Forgot your password?
typodupeerror
Facebook Social Networks

Facebook "Trusted Contacts" Lets You Pester Friends To Recover Account Access 114

Posted by samzenpus
from the with-a-little-help-from-my-friends dept.
alphadogg writes "Facebook Thursday said it's making available globally a feature called 'Trusted Contacts' that lets users select three to five friends who can help users recover account access such as if they forget their password. Facebook said the idea is that once these friends are identified as 'trusted contacts' through the user's security settings, Facebook will provide each of them with a special code. 'Enter the codes from [at least 3 of] your trusted contacts, and you'll be able to access your account,' Facebook says. 'After you set your trusted contacts, we'll notify them so that they can be ready to help you if you ever need it.'"
This discussion has been archived. No new comments can be posted.

Facebook "Trusted Contacts" Lets You Pester Friends To Recover Account Access

Comments Filter:
  • Security (Score:5, Interesting)

    by LordLucless (582312) on Friday May 03, 2013 @06:22AM (#43618425)

    That sounds like a really good idea; adding a human element to password recovery using already established trust relationships. Of course, slashdot wouldn't be slashdot if we didn't try and skew reader response by painting it as "pestering".

    • Re:Security (Score:5, Insightful)

      by markus_baertschi (259069) <`markus' `at' `markus.org'> on Friday May 03, 2013 @06:32AM (#43618451)

      I agree, I find this an excellent password recovery scheme. It does not protect against a bad choice in friends, but there are no technical protections possible against that. But for password recovery it is very good and quite safe against abuse by anonymous internet hackers.

      • Re:Security (Score:4, Interesting)

        by Chrisq (894406) on Friday May 03, 2013 @06:38AM (#43618479)

        It does not protect against a bad choice in friends

        I would imagine that Facebook account access is the least of your problems if you have a bad choice of friends.

        • 1. Hack account
          2. Add your own friends
          3. Set as trusted friends...
          4. Success?

          • by txibi (1691198)
            I don't get it... If I have already hacked the account why I need any of the other steps?
            • by penix1 (722987)

              Because it prevents the original owner from regaining control.

              • by Aaden42 (198257)

                Assuming they do in some fashion regain control of their account (and setting trusted friends doesn't prevent them from using some other password reset channel), they can simply un-trust your faux friends. Account security is restored. Granted there's a race condition if you can re-reset the password faster than they can un-trust you, but that seems like an *awful* lot of work to keep a Facebook account.

            • It is about the account owner forgetting his/her password.

      • by arth1 (260657)

        It does not protect against a bad choice in friends, but there are no technical protections possible against that

        Sure there is. Ditch the "electronic friend" concept. It's as fake as "pages" on a web page. Real life doesn't translate into the bitworld, and trying to shoehorn the concepts in is just causing problems.
        Trust is to be earned, not given away for a smiley.

      • by Thud457 (234763)
        OH YEAH, this is a BRILLIANT idea!
        Let's just add in another handful of vectors for phishing attacks. With people with less familiarity to your personal information and less incentive to exercise diligence.
        I see NO possible FLAW with that plan!&
        </boggle-eyed Homer simpson over the top sarcasm>
        • Let's just add in another handful of vectors for phishing attacks. With people with less familiarity to your personal information and less incentive to exercise diligence.

          Again, that comes down to your choice of friends - something there's really no technical solution for.

          This trusted contact scheme would work well for me, because I'll just mark as trusted the people who either a) already have keys to my house, or b) know the location my spare key is hidden.* Every one of them are type that, when t

    • Re:Security (Score:5, Insightful)

      by Anonymous Coward on Friday May 03, 2013 @06:53AM (#43618519)

      It's also excellent at providing Facebook data which of your friends are close friends. Very useful to charge advertisers more for fake likes from trusted friends who are more likely to have a bigger impact.

      • Re:Security (Score:4, Insightful)

        by Isaac Remuant (1891806) on Friday May 03, 2013 @07:31AM (#43618679)

        There's already 5000 ways for them to discover what friends are more relevant to you, though.

        They can analyze your interactions, your views of someones profiles/walls, your clicks on their shares, your groupings or other customized settings...

        I don't think this is the sort of feature that will have so much adoption as to matter in that sense.

      • Re:Security (Score:4, Insightful)

        by daveewart (66895) on Friday May 03, 2013 @07:59AM (#43618801)

        Just because you trust someone to be _trustworthy_ doesn't mean that you trust their _opinions_. For example, I would trust some members of my family to not abuse having a house key, for example; wouldn't stop them from talking nonsense I don't agree with, though :-)

    • Re:Security (Score:5, Interesting)

      by teslar (706653) on Friday May 03, 2013 @06:56AM (#43618529)
      I suppose the one worry is that if someone has the ability to impersonate your e-mail and has access to your friends list, he could then impersonate you and ask *all* your friends for codes. The attacker doesn't need to know who the trusted friends are since your circle of friends would not easily be able to detect that everyone's been contacted. The attacker may mine the publicly available info on the friends to personalise the message a bit, if not, keep it short and very simple. It's not like this request would come in a long personal message anyway. It IS likely that it will come by e-mail though since you'll already be at the computer, trusted friends may be around the globe and so on. In short, you need your friends to be capable of detecting an impersonation attempt, even if brief and potentially conveying a sense of urgency. Remember, your trusted friends may be the same people who click on links that appear to be from you *because* they trust you. So in summary, while I do think this is pretty neat, I also wonder if this is not rather vulnerable to social engineering (perhaps not so much among the /. crowd - but generally)?
      • Which is still a step above the current state of affairs. It relies on somebody being able to gain access to your email address; currently, if that happens, you're screwed anyway.

        • He said impersonate, not actually access. I'd imagine a decent email service would catch email spoofing though, and tricking 3 people without them getting in contact with the account holder doesn't seem likely either.

          • I guess, as long as your friends just send the reply email without noticing that it's addressed to someone else entirely.

            • by Culture20 (968837)
              I'm betting a From: "Lucless, Lord" <borris@mafia.ru> would fool more than half of your list, especially if your friends use a client that only shows the portion in quotes without any digging. That's still good odds even if they're focusing on one account.
      • Worse than that with the rate at which many people change email addresses you probablly don't even actually need access to the victims real email address, just an address that looks sufficiently plausible that the contacts think it's the victim.

        If you are going to use this feature and want your account to remain secure you need to carefully instruct the friends on when they should and should not give out the code (preferablly in person only) and make sure that you can trust them to follow those instructions

    • by Joce640k (829181)

      I don't think 'pestering' people worries Facebook in the slightest.

      OTOH this is several orders of magnitude better than "What's your favorite color?". I almost like it.

      • by nospam007 (722110) *

        "OTOH this is several orders of magnitude better than "What's your favorite color?". I almost like it."

        Nobody uses that anymore. It has been replaced by:
        "What is the air speed velocity of an African Swallow?"
        Ages ago.

    • But doesn't this approach just create another vector for social-engineering attacks? If any of my emails accounts are compromised, my phone is stolen, some malware gets a hold of my address book, etc., what stops a hacker from sending an email to everyone on my contact list asking for my secret Facebook codes? The chances are pretty high that the three extra-special friends on Facebook are also in your email/<insert social app> address lists.

      TFA says “Choose people you can reach without using Fa

    • by Luckyo (1726890)

      It appears to be like leaving your spare keys with a friend you trust that lives nearby. Makes sense.

  • Collusion? (Score:5, Insightful)

    by heypete (60671) <pete@heypete.com> on Friday May 03, 2013 @06:22AM (#43618429) Homepage

    While I'd hope that people would trust their friends to not abuse a privileged position in order to gain access to one's account, it's probably a good idea to pick friends from different, non-overlapping social circles to make it difficult for them to know who other "trusted" people for one's account are.

    • by mwvdlee (775178)

      Non-overlapping social circles give Facebook more information than overlapping social circles.
      If enough people use this feature, overlapping gives them circles of friends, non-overlapping gives them a network of interconnected circles of friends.

      Imagine a group of six friends, each chosing only eachother as "trusted contacts"; facebook will know only the small circle.
      Imagine a number of six-friend groups, each chosing a one of each group as a "trusted contact"; facebook will still be able to reconstruct a n

      • by heypete (60671)

        Ok, but what information does that give Facebook? They already know people's social connections due to people "friending" each other.

        My point was more "Leaving aside the privacy issues related to the use of Facebook and its specific implementation, in general people should choose diverse 'trusted contacts' from separate social groups so the odds of multiple friends colluding to get enough codes to gain access to one's account is minimized."

    • by MadKeithV (102058)
      I find that 5 friends from a non-existent social circle are even more secure.
  • by Nbrevu (2848029) on Friday May 03, 2013 @06:23AM (#43618431)

    Facebook [..] Lets You Pester Friends.

    Wasn't that already its primary use?

  • I'm sure there will be plenty of young people pranking each other by hijacking their friends' accounts (or former friends) with this.

    • Re: (Score:3, Interesting)

      by Grantbridge (1377621)
      There are plenty of young people pranking each other by hijacking their friend's accounts without this! Leaving yourself logged in on a laptop/phone is considered permission to update your status to something "hilarious". I don't think this is going to increase hijacking.
      • by mwvdlee (775178)

        For that to happen, the "friends" must have (A) physical access to the device and (B) a logged-in account.
        With this "Trusted contacts", the friends need neither to hijack an account, they just needed to be sufficiently trusted in the past.

        I'm much more worried about previously trusted ex-girlfriends getting together... (or rather; I would be).

        • 1) Get your friends together for a party (especially a bachelor or bachelorette party.)
          2) You and your friends get drunk.
          3) Your (drunk) friends decide it would be "fun" to access into your Facebook account and post naughty message as you.
          4) ???
          5) Prof... *ring ring* Hi, Grandma. What? There's a picture of my naughty bits on my Facebook page? No there isn't! *check* What the?!

  • by EmagGeek (574360) <gterich@aol.LISPcom minus language> on Friday May 03, 2013 @07:07AM (#43618595) Journal

    It creates yet another layer of "friendship exclusivity" in the Facebook social world. You have "friends" already, but now you can have "OMG BFF!" people as well, and some will feel accepted or rejected based on whether they are one of your "chosen few."

    This is, of course, the intent - to create more hype and drama, and even more important, yet another vehicle for narcissism to flourish.

    • Or they as said above will continue building a bigger database about you, your friends, and anything you do. The data isn't evil, what they do with it might be.
    • mmm... I saw it more in terms of some sort of extra authentication and it doesn't seem to be obligatory so I don't know why people are complaining that much.

    • by mrbester (200927)

      Best part is you have to wait until you receive the codes (how?) from these friends in order to access your account. What if one friend is off line because they've gone backpacking in the wilds of NoInternetLand for a month? What if they take their time responding (you're BFFs but you had a disagreement)? What if you don't receive the response?

      You're stuffed using this method as there are too many points of failure.

      • by MiKM (752717)
        According to the summary and article, you only need three of five codes. I suppose of 3 of your friends are out-of-contact, then you're SOL for the time being, but I suppose that is better than having a weaker, easier-to-compromise system. When choosing your five friends, it might be wise to select people from different circles of friends to decrease the likelihood that multiple trusted contacts are out-of-reach at once.
    • Close, but not quite. This creates another tier so that Facebook knows which of your 12 million friends are your closest. This is valuable information that they will be able to capitalize on.
    • It creates yet another layer of "friendship exclusivity" in the Facebook social world. You have "friends" already, but now you can have "OMG BFF!"

      Actually, you could do that already, far more effectively, using Facebook groups. My friends can see what I post, but by OMG BFFs (although, I called them "acquaintances" and "friends" respectively) can see my real world contact details, and other info.

  • But... (Score:5, Funny)

    by shitzu (931108) on Friday May 03, 2013 @07:10AM (#43618603)

    But I do not have 3 friends you insensitive clods!

  • by rodrigoandrade (713371) on Friday May 03, 2013 @07:25AM (#43618661)

    Isn't this security measure a bit overkill for a stupid social network site??

    What's next? All 3 to 5 friends will have to enter their codes simultaneously to recover the lost account?

    • What's next? All 3 to 5 friends will have to enter their codes simultaneously to recover the lost account?

      No. Three out of five friends need to enter codes. I thought most people posting on Slashdot would know about codes where n out of m keys are needed to uncover a secret. (For example, for 3 out of 5 the keys would be points on something similar to a 2nd degree polynomial; with two points you have no idea what the polynomial is, with three or more points you can reconstruct it).

      • by Etcetera (14711)

        If it's good enough for the root zone of DNS [popsci.com], it's good enough for my friends list.

      • What's next? All 3 to 5 friends will have to enter their codes simultaneously to recover the lost account?

        No. Three out of five friends need to enter codes. I thought most people posting on Slashdot would know about codes where n out of m keys are needed to uncover a secret.

        And if you don't, there's a Wikipedia page [wikipedia.org] listing a number of different systems.

    • by Anonymous Coward

      It's not overkill at all. It's a relatively simple decentralized scheme for doing password resets. It sits between the reset processes that that only require the user and the ones that require someone at FB to do something. It should take a significant load off of the people at FB, probably be quicker for the user, and might even provide a gentle shaming of people who lose their password too often. It seems like a pretty smart plan.

  • by Anonymous Coward

    s/Friends/Chums/

    You were so close.

  • Having " friends" instead of having a system saves FB money. Just another scheme .. ok now

    It's all about profit. Now that the ice is broken ,i ask : when will FB users catch on and ask for their share of the money their data makes ?
    Yes YOUR data makes THEM money , you get nothing in return . The Service ? LOL it's the tool they use to get your data that earns them money , it's not a service for you it's their tool to rake in the dough . They make billions with YOUR data . Wake up and send a letter t

    • you get nothing in return

      FB users get a significant amount of utility out of Facebook, and of course it comes at a cost. It looks extremely lop-sided because there's only one facebook and there are a billion or so users, but saying that users get nothing from it is just as stupid as saying that it costs users nothing.

  • by StoneyMahoney (1488261) on Friday May 03, 2013 @07:45AM (#43618741)

    This is supposed to be a security... enhancement?! How many people do you know on Facebook who would "recover" your password, change your profile picture to the photo they took of you in drag being touched up by a biker, change your status to Dead and start inviting people to your funeral? Because that's the vast majority of my friends - I'd trust them with my life but wouldn't dream of trusting them with £5. Or my beer. Or access to my Facebook accou - ohhhhhhh wait!

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      I know lots of those people, but they are not my trusted friends. If you have no true trusted friends, don't set any on facebook. It's not mandatory.

    • I am not concerned with the quality of my friendships. I am concerned with the quality of the computer security practiced by those friends.

      How many compomised computers are there in the world? How many successful Facebook phishing campaigns have there been? The trackrecord of my friends asking for computer support because they didn't know what they were doing is alarming. I think that my personal security policy will remain unchanged because of this option: only trust ME!
  • Interesting, so three of your "best friends" could work together to reset your password and gain access to your facebook account? In middle and high school enemies and friend change quickly. This could create some nice hijacking opportunities for malicious "friends".
  • Looks like Facebook gives special codes to three to five designated people. Then if you forget your facebook password, you contact them, may be outside facebook and through some kind of channel via face book and get the codes. If you are able to collect three such codes, facebook restores your password. This is not any worse than asking for the nickname of your younger brother or the name of your pet or the mother's maiden name. In fact facebook has thoroughly undermined these stupid security questions.

    Fo

    • For some reason the banks and credit card companies are very friendly on phone. They seem to trust the caller id and an actual human being on the phone.

      It's worth nothing that the ANI that your bank gets when you call their 800 number, is different than the "caller ID" service you might have on your home phone. Caller ID is much easier to spoof.

  • I thought about helping you get back into your account...then i remembered that weird tirade about gay marriage and kenyan socialism you went on last year...and that time you wouldnt shut the fuck up about kony....and the farmville crap. Trust me, this is for your own good.
  • The three to five people you choose as 'Trusted Contacts' are likely to be the 'closest' to you and thus the most likely to share behaviour and preferences with you.

    Once you identify those people, Facebook can use their patterns to (presumably) target ads at _you_ better, and charge a premium to advertisers for this 'more accurate' imprint.

    Whether this works remains to be seen, but in any case this has nothing to do with convenience and much more to do with monetization.

  • by Anonymous Coward on Friday May 03, 2013 @09:07AM (#43619171)

    Sound like a good idea in theory, and it would also allow close friends to close an account of a departed one.

    I know previously this can be distressing to contact facebook admins, and convince them that this is a valid request.

    • They don't have some sort of semi-automatic system for that? Hell, one person I knew, they practically had her profile down before I found out she was dead mere days later.

  • I've heard a lot of complaints about people passing away, and their facebook account becoming inaccessible to friends or family. This would be useful in the event of a long-term disabling event or death, allowing a spouse or close friend to pass on information in the event of a tragedy (or just begin the process of closing out the account).

If a listener nods his head when you're explaining your program, wake him up.

Working...