Some people creating Facebook accounts in early 2019 encountered a startling verification request: enter the password for the external email address used during sign-up. The screen presented the step as an automatic way to confirm ownership of the address. Security professionals objected because a service should not need the secret that unlocks a user’s account at an entirely different company.
The practice was noticed by a security researcher using the name e-sushi and investigated by The Daily Beast. A reporter reproduced the prompt after registering with a disposable email address while connecting through a virtual private network, conditions likely to trigger additional checks. Facebook said only a very small group of new users saw the option, particularly when their email provider did not support the OAuth standard used for delegated authentication.
Why the request was dangerous
A password is different from a one-time confirmation code. It can unlock stored messages, password-reset emails, contacts and personal documents. Even if Facebook handled the credential exactly as promised, asking for it normalized behavior that resembles phishing. A malicious site could imitate the same design and tell victims that surrendering an email password was a routine identity check.
The flow also created avoidable technical risk. A password submitted to another company must pass through that company’s software and network, expanding the number of places where a logging mistake, browser extension or compromised device might expose it. If a user reused the same password elsewhere, the potential damage would spread further.
Facebook’s response
Small text on the form said Facebook would not store the email password. The company repeated that assurance after the reports and explained that users could choose a more conventional method by opening a Need Help option. Alternatives included receiving a code by phone or clicking a link sent to the email address. Those methods proved that possession could be verified without collecting the outside credential.
Facebook quickly acknowledged that password verification was not the best approach and said it would stop offering it. Ending the feature was important because this was not merely a confusing label or visual bug; it violated a basic security boundary users are routinely told to protect.
Bad timing for a privacy promise
The controversy arrived about two weeks after Facebook disclosed that hundreds of millions of its own users’ passwords had been stored internally in a readable format. Facebook said those passwords were not visible outside the company and that it had found no evidence employees abused them, but the incident already had users questioning its password practices. Mark Zuckerberg had also announced a privacy-focused direction for the company while conceding that Facebook lacked a strong reputation for privacy.
Against that background, asking for an email credential communicated the opposite lesson. A privacy-centered service should minimize the secrets it receives and use open, limited authorization mechanisms when systems must connect. It should also make the safest recovery path the most obvious one rather than hiding it behind an assistance link.
Anyone who entered an outside email password into the form had a prudent next step: change that email password, enable two-factor authentication and review recent sign-ins. More broadly, users should never provide one site with the password for another. Legitimate verification can be completed with a code, a signed authorization page or a confirmation link without crossing that line.
Recent Comments