Facebook was asking new users for their email passwords when they signed up to create an account. Now, we know that it is common for users to sign up by using their email address or phone number. However, it is extremely unusual for companies to ask for a user’s email ID password.
This is because of security concerns for their email address. But Facebook asked users and many users even entered their passwords of email address. Since the issue has come to people’s notice, Facebook has said that they will stop asking users for their email address passwords.
Facebook says that they were asking it for verifying user’s accounts. The company would fetch the verification code sent to their email automatically as they got access to the user’s email address. But it is worth noting that this is a bad security practice. You should never enter your email address’ password online. Facebook also mentioned that users can still verify their account from code sent to their mobile number.
The company also claims that it never stored the passwords. Now, this is a major issue to collect passwords because of various reasons. One of which is that if a data breach takes place, your email address could be vulnerable too. Facebook, in a response to Axios, said “a very small group of people have the option of entering their email password to verify their account when they sign up for Facebook,”
But now that the issue has been highlighted, those users will also not have this option anymore. “That said, we understand the password verification option isn’t the best way to go about this, so we are going to stop offering it,” added Facebook. Apart from this, we already reported another security risk from Facebook. The company admitted that it stored passwords of Facebook users in plain text last month.