Hacker News Reader

Comment by phoe-krk | Hacker News Reader

> The scammer used my Facebook auth token to remove me from the Facebook Business entity. Strangely enough this is possible without getting any emails from Facebook. I had no way to check my Business entity or Ad account on Facebook to see what's going on.

This is an error on the Facebook side. Actions like this should never be possible without appropriate confirmation or re-requesting the password for 2FA confirmation.

View on HN

I can sort of see why this is allowed.

* Employee starts a Facebook business page using their personal Facebook account.

* They add their boss to it.

* Employee is fired.

* Boss removed employee from Facebook business page.

edit: Should still send a notification email but I'm guessing angry "why did you remove me from X" reactions are why they don't. Not good but there's a logic behind it.

Sure, but then [employee]'s payment methods should be removed along with them. If they were using the company / boss's card or PayPal, then surely the company / boss should be able to add it back again without too much undue trouble.

Sure although I'd guess having all your advertising campaigns paused (as there's no billing info anymore) would annoy many people especially if they didn't notice or weren't aware it happened. It may in aggregate be cheaper for Facebook to just eat the cost of refunding these things versus providing more friction to their users.

The additional confirmation is not from the user being removed, it's from the user doing the removal. In this example the API/oauth was enough to do this. There really should be an additional confirmation certain times. Like how Google sometimes requires you to put in your password/2fa again, despite previously authenticating or saying something like "don't ask me again".

I presume the scammer added a new account, made it an admin and then used that to take over. So it's not the removal that's the issue but adding a new admin on the account. Of course if you allow this type of activity through oauth I don't think there's a good way to re-authenticate.

In that case, adding a new admin should require re-authentication.

Reply on news.ycombinator.com