign up, but there's no reason facebook needs to be make these active mora…

> enormous sums of money seeking out the top tech talent

Still less than what they spend on management.

Re: Facebook Asking for Some New Users' Email Passwords

#202

Post by icebraining »

tantalor wrote: post #101
AnthonyMouse wrote: post #85

Earlier quoted context omitted.

That's the problem now though. We've made it so apps have to be approved by gatekeepers, and are highly discouraged by the gatekeepers from sharing state with other apps on the same device. Then the recommendation if that's a problem for you is to use the web. But sometimes the web doesn't work, as is the case here, because it requires the user to trust third party code in real time and give sensitive data to third p…

> highly discouraged by the gatekeepers from sharing state Source? My understanding is the app permission model never asks for network access, so all "apps" are effectively web clients with a fancy UI.

> My understanding is the app permission model never asks for network access, so all "apps" are effectively web clients with a fancy UI.

At least for Android, not exactly: they still have to require network access (android.permission.INTERNET), and you can check if they have done that in the Play Store (description → Read More → App permissions). What changed is that the Store won't explicitly ask you to confirm you're OK with it when installing.

In any case, typical native applications didn't have to ask for network access either, that didn't make them all effectively web clients. Many of the mobile apps I have installed don't rely on a central service.

Re: Facebook Asking for Some New Users' Email Passwords

#203

Post by ryanlol »

tapland wrote: post #65
hn_throwaway_99 wrote: post #18

All of these types of "hey, give us your password to this other system" are just training users to get phished. IMO the worst offender in this is Plaid, which has created a service where millions of people are giving their banking credentials so some random startup can mine your transaction data. And people think FB has privacy implications...

Swedish payment processor Klarna does something similar to this as well. If bying something through the platform by direct bank transfer you are asked to sign to your bank to accept the payment using BankID [0], which is normal. What is not normal is that they grab your personal identification number and send a login request using BankID before you open your app. When authenticating the login you authorize one of Kla…

>they are relying on recent court cases where scammers would call old people asking them to log on to check their retirement accounts

How would this work? As far as I know Swedish courts don't follow stare decisis.

Re: Facebook Asking for Some New Users' Email Passwords

#204

Post by matz1 »

nemothekid wrote: post #22
hn_throwaway_99 wrote: post #18

All of these types of "hey, give us your password to this other system" are just training users to get phished. IMO the worst offender in this is Plaid, which has created a service where millions of people are giving their banking credentials so some random startup can mine your transaction data. And people think FB has privacy implications...

Mint legitmatized that authorization flow years before Plaid came around and the banks decided that was the best way to move forward instead of adopting something like an oauth2 flow.

I've been using mint for years，it's been very useful for me. Adopting other mechanism like oauth will be slow they wouldn't be able to support that many financial institution.

Its all boil down to risk vs benefit.

Re: Facebook Asking for Some New Users' Email Passwords

#207

Post by datenhorst »

tapland wrote: post #65
hn_throwaway_99 wrote: post #18

All of these types of "hey, give us your password to this other system" are just training users to get phished. IMO the worst offender in this is Plaid, which has created a service where millions of people are giving their banking credentials so some random startup can mine your transaction data. And people think FB has privacy implications...

Swedish payment processor Klarna does something similar to this as well. If bying something through the platform by direct bank transfer you are asked to sign to your bank to accept the payment using BankID [0], which is normal. What is not normal is that they grab your personal identification number and send a login request using BankID before you open your app. When authenticating the login you authorize one of Kla…

Wait, what? I use Klarna quite regularily and I assumed they were redirecting to my bank's website (in an iframe) where I would enter my credentials. I mean, the web form is even branded with my bank's logo and color scheme. If it's really the case that I was just giving my credentials to Klarna who then logged into my bank account on my behalf, I have been phished, there's no sugar coating this.

Re: Facebook Asking for Some New Users' Email Passwords

#208

Post by icebraining »

fareesh wrote: post #179

How is this even implemented safely? The passwords have to be forwarded over to the email provider, so they are flying around log files, unsafe in the database. There's actually a programmer somewhere who can read all of them and put them in a text file and take them home.

In theory, the password doesn't have to be stored at all. I bet it's kept in some sort of job queue, so it might be stored in disk (e.g. Redis AOF), but even that could be avoided.

Still, one has to wonder why do it at all, considering the simple alternative of sending a verification email, which was already implemented.

Re: Facebook Asking for Some New Users' Email Passwords

#209

Post by icebraining »

deanclatworthy wrote: post #124
tragic wrote: post #117

Earlier quoted context omitted.

They're asking for the password to your email account, not your Facebook account.

So what are they doing with that? How can they verify it? Are they actually logging into your email account with that? Surely (BigCompany) measures would prevent that?

> So what are they doing with that? How can they verify it? Are they actually logging into your email account with that?

Well, of course.

> Surely (BigCompany) measures would prevent that?

What do you mean?

Re: Facebook Asking for Some New Users' Email Passwords

#210

Post by matwood »

leCapitalist wrote: post #82
kyle-rb wrote: post #67

I just don't understand how this gets implemented without someone speaking up and saying "hey, wait, isn't this an insane thing to do?". I would guess it's some combination of the complainers being ignored, and people at a higher level thinking "well we're doing this in a secure way, as long as the user trusts us, and why wouldn't they trust us, we're Facebook!".

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

This is why control > salary for me. I would much rather (and do) work at a smaller company making less money, but where I have real input in the company itself.

We routinely have clients ask for more tracking data on users and we explain/teach why it is a bad idea. In some way these FB stories help me, because I can point to these articles and ask 'do you want to end up associated with this?'

Post reply on HN