Facebook Asks New Users for Password to Email Account

Facebook has asked some new users to provide passwords for their email accounts. It's provoked fury among critics who say it goes against basic rules of online security.

Often when a user signs up for an online service they provide an email address as a form of identification. The service will normally check the address is genuine by sending a code or a link in an email to the address, thus proving the user does indeed "own" that address.

However, some people signing up to Facebook have instead been seeing a screen that offers to confirm the email address automatically. The screen includes a box into which the user types their email password, which Facebook then uses to verify the address is correct. It appears Facebook does so by logging in to the user's email account through an automated process.

It's a spectacularly bad move on Facebook's part: as security consultant Jake Williams told the Daily Beast, it is "beyond sketchy." That's for several reasons. (Source: thedailybeast.com)

Move Undermines Basic Safety

Firstly, there's no valid reason why Facebook should ever have access to a user's email password or account.

While some sites do let people use their social media accounts (including, ironically, Facebook) as an alternative way to show identity, this always works by redirecting the user to the social media account. The site they are signing up to doesn't access their login details.

Secondly, there's a serious danger that Facebook doing this could "normalize" the idea of handing over an email address and password to a third party - something that's particularly risky among less experienced computer users.

Once a scammer accesses an email account (for example), it becomes far easier to access other online accounts from the same user. This is especially true in the case of requesting a password reset on another site, which may be linked to a compromised account.

Finally, it raises the risk of a phishing attack. If it became established that Facebook asks for an email password, scammers would be much more likely to pull off similar attacks where they create a bogus page that looks like Facebook and asks for the password.

Facebook Abandons Policy

Confronted with the criticism, Facebook said it only used the method in a few cases, mainly with less reputable email services.

It added that it did not store the password after checking the email account. It also said users could choose other methods of verification such as an email link or a code sent by SMS, though these only appeared if the user spotted a button marked "Need help?"

Fortunately Facebook has now scrapped the policy altogether, saying "We understand the password verification option isn't the best way to go about this, so we are going to stop offering it." (Source: gizmodo.co.uk)

What's Your Opinion?

Would you provide your email password if Facebook asked for it? Was this a bad example for Facebook to be setting? Are you surprised Facebook would use such a method?