11 thoughts on “Now you can have my Facebook password as well!”

  1. As I was reading your article I enabled two-step authentication on Facebook myself, and I noticed they do provide App Passwords.
    On the security settings page, below the log-in approvals there’s a section called “App Passwords”.

  2. Activated this as well. I am now worried that I will loose my phone just at the moment my 30 days expire on my laptop and I won’t be able to login to Facebook anymore.
    Those 10 printed codes I got with my Google two-step verification somehow seem like a good idea now. Doesn’t Facebook do this?

    • Well, you could generate a couple of app passwords and write those down. Those should allow you to log in without login approval, upon which you’d be able to deactivate login approval?

        • darn, and form an app you can’t change the “login approval” settings, so you’re blocked. this is what facebook has to say on the subject:

          If you can’t access your phone, you’ll need to log in to your account from a computer or phone that you’ve already linked to your Facebook account (ex: one of your recognized devices).
          Once you’ve logged in you can add a new mobile number to your account or turn off login approvals.
          If you unable to log in from one of your saved devices, you can file a report.

  3. I use Two-Factor Authentication across a lot of my accounts. I feel a lot more secure when I can telesign into my account with an OTP. I am glad that is offered as an option for many sites, but not enough. It is worth the time and effort to have the confidence that your account won’t get hacked and your personal information isn’t up for grabs. It would be nice to see more of the leading companies in their respective verticals start giving their users the perfect balance between security and user experience. I know some will claim that 2FA makes things more complicated, but the slight inconvenience each time you log in is worth the confidence of knowing your info is secure. I’m hoping that more companies start to offer this awesome functionality. To me this should be a prerequisite to any system that wants to promote itself as being secure.

  4. I got one today, and my thunderbird is logged in from months anyway.
    as soon as I saw xmpp I knew it was thunderbird… BUT the issue was that facebook seemed to report some private ip with it… and I am not using that same subnet of private ip.
    Makes me wonder if someone else did log in.. Anyway changed password and now im going to put that 2 step in.

    • Hi Krish; I suspect the private IP is an indication this is a Facebook-internal problem, with the XMPP-gateway server(s) (on the private IP) sometimes being blocked from logging in on the Facebook-authentication platform.


Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.