2

Typically when you reset a website password you receive an email.

A lot of sites send you a link with a code on the end of it to click on which will take you to an 'enter new password' form.

Facebook and Microsoft have a similar sequence except they send you a code which you need to copy and paste into the password update screen.

Why do they do it differently?

1 Answer 1

3

As a countermeasure against phishing emails.

Such emails will look like legit email asking you to change or update your password, but their link will direct you to a false website (still looking as legit as possible, with URL such as micr0s0ft.com: here the letter 'O' was replaced by zeros '0', it looks like "microsoft.com" but it is not "microsoft.com") which will transmit your credential to malicious people.

By requiring you to copy-paste the code instead of clicking on a link, you will have to type Microsoft/Facebook address yourself in the URL bar (or use your usual favorite link), so you are sure that the address is genuine and that you are not being directed to a false website.

4
  • 1
    But this is predicated on people aware that Facebook/Microsoft do not send links in the email. A falsified email can still trick users unless the said users have reset passwords before and somehow remember that they should see a code rather than a link.
    – Siyuan Ren
    Commented Apr 19, 2015 at 7:57
  • And in fact Facebook does send a link in the email that contains the code. In fact there're two links in the email. One of them is a big blue button that says 'Change Password' and when I click on it takes me directly to the password change form and the code from the email is on the query string. So I'm afraid I'm going to have to un-mark this as the answer. :) Commented Apr 21, 2015 at 20:30
  • Can you please rephrase your question? You seem to ask why Facebook ask to enter a code, which is the reason I mentioned in my answer. Then, for usability reason, because a lot of people do not know how to copy/paste, there is also a link... But as far as I know as mentioned in your title the question was about the code to be entered, otherwise the question may be unclear and should be rephrased... Commented Apr 22, 2015 at 9:46
  • ok fair enough, yours is the correct answer. Commented Apr 25, 2015 at 15:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .