Just the next erosion of our privacy, disguised as a protection of our privacy.
Hyperbole would be a more apt description.
How can something that is opt-in be an erosion of privacy?
Quite easily. You can choose to use a service without fully understanding the privacy implications. I don't think we can expect the general public to be infosec and personal rights experts.
If you start by assuming they have access to the cell carrier data (which is a super-mega-wacky assumption), why do they need you to provide your number in the first place? They can just look it up in the billing, which ties to a verified address.
And even if you really are this paranoid, you can just use a $10 burner phone for this authentication.
That said, this is a pretty cool feature, and seems to play into Facebook's ongoing attempt to become the standard for identity on the internet - added security is a really good thing when your entire identity is tied to a single service.
I highly doubt that. The two groups responsible for each probably aren't aware of what the other party is working on. I don't see Facebook launching a feature if it isn't ready, nor do I see them holding a feature back that is ready.
I wish this launch hadn't been tarnished / buried by it :-(.
For any other site looking to implement this, check out our open-source web SDKs and service at Duo Security:
http://www.duosecurity.com https://github.com/duosecurity
At the very least, we highly recommend folks use it to protect their own cloud/datacenter infrastructure, and have made it free to do so (assuming you have 10 or less admins):
http://blog.duosecurity.com/2011/04/ssh-keys-that-call-you-b...
We support callback, SMS, mobile apps for 7 platforms, as well as traditional hardware tokens for online and offline use...
More websites need to use two-factor authentication like Facebook is doing, but a more secure and easier-to-use approach is to send an image-based authentication challenge to the user’s phone, like Confident Technologies provides: http://bit.ly/dMNzB5. A grid of pictures is displayed on the user’s smartphone and to authenticate, the user must correctly identify the pictures that fit their pre-chosen, secret categories. Even if someone else had possession of your phone, they wouldn’t be able to authenticate because they wouldn’t know your secret picture categories.
In contrast to Google's solution which provides you with a set of fallback codes.
