Comment by basch | Hacker News Reader

Comment by basch | Hacker News Reader

Parent Full thread

Reasons I would use FB for sign in

-facebook already as my bank account info

-facebook already has my social security number

-if facebook doesnt have that stuff, im sure they could buy it or brute force it in seconds. (they can brute force a key for onion addresses...)

-I dont really care if facebook knows WHEN I log in (remember we are just talking log in services, not ad analytics)

-I trust facebook's service itself to be very secure. Facebooks login system its very likely insanely complex to prevent unauthorized logins. They know so much about me, they know when someone isnt me. See also, Google. I dont trust my bank to have this kind of "me detection" like I do Facebook/Google.

Reasons I would not use FB to sign in

-no other way into account if facebook decides to lock my account.

-super arbitrary content policy

-terrible support team to resolve arbitrary issues.

From a technical perspective, facebook seems like an excellent way to verify and secure the identity of "is this me." I cant really think of anyone else at the Google/AzureAD scale who does it better than Facebook. From a customer service perspective, Facebook gets the human side wrong of how to handle people.

> facebook already as my bank account info

> facebook already has my social security number

> if facebook doesnt have that stuff, im sure they could buy it or brute force it in seconds.

Do you not agree that this is a somewhat sad state of affairs?

I dont. I gave them the first two, and the third just speaks to how powerful their compute abilities are and how much money they have. I didnt say they were doing it.

While you are of course completely entitled to provide this information to anyone you see fit, I still find the thought of a bank using FB integration for anything, especially authentication, abominable.

And the fact that FB has your data certainly isn't a justification for a bank using any kind of such integration. My pet store has my credit card data, doesn't mean I want my bank to use them as an identification provider or have any integration with their systems.

And if powerful abilities are what you're looking for, the mafia can also brute force anything out of anyone. So I guess... yay? That's a good reason for banks to use them.

The reasons you yourself gave in the "against" section are sufficient to disqualify them. I have a contract with my bank. Any 3rd party introduced in there is additional liability. When that 3rd party is a company with a proven track record of every shady practice known to man it just reinforces my opinion.

I'm sure there are banks to cater for everyone's tastes. I just don't see a reason why I would ever want to give my business to any such bank.

Would you be mad if your bank offered to allow people to verify their identity with FB, or if they forced it. I dont see why the former bothers you, if you choose not to use that feature.

I would not use FB to log into a bank because of the Against section. Its not the technical implementation, but their human services that make the product too risky to be trusted as my keys to a door. Im not worried about them logging in and poking around my bank, im worried about them locking me out.

I wouldn't be mad, I would just choose to take my business elsewhere.

First of all I do not trust Facebook in any way and would no longer trust my bank if they trusted Facebook. FB does not have any kind of obligation towards me (at least none that they're willing to uphold, even if it means bending or breaking the law). I consider banking to be a critical service to me so I personally wouldn't want them to have anything to do with my bank.

Second of all FB and the bank could at any time share data that would negatively impact me and we already know there are no negative consequences to that as far as the companies are concerned.

And lastly, my bank using this even as an opt-in sets the trend and suggests their intentions in the future. Continuing to use it means endorsing the behavior. Like buying software from a company that also sells to oppressive governments. If I have a choice I avoid it.

I guess I trust facebook more than a small credit union to have secure software, better code review, smarter employees who dont fall for phishing, and less likely to lose their password database. The worst thing to happen to facebook from a security standpoint is either that page preview token or someone logging into some of their back end accounts a while back, and in both cases the people who got in didnt get very far.

Myspace, Adobe, and Dropbox all lost databases.

Why does Facebook need your banking info and SSN? And how in the seventh circle of hell would they feasibly brute force the correct information?

Because if you transfer too much money through them in a month they are required to verify your identity. Federal laws.

What's the connection between FB having to verify your identity and the question of brute forcing anything? I am 100% sure that brute forcing anything is 100% illegal. Using this as an "argument" in this discussion is really scrapping the bottom of the barrel.

Maybe you are reading too much into that line. The point is, im not giving them anything they dont already have access to.

(If they are asking my social to verify my identity, they already know it to verify against.)

But that's you. Some people don't give FB that kind of info. And they definitely don't want the social media identity to be irreversibly tied to their finance. It's not only about what you give FB, it's what you indirectly give to the bank. How long before they share data and that does affect you?

Again, your personal choice could be to post you CC data on your FB wall, you're free to do whatever you want. But you're seeing this very one sided if you assume everybody should be just as comfortable with FB and anything real in their life sharing data, or relying on a 3rd party with 0 obligations towards you for those critical services.

And mind you, the problem isn't that the bank is relying on a third party for things. They may already be using a cloud service, they could also be using an Apple ID or a Microsoft account. It's that they would use a social media platform in general (thus allowing data sharing which will never do the customer any favors), and Facebook in particular (since they have some of the most atrocious morals and unreliable promises).

give what I could consider private (credit card habits, gmails, fb messenger conversations) facebook having my credit card habits would be the least of my worries. maybe they could target me with more relevant ads.

i agree fb is terrible at promises or treating people like they matter, but the only thing they ever do with the data collected on people is make them targetable demographics to advertisers. use an adblocker if you dont want to see them.

Reply on news.ycombinator.com