I’m sure most of you, if not all, have experienced getting locked out from any of their social media or email accounts at least once. It may be because, you forgot your password, or you’ve lost the phone wherein you receive those two-factor authentication codes, or maybe you accidentally got a wrong answer to a security question.
So what do we usually do? We try to recovery our account through the account recovery feature of the site where you got locked out of. Unfortunately, none of the widely available account recovery measures are very secure. Large companies such as Yahoo, who just recently disclosed the breach of their accounts, often don’t just include passwords but even answers to security questions. This will allow hackers to use these information to hack your other accounts on different platforms or websites. Usually, websites would respond to a user’s lost password report, by sending a recovery link to the user’s email once they’ve answered the security questions.
Source: Regmedia
This is why the social media giant, Facebook, wants to fix this means of account recovery. They want to replace email as the as the hub of online identity management.
At the USENIX Enigma conference last January 30, Facebook security engineer Brad Hill announced that their company will be launching an account recovery feature for other websites called Delegated Recovery.
Source: Bestofmicro
Here, Facebook will let users set up encrypted recovery tokens for websites like Github, and if a Github user loses access to their account, she will send the stored token from her Facebook profile back to Github. This token will provide that user’s identity and will unlock his/her account. Encryption of these tokens will provide privacy. Facebook will not be able to read the information stored in the token, and it will not share information about your identity on third-party websites.
Hill told Techcrunch that “No matter what kind of site you are, you have to deal with the issue that someone will lose their password or their token. We can get you back into your account even if you drop your phone off the boat.”
Delegated Recovery is also Facebook’s way to convince users to focus their online identity around their Facebook profile, rather than their email address. For a long time, account recovery process has always revolved around using your email address to register for all your online accounts. By using the encrypted token system, Facebook can offer improved security without the need of emails in the process.
Article Sources:
