Facebook says it is ending an account-verification method that asked some new users to provide the password to an outside email account. The prompt drew immediate criticism from security professionals, who argued that a social network should never train people to type sensitive credentials into a different service.
The practice gained attention after a security-focused developer using the name e-sushi posted a screenshot on March 31. Facebook’s registration screen offered to confirm an email address automatically if the person entered the password for that mailbox. The request looked especially troubling because fake login forms use the same basic technique to steal credentials.
Who received the password request
Facebook said the option appeared only for a very small group of people creating accounts on desktop computers. It was associated with email providers that did not support OAuth, a standard that lets one service verify a user through another provider without receiving the provider’s password. Major services such as Gmail already offered that type of authorization.
According to Facebook, the email passwords entered through the prompt were not stored. The company described the feature as a shortcut for confirming ownership of an address rather than an attempt to keep the credentials. Users could choose another method, including a code sent to a phone or a link delivered by email.
Those alternatives were not particularly prominent. A user had to select a Need help option before the registration screen revealed them. That design made the password request appear more compulsory than Facebook said it was, and it placed the safer methods behind an extra step.
Why security experts objected
The concern is larger than whether Facebook retained the password. Email accounts often control password resets for banking, shopping, social networks and other services. Anyone who gains access to a mailbox can potentially take over many connected accounts. Handing its password to a third party therefore creates risk at the moment of transmission and makes it harder for users to recognize a real phishing attack later.
OAuth was developed in part to avoid exactly that exchange of credentials. A legitimate verification flow should send the user to the email provider or deliver a code, leaving the original password known only to the provider and the account owner. Security researchers said Facebook’s prompt undermined years of advice telling people not to share passwords across websites.
After the criticism, Facebook acknowledged that password verification was not the best approach and said it would stop offering the option. Independent tests of new registrations found that affected email addresses instead received a short security code and a confirmation link, with no request for the mailbox password.
The reversal comes at a difficult time for Facebook’s privacy reputation. Only weeks earlier, the company disclosed that hundreds of millions of its own users’ passwords had been logged internally in readable form. The two issues are technically different, but together they reinforce a simple rule for users and developers: a service should verify identity without asking for the secret that protects another account.
Recent Comments