Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by marcinzm | Hacker News Reader

Parent Full thread

marcinzm·

I can sort of see why this is allowed.

* Employee starts a Facebook business page using their personal Facebook account.

* They add their boss to it.

* Employee is fired.

* Boss removed employee from Facebook business page.

edit: Should still send a notification email but I'm guessing angry "why did you remove me from X" reactions are why they don't. Not good but there's a logic behind it.

View on HN

Sure, but then [employee]'s payment methods should be removed along with them. If they were using the company / boss's card or PayPal, then surely the company / boss should be able to add it back again without too much undue trouble.

Sure although I'd guess having all your advertising campaigns paused (as there's no billing info anymore) would annoy many people especially if they didn't notice or weren't aware it happened. It may in aggregate be cheaper for Facebook to just eat the cost of refunding these things versus providing more friction to their users.

The additional confirmation is not from the user being removed, it's from the user doing the removal. In this example the API/oauth was enough to do this. There really should be an additional confirmation certain times. Like how Google sometimes requires you to put in your password/2fa again, despite previously authenticating or saying something like "don't ask me again".

I presume the scammer added a new account, made it an admin and then used that to take over. So it's not the removal that's the issue but adding a new admin on the account. Of course if you allow this type of activity through oauth I don't think there's a good way to re-authenticate.

In that case, adding a new admin should require re-authentication.

Reply on news.ycombinator.com