Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fury at Facebook as login requests “Government ID”

thedrum.com

Post reply on HN
Print view View original

31–40 of 233 posts

Re: Fury at Facebook as login requests “Government ID”

#31

Post by VladRussian2 »

Tarang wrote: post #12

A response to 'The Zuckerberg Files' ( http://zuckerbergfiles.org/ )? I find it hard to justify a use for this type of info online? You can get money-related businesses because of the need to comply legally but why facebook? Off topic: Does anyone think Google's floating barge is a way to evade compliance when it comes to data monitoring? Theoretically they could go further offshore

>Does anyone think Google's floating barge is a way to evade compliance when it comes to data monitoring? Theoretically they could go further offshore

the compliance is mainly enforced through the company execs being onshore, not the data/servers. The barges will be waiving 2 Irish flags with 1 Dutch flag in-between at the same time.

Re: Fury at Facebook as login requests “Government ID”

#32

Post by DominikR »

I am going to get a lot of downvotes for this but I am still curious to hear what solutions the HN community could come up with for the problem Facebook is facing:

Some of the accounts have been hacked.

You locked the accounts as a security measure.

Now you need to validate that some person is the actual owner of the account.

How would you solve this problem? (Sending a code via text message to the owners mobile device wont work in every case since old accounts didn't have to validate via phone number on registration)

Re: Fury at Facebook as login requests “Government ID”

#33

Post by jmpe »

algorias wrote: post #2

With each passing day, I look less and less like a lunatic for avoiding facebook (and its ilk) like the plague. You should try it.

Oddly enough, this happened for me on day one when I considered joining. They asked to provide my email password so they could build up a list of contacts. Oddly enough I was one of the few who thought this is "not done" because it lowers the bar for online security, i.e. it would be considered normal after a while if websites started asking this. It didn't pan out, but as a result I never got a FB account.

Re: Fury at Facebook as login requests “Government ID”

#34

Post by dan1234 »

NemesorZandrak wrote: post #24

I'm from Europe. If they will do it to me I will be forced to stop using Facebook. And I will laugh if they will make it happen in uk as people here don't have such ID's

The UK issues both passports and photographic driving licences. Most people will have at least one of those.

Re: Fury at Facebook as login requests “Government ID”

#35

Post by jnsaff2 »

So I got locked out about 10h ago and as I saw lots of people like me on twitter then I just went to bed without verifying anything. Wake up, account unlocked without questions.

I suspect this was related to the earlier news where Obama's facebook was hacked [1]. Some junior dev at FB forgot a WHERE clause at a sql query or did something equally dumb to mitigate this.

[1] http://uk.reuters.com/article/2013/10/28/uk-usa-obama-twitte...

Re: Fury at Facebook as login requests “Government ID”

#38

Post by signed0 »

jnsaff2 wrote: post #35

So I got locked out about 10h ago and as I saw lots of people like me on twitter then I just went to bed without verifying anything. Wake up, account unlocked without questions. I suspect this was related to the earlier news where Obama's facebook was hacked [1]. Some junior dev at FB forgot a WHERE clause at a sql query or did something equally dumb to mitigate this. [1] http://uk.reuters.com/article/2013/10/28/uk-u…

That's not what happened at all. The link shortener that Obama used was hacked and previously shortened links where redirected. That article says nothing about his Facebook being hacked.

Re: Fury at Facebook as login requests “Government ID”

#39

Post by cmdkeen »

Tarang wrote: post #25
jsvaughan wrote: post #20

This is the page about verifying your account: https://www.facebook.com/help/385569904840341 Facebook accepts any government-issued ID that contains name and date of birth. Examples include: Birth certificate, Driver’s license, Passport, Marriage certificate, Official name change paperwork, Personal or vehicle insurance card, Non-driver's government ID (ex. disability, SNAP or national ID card), Green card, residence…

What do you think would happen if we just submitted fake data. Back before facebook went gigantic people used social networks with avatar like display pics & put up loads of fake data.

You'd no doubt be committing all sorts of criminal offences in both the US and whatever (Western) country you send them from. It makes for a much better reason for getting the authorities involved in a hacked account than just the initial hack.

It's also much less likely that someone will do it due to the hassle and lack of automation. Though no doubt some hot startup idea is about to be born...

Re: Fury at Facebook as login requests “Government ID”

#40

Post by dlss »

DominikR wrote: post #32

I am going to get a lot of downvotes for this but I am still curious to hear what solutions the HN community could come up with for the problem Facebook is facing: Some of the accounts have been hacked. You locked the accounts as a security measure. Now you need to validate that some person is the actual owner of the account. How would you solve this problem? (Sending a code via text message to the owners mobile devi…

I'll take a stab at this.

Before I get in to it, we need to correct a misconception on your part: using a government ID doesn't work in every case. It turns out hackers know how to forge government ID images, and some of FB's users don't have government IDs (for instance, before I turned 16 all I had was a private school id).

With that out of the way, I think they should do what you suggested: sms verification. Email verification also works. As does postal mail. As does credit card charge. As does ACH charge. As does paypal charge. As does "send in a photo of you with a shoe on your head". As does having a user's friends vouch for them (they call their friends and ask). As do a lot of things.

Facebook should look closely at whatever attacker they are trying to lock out, and make several methods of ownership verification available. Maybe require two?

Requiring IDs just isn't a particularly good way to do it, and has bad PR effects these days.

Post reply on HN