News for hackers. Stuff that matters.

A comment on Facebook Doubles Down on Misusing Your Phone Number. Parent comment

Re:Facebook Doubles Down on Misusing Your Phone Number by pxeboot on Monday March 04, 2019 @08:16PM (#19307304)
Facebook supports U2F security keys for 2 factor auth [1].

[1] https://m.facebook.com/notes/facebook-security/security-key-...

[ Parent | on HN ]
Re:Facebook Doubles Down on Misusing Your Phone Number by BFLpL0QNek on Monday March 04, 2019 @09:27PM (#19307620)
The UX I'd say is following dark patterns for this.

You cannot enable U2F without first enabling SMS Auth and or OTP Auth. Once u2f enabled if you delete both SMS Auth and OTP auth it disables 2 factor auth and takes you to a welcome screen to get started enabling it again with the only 2 options SMS / OTP, once enabling one of them you can add U2F again.

Also I have "security.webauth.u2f" enabled in Firefox but Facebook is the only U2F service I use that doesn't work in Firefox so it falls back to the SMS / OTP methods on login.

[ Parent | on HN ]
Re:Facebook Doubles Down on Misusing Your Phone Number by btrettel on Monday March 04, 2019 @10:50PM (#19307943)
> Also I have "security.webauth.u2f" enabled in Firefox but Facebook is the only U2F service I use that doesn't work in Firefox so it falls back to the SMS / OTP methods on login.

I noticed this as well. I was able to add my security key via Firefox, but for some reason Facebook decided that you need Chrome to use U2F when logging in.

[ Parent | on HN ]