Facebook apologizes for text spam for 2FA users; here’s how to secure your account wisely
An engineer signed up for Facebook two-factor authentication and the social network responded by sending him endless text notifications, ones he didn’t want.
After Gabriel Lewis posted about his woes on Twitter, Facebook responded by saying it was “looking into the situation.”
Friday afternoon, it found the answer in an apology. “I am sorry for any inconvenience these messages might have caused,” wrote Alex Stamos, Facebook’s Chief Security Officer, in a blog post. “We are working to ensure that people who sign up for two-factor authentication won’t receive non-security-related notifications from us unless they specifically choose to receive them, and the same will be true for those who signed up in the past. We expect to have the fixes in place in the coming days.
To reiterate, this was not an intentional decision; this was a bug.”
In the meantime, USA TODAY has the quick, easy solution for readers, bug or no bug. Don’t give Facebook your phone number.
Two-factor authentication is recommended by security experts as a way to keep hackers away from your private networks — think emails, social accounts, banking, your access to the Google and Amazon universes, by signing in twice. In general, you sign on with your password and then wait for a SMS text for a new code for a second sign-in.
But you can apply two-factor authentication without getting texts.
Your best bet: download a third party app, like Google Authenticator or Authy, which generates specific codes that you can then use for your sign-in.
Facebook also offers “Security Keys,” that would let you sign in via a USB device. It’s more secure, but for most of us, returning to the days of carrying a dongle for a code would be a hassle.
Also a hassle? Getting anything more than a short text with a code from an app that is probably already sending you push notifications and emails.
Lewis, who is a software engineer for Panda, a soon-to-launch video chat app, thought it was odd that his request to sign up for 2FA resulted in a wave of new text notifications from Facebook about new photo postings and the like. He had signed up not to get notifications. What’s more, he said, his replies to those unwanted notifications got posted to his Facebook wall.
“It was like, now we have his permission for his phone number, now we can start sending him notifications and get him to use Facebook more,” he told USA TODAY in an interview. “Or it’s a bug.”
His original tweet got over 1,000 re-tweets.
This reporter signed up for Facebook 2FA text notifications and didn’t get any unusual texts. But Facebook also said it would take at least a week for the service to get set up.
Facebook notes that people who sign up for 2FA using the U2F security key or code generator apps “do not need to register a phone number with Facebook.”
To add the third-party authenticator apps, start by downloading them to your phone at the iTunes or Google Play stores.
Then, on Facebook, go to the More tab, select Security and Login and Two-factor Authentication. Here, Facebook offers several choices. We suggest Code Generator.
Open it up, and Facebook will ask you to use your app to connect, via a QR code, the first time, and then to type in the code generated in the app. Now you’re all set up. Every time you want to re-open Facebook, you’ll be prompted to add a code generated by the authentication app.
Source:-Â https://www.usatoday.com/story/tech/talkingtech/2018/02/16/how-secure-your-facebook-account-and-prevent-facebook-spamming-you-texts/345483002/
