1

Today on my Facebook I saw a new (to me at least) feature to access your account if you lose access somehow.

The process is simple. You add 3 to 5 friends as trusted friends. Then if you lose access to your account, Facebook will give each of those friends a piece of a security code. The you can then contact those friends and gather the code to access your account.

This image is from the walk through where Facebook explains it in their own words:

But now I wonder, **what are the actual benefits of this?**

The only benefit I see is that you now have a sort of trump card to always have a way back into your account. An attacker can hack into your account but you will always be able to utilize your friends to get back in. But what does this solve that a simple texted/emailed access code (two factor authentication) to you, the account owner, doesn't? I suppose it turns it into 3 to 5 factor authentication but is that ever necessary.

Especially at the cost of having to contact 5 different people and gather codes to log in and possibly do so over an insecure medium.

Is there really a benefit or is this security theater?

1

This is a really interesting idea and I don't think it's just security theatre. Email accounts can be hijacked through technical means and/or social engineering. 2FA can be broken (via hacked email or exploited SS7 vulnerability).

This mechanism offers a way to always be able to retain control of your account. It does however rely on your friends to not be bribable and not fall for social engineering attacks from attackers trying to exploit this to this to hijack your account and humans are often a weak link in the security chain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.