The Giant Security Hole That Facebook Doesnt Care About ('Cause it's impossibly stupid?): Facebook Won't Let You Change Your Security Question!

Sam Biddle 

(BTW PayPal has a scam aimed at it, too. You get an email from “PayPal”; you open it, looks exactly like the real thing, so you log it and it says, ‘wrong password’, even if you’ve entered the correct one, don’t matter; so you carefully enter the real one again…GOTCHA! And your money goes straight down TheirTube… tomdennen

You probably assume hackers are using all sorts of devious viruses, obscure scripts, “exploits” (whatever that means, right?) and other complex means to break into accounts. But often the means of entry are stupid simple. Facebook has a huge one—and doesn’t care about fixing it.

There’s a basic premise here that isn’t a Facebook problem, but really an internet problem: it’s super easy to reset someone’s password (like stealing an old tub). The web is an ornate, lumbering thing built on tiny little stilt legs, its foundation unfit for what came after it. It’s complex stuff standing on simpler stuff. New on old. And often the old can’t cut it: just ask Giz alum Mat Honan, whose online life was savaged because of the stupid-simple processes standing between assholes and us online. You don’t need to be a hacker—you can just talk your way in:

• Step one: Say you’ve forgotten your password.

• Step two: Say you’ve forgotten your email address.

• Step three: Use a security question or customer service rep to change over to a new email address—one you control.

• Step four: Send a new password of your choosing to that new email address.

• Step five: Log in.

This is the same lazy, methodical trick that hit Honan, breached @BurgerKing, and this past weekend, tried to crack my Facebook account. Again, and again, and again, because Facebook makes it so easy…

MORE HERE