Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Facebook Security IT

Facebook Introduces One-Time Passwords 215

Posted by CmdrTaco from the i-forgot-that-too dept.
angry tapir writes "Worried about logging into Facebook from a strange computer? There's now a way to get into the popular social network without entering your regular Facebook password. It's called a temporary password. To use it, users must list their mobile phone numbers with their Facebook accounts. They can then text a number from their phones and Facebook sends back a temporary password that is good for 20 minutes. The service will be available worldwide in the next few weeks."
This discussion has been archived. No new comments can be posted.

Facebook Introduces One-Time Passwords More

Facebook Introduces One-Time Passwords

Comments Filter:

  • Great idea. (Score:5, Insightful)

    by Timmmm ( 636430 ) on Wednesday October 13, 2010 @08:52AM (#33881394)

    Now can we please get one-time credit card authorisation?

    • Re:Great idea. (Score:5, Informative)

      by Rijnzael ( 1294596 ) on Wednesday October 13, 2010 @08:59AM (#33881478)
      BOA does this already [bankofamerica.com] if you're in the US.

    • Re: (Score:2)

      by n0dna ( 939092 )

      Discover also does this.

    • Re:Great idea. (Score:5, Informative)

      by Rob the Bold ( 788862 ) on Wednesday October 13, 2010 @09:15AM (#33881618)

      Now can we please get one-time credit card authorisation?

      Amex did this for a while about 10 years ago. I used it and liked it. Then it went away.

      • Re: (Score:2)

        by barzok ( 26681 )

        And here I thought they just buried it on the site and I couldn't find it. They completely did away with it? Jerks.

    • Now can we please get one-time credit card authorization?

      You mean like my Discover More Credit Card offers me [discovercard.com]?

      You have the option of re-using the same one for a retailer or just continually requesting a new one if your dealings with them are infrequent or shady.

    • Re: (Score:2)

      by Mascot ( 120795 )

      The tech has been there for years. For any online store supporting verified by visa/mastercard, I'm sent to my bank's authorization page and required to enter my security token's current code and personal password.

      For whatever reason though, there are still tons of sites out there that do not support verified by visa/mastercard.

      On the other hand, it's only a matter of time before we get cards with built-in token generators. At which point I would expect CC companies to start refusing transactions based on n

      • For whatever reason though, there are still tons of sites out there that do not support verified by visa/mastercard.

        I seem to remember some sites using Verified by Visa and then abandoning it. Perhaps they found that shoppers were abandoning their shopping carts after having set up VBV before and then forgetting their VBV username and password.

        • Re: (Score:3, Informative)

          by pasamio ( 737659 )

          The worst thing about VBV was not actually having it set up properly and then having a merchant require it compared to others that didn't. I had this happen to me when I was overseas trying to get internet and all of a sudden I got slammed by this Verified by VISA thing that wasn't setup and I could get internet to get the details I needed to get it set up (catch 22). Sounds like a good idea until it gets inconsistently applied in practice.

        • Re: (Score:2)

          by Mascot ( 120795 )

          If stores universally used it, you better believe people would start remembering their passwords.

        • Re:Having to remember even more passwords (Score:4, Insightful)

          by tlhIngan ( 30335 ) <slashdot.worf@net> on Wednesday October 13, 2010 @11:55AM (#33883412)

          I seem to remember some sites using Verified by Visa and then abandoning it. Perhaps they found that shoppers were abandoning their shopping carts after having set up VBV before and then forgetting their VBV username and password.

          Well, few reasons.

          1) Merchants love it because the customer gets stiffed with the charges (you can't chargeback a merchant if it was done via 3DS (3D Secure, aka Verified by Visa and MasterCard's equivalent). I only do VBV on a merchant I know. Unknown merchants, I'd probably trust Paypal a bit more.

          2) It seriously screws up with NoScript. I keep forgetting to enable the 3rd party site which usually results in screwing up the checkout process.

          3) It makes it harder to do "one-click shopping". If you're a merchant that gets a lot of impulse buys, the more steps betwen "I want it" and "We got your order, it'll be shipped soon!" is more chances the user will cancel the order prior to completion. (And this is a very important point)

          4) It's extremely insecure, and can offer a great way to phish. Heck, we've got previous Slashdot articles on the subject. Why "Verified by Visa" system is insecure [slashdot.org] and Net Shoppers Bullied into "Verified by Visa" program [slashdot.org].

          5) Forgetting your password can get your credit card locked out.

          Quite honestly, 3DS is just another form of Wish-it-was two-factor [thedailywtf.com] security. It pretends to be more secure, but in reality it isn't.

          There are two ways to do it properly - you could SMS people a password, but that screws with people like me who don't always carry their cellphone around, or perhaps build in an RSA key thingy inside the card itself. Chip cards (which have their own issues - really - the PIN's in the chip and the chip sends an "OK" or "Failed PIN" response - not any form of challenge-response packet to the bank, who should know your PIN, not your card) have powerful enough processors to do some RSA token like task. Given we can buy a calculator for under a dollar, there's no real reason why we can't have credit cards with two-factor support on them (and no PIN needs to be stored - the card will generate a code based on the entered PIN which the bank can validate).

      • Re: (Score:2)

        by vlm ( 69642 )

        For any online store supporting verified by visa/mastercard, I'm sent to my bank's authorization page and required to enter my .... personal password.

        Sounds like a great phishing opportunity... Thats why I don't like it. Especially since "most people" use the same password for everything.

        • Re: (Score:2)

          by Mascot ( 120795 )

          What's your point, precisely? That it's somehow worse to require extra information compared to only what's physically printed on a credit card? If so, I think most would disagree rather strongly with you. Even a simple password verification like that (which I simplified, one also needs information from birth certificate) prevents a stolen card from being used in online stores.

          Obviously I prefer my bank's solution (token). But I don't think we're going to get there until the token generators are actually on

    • Re: (Score:2)

      by mcgrew ( 92797 ) *

      I have a LOT of phone numbers stored in my phone. This new "feature" would let me jack with any of their accounts if TFS is accurate.

    • Sure. Give me your card details and I'll set it up for you.

    • Re: (Score:2)

      by RMH101 ( 636144 )
      What if there's another reason Facebook are doing this?
      It's a good idea, but it's also one that will increase the number of people who put their mobile phone number in their facebook profile. What if Facebook were looking at leveraging this for a Facebook/Skype/Facebook-branded mobile phone OS as has been rumoured recently? It'd be very handy for them if they already had a lot of users who'd already input their numbers, so when they launched any mobile services the "dial friend" option was already worki

    • Re: (Score:2, Interesting)

      by dillpick6 ( 699618 )
      What happens when your phone gets stolen? I wouldn't them to have my phone and access to things like my email and facebook, let alone my credit cards and bank accounts. This seems even more risky considering the chance most smart phones could be hacked or some app on the phone turns out to be malicious.

  • texting (Score:5, Funny)

    by Theoboley ( 1226542 ) <theoboley.hotmail@com> on Wednesday October 13, 2010 @08:52AM (#33881396) Homepage

    867-5309 will give you a password of "Jenny"

  • i am sure that there is no chance that they were scraping around for an excuse to collect cell phone numbers from their users. adding that very unique information to their already massive database on every user will make it much more valuable. as i tell my friends, it's just a pyramid scheme. you get a free website with communication tools bolted on and they get to know everything about you and will sell it to whoever they want.

    • Re:yeah, just give us your phone number (Score:5, Informative)

      by TheKidWho ( 705796 ) on Wednesday October 13, 2010 @08:55AM (#33881426)

      I don't think you know what a pyramid scheme is...

      • Yes, he most definitely does not, however the rest of the GPs post does seem to be reasonable.

      • Re:yeah, just give us your phone number (Score:4, Funny)

        by baKanale ( 830108 ) on Wednesday October 13, 2010 @12:05PM (#33883518)

        That's the one where they steal your cellphone number, and use it to track your movements, then wait until you're all alone and kidnap you, taking you to the desert and forcing you to build giant pyramids all day, right?

  • Real advantage over SSL? (Score:5, Insightful)

    by hcs_$reboot ( 1536101 ) on Wednesday October 13, 2010 @08:54AM (#33881410)
    Yet another way for a big Internet organization to collect phone numbers.

    • Re:Real advantage over SSL? (Score:5, Interesting)

      by Rijnzael ( 1294596 ) on Wednesday October 13, 2010 @08:58AM (#33881462)
      I don't think this is an attempt to prevent interception of passwords in transit over the network; I believe it's an attempt to prevent keyloggers or other nefarious software/hardware on a machine from impacting the user's privacy.

    • Re: (Score:2, Redundant)

      by sinclair44 ( 728189 )
      How exactly are phone numbers useful to them?

      • Re: (Score:2, Funny)

        by silverglade00 ( 1751552 )
        *RING* Hello?
        This is an automated call from Farmville reminding you to harvest your crops. Farmville would also like to remind you that you can get a free Special Edition Purple Cow!!!11!!!ZoMg! for your farm just for trying out the new Facebook Mastercard...

      • Re:Real advantage over SSL? (Score:4, Insightful)

        by gstoddart ( 321705 ) on Wednesday October 13, 2010 @09:34AM (#33881822) Homepage

        How exactly are phone numbers useful to them?

        One more vector of information which can be correlated to you, spammed, sold, analyzed, or mined.

        People won't know all of the ways this could be a bad idea until it's way too late -- same with most of Facebook and privacy. Give everything away and hope for the best, or don't use it at all ... and still hope for the best.

    • Re: (Score:2, Interesting)

      by bball99 ( 232214 )

      won't matter if you use a throwaway phone - all my phones are $4.88 from Dollar General or the local FYE

      • Re: (Score:2)

        by xaxa ( 988988 )

        Until one of your Facebook friends wants to contact you, and uses the number you've listed on Facebook.

        (Since this integrates very well with my HTC Android phone I use this all the time without realising it.)

      • all my phones are $4.88 from Dollar General or the local FYE

        BREW phones like these tend not to have a wide variety of applications because the BREW application development process has substantial entry barriers against small developers. It's even more expensive than the iPhone developer program. So you'd end up carrying two phones, each with its own service plan: a smartphone to run apps and a dumbphone for anonymity.

      • Re: (Score:2, Funny)

        by Theoboley ( 1226542 )

        are those the ones that come with the candy inside?

    • Re:Real advantage over SSL? (Score:5, Insightful)

      by tgd ( 2822 ) on Wednesday October 13, 2010 @09:32AM (#33881802)

      Sometimes there's a conspiracy.

      Sometimes you just really don't understand.

      If you think this has anything to do with SSL, guess which camp you're in?

      • Re: (Score:3, Insightful)

        by DrgnDancer ( 137700 )

        In this case it could be both. I mean, it's a really good system for protecting your password, but it also gives your cell number to Facebook which they really like. If you use a lot of public computers this becomes kind of a win-win. You get increased security, Facebook gets your number. If I want to access Facebook and I have my phone I use the Facebook app, so for me this isn't very useful.

    • Re: (Score:3, Informative)

      by Yer Mom ( 78107 )

      Yes, but most Facebook users have already added their number to their profiles so their friends can call them...

  • makes sense (Score:5, Insightful)

    by sakura the mc ( 795726 ) on Wednesday October 13, 2010 @08:55AM (#33881430)

    but that limited password better come with limited privledges to protect the account from getting jacked.

    • Re: (Score:3, Insightful)

      by Rhaban ( 987410 )

      agreed, you should not be able to change your e-mail/password/privacy setting with it.

  • With sufficiently complex spyware, an untrusted computer could do much damage even with a temporary access: Install applications, scrape your email, change your real password... this is only secure if the temporary access is severely restricted in what it can do with the account.

  • I think this is a step in the right direction, assuming spoofing is difficult or impossible for these SMS messages (anyone care to weigh in there?). Still, my personal policy is to never login to a system which contains somewhat sensitive data from a computer that I don't fully control or whose controller I don't fully trust. Their solution seems like a workaround, while users could just stop any potential privacy violation at the source and opt not to provide their credentials via others' machines.
    • Maybe you can live with not logging in from a "computer" that you don't fully control in your basement, but in real world, there happens to be a lot of times that you need to login through a computer (and sometimes only available ones are public). On the other hand, it's not over only with control of the computer you used as client. You need the control of the network as well.

      General rule of thumb should be, never put anything secret at all to databases that could be accessed over public networks, like In
      • What situations do you wind up in where you need to log in to an untrusted computer, and you don't have any time to go find one you trust?

        • Re: (Score:3, Interesting)

          by Darkness404 ( 1287218 )
          Public labs at a university. While I have a hard time thinking of any time that I -need- to log into Facebook and can't just use, say, a smartphone app. There are a lot of occasions where in university you realize that there is something you need to do online (such as quickly type and turn in a paper you just remembered is due in 2 hours) but you can't trust the security of a lab computer (its pretty easy to install hardware keyloggers that just go between the PS2 or USB port and capture keystrokes) so you
          • Perhaps, although I think that scenario says more about universities than anything else (like the fact that you have to log in to lab computers just to type a short essay). I do not find myself in that situation too frequently though, although it could just be the way I work (I usually have my laptop available).
          • Fire up the on-screen software keyboard. If you have any students at all who have reduced mobility in their hands / arms, it'll be on every computer across the campus.

        • Re: (Score:2)

          by xaxa ( 988988 )

          What situations do you wind up in where you need to log in to an untrusted computer, and you don't have any time to go find one you trust?

          On holiday
          At some point between home and the amazing party you have an invite to on Facebook, but can't remember the location of
          At school/college/university

          Maybe when you want someone else to log in for you, e.g. to ask someone else to look up a phone number when you aren't near a computer.

        • Re: (Score:2)

          by tepples ( 727027 )

          What situations do you wind up in where you need to log in to an untrusted computer, and you don't have any time to go find one you trust?

          Traveling without a laptop, for one. Some people aren't wealthy enough to own more than one PC. Others who have purchased an iPod touch or iPad no longer feel the need to carry a laptop, but a lot of Facebook apps require Flash, which doesn't work on iPod touch or iPad. Or traveling to the home of a relative who can't or won't give you the WEP key. Or in the break room at work.

          • Re: (Score:2)

            by Sancho ( 17056 ) *

            but a lot of Facebook apps require Flash, which doesn't work on iPod touch or iPad.

            If you need to log in to Facebook and use a flash app, you might want to consider seeking help.

    • If Facebook now stores people's sensitive data, we are in a lot of trouble...

  • I wonder what happens if someone steals your phone (or just if a roommate picks it up).... can they then get into your Facebook account by requesting a one-time password?

    I'm sure they've thought of this trivial case... but I wonder how they're going to handle it.

    • Re:Stolen Phone? (Score:4, Informative)

      by Rhaban ( 987410 ) on Wednesday October 13, 2010 @09:12AM (#33881602)

      a lot of people who use have smartphones with a facebook app, so if someone steals the phone they already have access to your fb account.

    • Like another poster said most phones already have a Facebook app. But really, that is why you have a lock on your phone if you are around people who you don't trust.

    • Re: (Score:2)

      by vlm ( 69642 )

      I don't use facebook, but obviously post that you used the service to your wall. Then when your little minions comment on how you "forgot your password this morning" ... but you didn't ... then you'll get the idea.

      It would also be semi amusing to require a cellphone photo of a human as part of the password request.

  • Now nobody will ever know what you post on Facebook from an untrusted computer! Wait..

  • get hurt.

    Hand over your cell phone and tell me your Facebook email.

  • "Man in the Mobile"

    Smartphone variant already set to harvest OTP.

  • Hurry! I need my password to I can login and complain about my miserable life and post pictures from the bar celebrating my miserable life!

    Whatever did people do before facebook? Oh yeah, they actually talked to people face-to-face and spent 'quality time' in full 3-D social interaction.
    • I barely have time left for my Serious Business on /.!!

    • Whatever did people do before facebook? Oh yeah, they actually talked to people face-to-face and spent 'quality time' in full 3-D social interaction.

      There were also fewer people with whom to interact, meaning less chance of finding somebody in the same town who shares some specific interest with you.

    • Re: (Score:2)

      by Ogive17 ( 691899 )
      So I guess you don't email or talk on the phone... because those both eliminate the need for face-to-face conversation. Oh, so does /.

      I don't hang out with my friends nearly as much as I use to... but that's not due to facebook, that is because we're all in our 30s now and most have spouses and young children. But I am able to keep in contact with them on a daily basis, if I need.

  • I have it disabled on all 5 of my family phones. COST!

  • Improving in the wrong direction... (Score:4, Interesting)

    by Haedrian ( 1676506 ) on Wednesday October 13, 2010 @09:42AM (#33881928)
    When people want more security on their facebook, they usually mean protection from Facebook and other corporations - not passwords themselves.

    How about fixing the lack of privacy instead?
    • Because Facebook's version of privacy is like McDonald's version of nutrition. It's not part of their formula.
    • Facebook have a great solution for keeping your information private.

      If you don't like what they do with your data, don't give it to them. Nobody is putting a pistol to your head.

    • Re: (Score:2)

      by Ogive17 ( 691899 )
      Using Facebook is 100% optional. If privacy is an issue, you don't have to give them any personal/private data.
  • This message brought to you by FACEBOOK... Hungry? Try McDonald's new double Big Mac extra value meal only 4.99 at participating McDonald's

    Your temporary password is:
    [message part 1/2]

  • RSA Encryption (Score:4, Insightful)

    by Kildjean ( 871084 ) on Wednesday October 13, 2010 @10:18AM (#33882302) Homepage

    What they really need to do is add RSA Encryption to the account, then create an app for iPhone to get the key from. they could also create a dongle that people buy from for $6.95 and that way their accounts will be encrypted, and issue is solved. This is pretty much what Blizzard did with their WoW accounts.

    • Re:RSA Encryption (Score:4, Insightful)

      by Maarx ( 1794262 ) on Wednesday October 13, 2010 @10:39AM (#33882510)

      I regret to inform you that you have absolutely no idea what you are talking about. There is absolutely no encryption going on with your WoW account, let alone something as complex as RSA Encryption.

      There is an additional password, generated from a hardware dongle, which is required for you to log in, but it is simply a password, not an encryption key. Once it has been successfully provided, the rest of your traffic is identical to traffic on an account without an authenticator. Your account is not "encrypted". You have a second password. Nothing more, nothing less.

  • CHARGES TO YOUR CELL PHONE BILL! (Score:4, Insightful)

    by lonesome phreak ( 142354 ) on Wednesday October 13, 2010 @11:32AM (#33883082) Journal

    Be carefull putting your mobile number in Facebook. I currently work for one of the worlds largest mobile telecoms as a CSR, and we just had a bit of training where we learned that your cell phone bill can be charged by a 3rd party game if you click and play the wrong one. Every day I remove "mobile download" 3-rd party charges because there is little obvious warning about playing some game will add a 9.99 monthly subscription because they where able to retrieve your cell phone via FB.

    It's just getting worse, I wish there was a better way to educate people. Not because I care about people, but because I'm tired of having to remove the subscriptions ten times a day every day lol.

  • New Facebook hacking technique (Score:3, Insightful)

    by kheldan ( 1460303 ) on Wednesday October 13, 2010 @12:47PM (#33883978) Journal
    1. Steal target's phone
    2. Get temp Facebook password
    3. Change target's permanent Facebook password
    4. ????
    5. Profit!

    ..assuming of course that Facebook allows you to change your permanent password after logging in with a temporary password. Sure hope they thought of that.

Slashdot Top Deals

Math is like love -- a simple idea but it can get complicated. -- R. Drabek

Close