Uploaded April 2019 | Updated September 2026, 3 weeks ago
Since May of 2016 Facebook has been prompting some new users for their email passwords. Yes, their email passwords. WTF?
Apparently as a means to "verify" their email accounts, Facebook prompts users for their email passwords. That means they log in, verify the receipt of an email in order to setup the account. The idea here is also to provide the option to import your email contacts in order to setup your initial experiences on the network.
I can't even...but I try to explain the cybersecurity and privacy implications in this episode. Lots of reasons why this is flat out wrong.
References;
- Rob Price has the story for Business Insider, businessinsider.in/Facebook-says-it-unintentionally-uploaded-1-5-million-peoples-email-contacts-without-their-consent/articleshow/68930320.cms
- e-sushi the researcher who called it out on Twitter, twitter.com/originalesushi/status/1112496649891430401
- more on passwords in general, sans.org/security-awareness-training/blog/nist-has-spoken-death-complexity-long-live-passphrase
// MWM Y2 no. 027
Since May of 2016 Facebook has been prompting some new users for their email passwords. Yes, their email passwords. WTF?
Apparently as a means to "verify" their email accounts, Facebook prompts users for their email passwords. That means they log in, verify the receipt of an email in order to setup the account. The idea here is also to provide the option to import your email contacts in order to setup your initial experiences on the network.
I can't even...but I try to explain the cybersecurity and privacy implications in this episode. Lots of reasons why this is flat out wrong.
References;
- Rob Price has the story for Business Insider, businessinsider.in/Facebook-says-it-unintentionally-uploaded-1-5-million-peoples-email-contacts-without-their-consent/articleshow/68930320.cms
- e-sushi the researcher who called it out on Twitter, twitter.com/originalesushi/status/1112496649891430401
- more on passwords in general, sans.org/security-awareness-training/blog/nist-has-spoken-death-complexity-long-live-passphrase
// MWM Y2 no. 027
