Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Asking for Some New Users' Email Passwords

thedailybeast.com

Post reply on HN
Print view View original

241–250 of 377 posts

Re: Facebook Asking for Some New Users' Email Passwords

#241

Post by cujo »

TheRealDunkirk wrote: post #239
leCapitalist wrote: post #82

Earlier quoted context omitted.

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

> Welcome to life at a big tech company. Most of this is, as you've correctly spelled out, just due to perverse incentives, and there's not really any intentional malfeasance. The REAL problems start when you get a neurotic psychopath with a modicum of power, and an agenda to climb the ladder, who pushes through ideas they KNOW are bad for the company, as a whole, in the long run, but do so anyway because they know i…

> there's not really any intentional malfeasance

I would argue that the people at the top making these decisions are not ignorant about what is going on.

Re: Facebook Asking for Some New Users' Email Passwords

#242

Post by nathan_long »

Verifying a user's email by collecting their password is ineffective for users with 2FA enabled and reckless/malicious for those (the majority) without it.

Accidentally log that data somewhere, and you've opened a way for attackers to take over your users bank accounts, social media, and pretty much every other online account, as they all rely on email verification.

If we had privacy laws with teeth, somebody at FB would be calculating how many millions in liability each piece of data collected represents. This one would be astronomical and an automatic "no" by those calculations.

Re: Facebook Asking for Some New Users' Email Passwords

#243

Post by Jgrubb »

u801e wrote: post #227
Nasrudith wrote: post #215

Earlier quoted context omitted.

It is an authoritarian mentality fundamentally of "social order" - that they are beneath them so it is the "proper order" to obey. Above profitability even. You can see that bit of outright sadism with retail in particular but the pathology exists elsewhere. Rivals of Costco are angry with them for paying their employees more to get better motivated ones and less shrinkage - when if they think it is a waste of money…

> Rivals of Costco are angry with them for paying their employees more to get better motivated ones and less shrinkage - when if they think it is a waste of money be happy about it Do you have a citation for this claim?

I don't have a citation, but I have read repeatedly that stock analysts cite "overpaying" their workers as a place where they could cut costs and boost short term profits.

Re: Facebook Asking for Some New Users' Email Passwords

#244

Post by MagicPropmaker »

I don't understand how they can login for you on any of the popular email providers.

Gmail, for example, detects a new computer by cookie and "fingerprint" (ip address, browser, UA, etc). You then get 2fa'd or at least "robot checked".

How did they make this a smooth experience?

Re: Facebook Asking for Some New Users' Email Passwords

#245

Post by jobigoud »

jrockway wrote: post #199

I wonder what Facebook would do if I created a site that "verifies your identity" by having the user type in their Facebook password. It just seems like an unwritten rule that sites are not to ask users for other sites' passwords. It's basically phishing.

I think there are many services for social media that ask for your account password so they can post in your name on Instagram or Twitter when you post a Youtube video or whatnot. Not to mention the shadier services that do the follow-unfollow dance.

Re: Facebook Asking for Some New Users' Email Passwords

#248

Post by yosamino »

deanclatworthy wrote: post #124
tragic wrote: post #117

Earlier quoted context omitted.

They're asking for the password to your email account, not your Facebook account.

So what are they doing with that? How can they verify it? Are they actually logging into your email account with that? Surely (BigCompany) measures would prevent that?

They send you a confirmation email, and then, instead of you logging into your emailaccount and clicking the verification link, they ask your emailacount password and log into your emailaccount for you and click the verification link for you.

Re: Facebook Asking for Some New Users' Email Passwords

#249

Post by shados »

kyle-rb wrote: post #67

I just don't understand how this gets implemented without someone speaking up and saying "hey, wait, isn't this an insane thing to do?". I would guess it's some combination of the complainers being ignored, and people at a higher level thinking "well we're doing this in a secure way, as long as the user trusts us, and why wouldn't they trust us, we're Facebook!".

There was also probably some "Well, financial sites/tax softwares do it and they have much higher security requirements than we do!".

Let's not underestimate the power of precedents: someone else said it was crazy at ANOTHER COMPANY, didn't get their idea through, and now other companies are copying it.

Additionally, a lot of people in the comments mentioned how engineers are ignored. Being able to convince your peers (like a product manager) of something is a skill, one that is fairly uncommon among "top tech talent", but happens to be a minimum requirement for roles like PMs. Saying "We can't do that, it's crazy!" and expecting everyone to just agree with you because you're awesome at coding just isn't going to cut it. Yeah, maybe the PM should have realized it was insane on their own. But let's consider that given hundreds or thousands of people in a company, crazy ideas might get deflected thousands of times, but it only take one "failure" for it to slip in.

Re: Facebook Asking for Some New Users' Email Passwords

#250

Post by SN76477 »

Traster wrote: post #103
leCapitalist wrote: post #82

Earlier quoted context omitted.

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

I find it fascinating how big tech companies are intent on spending enormous sums of money seeking out the top tech talent in the world. Then rather than listen to them when they voice concerns they try to beat them down into submission. I get that if you worked at a company whose core mission is evil that you just have to accept that when you sign up, but there's no reason facebook needs to be make these active mora…

Steve Jobs understood the problem.

https://youtu.be/fuZ6ypueK8M

Post reply on HN