0

Today when I logged in Facebook, no 2FA was shown.

I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately set it up again, and performed the security check (change password, check phone number, posts, comments) offered by the "Not me" log-in option.

Since I usually use Facebook on semi-public computers, the account might be hacked. Are there any other things that I should do to protect the account?

I assume that there should be some SMS confirmation before succeeding in turning off 2FA, but I received none. Should I worry my phone's security? Also, although I didn't reuse my Facebook account password on other sites, are there other credentials I have to change?

0

The authentication token/cookie was probably saved and you were not prompted to login in with 2FA/MFA. Normally changing 2FA/MFA settings requires you to input a new OTP again so unless you're second factor was compromised you're most likely safe in terms of access to the account - data can have been stolen/compromised. Also consider using an option that is not SMS for 2FA/MFA like an authenticator app or yubikey (U2F).

More information
https://www.yubico.com/products/yubikey-hardware/
https://pages.nist.gov/800-63-3/sp800-63b.html
https://www.facebook.com/help/148233965247823/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.