Hacker News Reader

Comment by powera | Hacker News Reader

I'm sorry she had a bad experience (and if the situation was triggered by something she posted that's horrible), but from a security point of view, if the automatic security questions can't be answered and you can't provide an "official government ID", the only way that you should be able to get access back to your account is "from a favor from someone on the inside that knows that you are you".

If there's any way that she can just say she's herself and skip the security procedures on a regular basis, then they aren't security and anyone else can just do the same thing to skip the procedures, so they might as well not even have them.

View on HN

She's not saying that Facebook shouldn't have security procedures. She's saying that Facebook's security procedures aren't designed properly and that they don't work for her. Plenty of identity providers (she cites Apple's policies in particular) have more reasonable ways of recovering your account.

She's saying they're not secure, but quite the opposite is true: they're too secure.

Apple's had major problems with account hijacks, including accounts of celebrities. There's no easy answers here.

also: "de-anonymizing refugees usually precedes murder on a grand scale" - that's an aggressively outrageous claim. "Bad things happen in the world" does not mean "if we ignore the world, nothing bad can happen". And I can't even argue with someone who disagrees.

EDIT: to people down-voting, how is her claim at all reasonable? there are lots of refugees that have been murdered in nameless graves. if anything, the whole "say her name" would suggest that people on facebook would be less likely to be murdered by a dictatorial state. but apparently since she doesn't want to be nice to facebook, they are literally acting as a conspirator to mass murder.

No that's pretty fair.

I suggest that the measures are largely security theatre to begin with. Consider the attached accounts of determined identity thieves (1,2). Facebook needs to inconvenience children, but also needs to acknowledge its own theatre in serious situations. Consider that many of the mechanisms that government issued ID use to prevent forgery are impossible to verify unless you're in physical possession of the ID.

It also needs to provide a mechanism by which it does not gain and store additional information during the process of someone trying to opt out of their privacy free zone.

1 - http://www.bloomberg.com/news/articles/2015-07-15/an-identit... 2 - http://resources.infosecinstitute.com/confessions-of-an-iden...

The security questions might be done wrong, I'm more saying that "a real person on the inside who can personally verify your identity" is in fact a key part of the security process.

Surely not everybody can be expected to know a senior Facebook employee?

> the only way that you should be

Well, your friends could vet for you too.

Reply on news.ycombinator.com