Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I've heard that there's a new type of security in Facebook. When logging in they automatically check if the IP Address is similar to that of the original IP during registration. That's in order to prevent hacking into someone's account via the three methods i.e keylogging, phishing or social engineering.
So, since VPNs and proxies change your IP, Facebook might just think that you're intruding in someone's account. I haven't tried it (I will) but I hope it doesn't work :P. Is it possible?
As far as I'm aware, Facebook don't actually block the new attempts from different IPs. Instead, they send an email to the registered email address with a notification that you logged into a new device, with a button to mark this as legitimate or malicious.
The tracking appears to work not only via your IP, but also a long-term identification cookie and other browser fingerprint data (e.g. user agent header) so that switching browsers or computers within the same network will still trigger it.
It depends.
Facebook analyzes the locations from which you use to log in from. Depending on where your new IP is located, Facebook may, or may not, give you access. Remember that it has never been your account in the first place.
In the case where Facebook finds the new location suspicious, it will use another mean to validate your identity. (E.g. an email to validate your attempt.) Once you validate that new location, you should be able to connect.
I don't know the details of the algorithm that decides whether that new connection should be considered as an abnormal behavior. Several parameters comes to mind, such as the distance between the locations, the time since your last connection, and so on and so forth. (Someone logging in in from Russia one hour after logging in from the USA 1 hour before is kinda suspicious.)
Anyway, if you have a total access to the mail box and/or the phone number associated with that account, you should be fine.
if (distance [km] / time_interval [hour] > 500) then alert(). (It would use less CPU usage than checking the password.) In other words, one would need to travel faster than 500 km/hr (= 310 mph) between 2 connections to raise an alert. This shouldn't annoy the casual user, unless they're traveling by plane. (And then, they'll just have to confirm their identity by email/phone the first time.)