::Trend Micro Threat Resource Center::

15 October 2010

Facebook Adds Extra Layer Of Security

Facebook, the giant of the social media networks, has added extra security to user accounts. This security comes in the form of three new features that are available now for most users.

According to Jake Brill in The Facebook Blog, the first feature that has been introduced is an option to receive a one time use, temporary password for your account. According to Brill, "Simply text "otp" to 32665 on your mobile phone (U.S. only), and you'll immediately receive a password that can be used only once and expires in 20 minutes. In order to access this feature, you'll need a mobile phone number in your account." I can see this being useful in the case that your account has been compromised and your password has been changed by whoever accessed it. You would then be able to get into your account to create a new password that only you know. Of course, in the case of a lost or stolen phone, this policy works against you.

This next feature I am actually glad for. It is a remote sign-out feature that lets you sign off your account from any computers it is active on. It can also show you where you account is being accessed from, so you can tell if someone who shouldn't be on your account is. This is a feature that has been available for other services, such as Gmail, for a long time now, and I'm glad Facebook has finally caught up.

Finally, Facebook will begin prompting you more often for security updates. From Brill, "when people log in to Facebook we will regularly prompt them to keep their security information updated. If you ever lose access to your account, having this information helps us verify who you are and get you back into your account quickly." This is nice for the people who have a hard time remembering to update this kind of information frequently enough.

Overall, I see these new features as two steps forward, and one step back for Facebook security. The step back is only in the case that your phone is lost or stolen, as whoever is in possession of your phone is now in possession of your Facebook account.