2nd Kerckhoff's principle
This principle was conceived by a cryptographer for the cryptography field but applies to any securing process:
"It should not require secrecy, and it should not be a problem if it falls into enemy hands"
See: Kerckhoff's principle
I am not able to audit or proove a process which is kept secret. Hence there is no good reason to keep a securing process secret.
The only 2 reasons I imagine to keep secret a securing process I would have conceived would be:
- my process is weak and if my enemy read it he will be able to break it,
- I don't trust my process strength and I prefer to avoid the risk of case one.
In both cases I should aknowledge that my process is risky, not audited, not prooven. My secret is just a lie, a lie to me and a lie to my users.
"We use this photo to help us to check that this account belongs to you"
The truth is that if they don't have an evidence this picture is one taken of you as a physical person, they can't proove that this picture is an authentic one of you.
They have a relation set between:
- a photo: P,
- a sending phone number, or a sending computer IP address: N,
- an account name: A.
Not any relation with the physical person (the physical person might for example take a nice picture of his neighbour or his daughter).
R1: Facebook can't proove that a picture is an authentic one of a physical person.
What could they check?
They could check that photo P is not in any:
- database of photos signaled as used in identity theft and reported to Facebook, this search would take minutes,
- database of photos used to "identify" other Facebook accounts, this search would take hours.
All in all, they could detect quickly any attempt of identity theft "from you", if and only if the previous registered photos were authentic, which unfortunately they can't proove (no one can demonstrate that they have any robust process to proove authenticity of photo see R1).
I can't trust this process for the above arguments and the lack of clear communication from Facebook. If there is any error in my arguments, someone will be able to see it and signal it publicly.
This conclusion is not based on any good or bad reputation Facebook might have in the security field.