*Facebook / Instagram Paid Verification*
Implementation differences so far:
- Focus on ID verification from the start (missing in Twitter's roll out)
- Focus on decreasing impersonation (was the biggest concern come-to-life w/ Twitter's roll out)
- 2FA required (hoped for this)
Implementation differences so far:
- Focus on ID verification from the start (missing in Twitter's roll out)
- Focus on decreasing impersonation (was the biggest concern come-to-life w/ Twitter's roll out)
- 2FA required (hoped for this)
Do I think paid verification is the best idea in the world? I don't.
But I'm not a Product Manager so I'll focus on the cybersecurity elements of this roll out.
ID is *essential* in pay-to-play verification, otherwise impersonation goes wild (like we saw in the Twitter roll out)
But I'm not a Product Manager so I'll focus on the cybersecurity elements of this roll out.
ID is *essential* in pay-to-play verification, otherwise impersonation goes wild (like we saw in the Twitter roll out)
Thoughts on proposed benefit of paid verification on Meta:
A. Verified badge -- is it the same legacy verified icon on FB and IG? I would prefer a unique signifier to further reduce user confusion, mitigate additional impersonation edge cases, etc.
Guessing it's the same badge.
A. Verified badge -- is it the same legacy verified icon on FB and IG? I would prefer a unique signifier to further reduce user confusion, mitigate additional impersonation edge cases, etc.
Guessing it's the same badge.
B. "Customer support for most common issues"
- Customer Support is the main channel used by cyber criminals to takeover accounts. How will identity be verified during account recovery interactions? ID? KBA like birthdate?
A Customer Support channel always opens up new ATO risk.
- Customer Support is the main channel used by cyber criminals to takeover accounts. How will identity be verified during account recovery interactions? ID? KBA like birthdate?
A Customer Support channel always opens up new ATO risk.
C. "Active impersonation monitoring"
- Curious about implementation of impersonation monitoring. Is this a manual process / does it use AI?
- If it includes a human in the review process, how might that manual reviewer be social engineered, bribed, etc to let impersonation slide?
- Curious about implementation of impersonation monitoring. Is this a manual process / does it use AI?
- If it includes a human in the review process, how might that manual reviewer be social engineered, bribed, etc to let impersonation slide?
As always, my main concern is account takeover, social engineering, and the human element's involvement in this tools roll out.
Anytime a new feature is released, us ethical hackers (& the cyber criminals) start thinking through how it could be abused AND protected in lock step.
Anytime a new feature is released, us ethical hackers (& the cyber criminals) start thinking through how it could be abused AND protected in lock step.
If we're going to do paid verification at all, I'm glad Meta has required 2FA for it.
This ensures that an additional step is required upon sign in and reduces account takeover.
Would love to see additional education on likely scams to steal pw/MFA for these types of accounts.
This ensures that an additional step is required upon sign in and reduces account takeover.
Would love to see additional education on likely scams to steal pw/MFA for these types of accounts.
Another difference in Meta’s paid verification roll out:
Paid verification isn’t an option for FB or Instagram business accounts (yet).
Here’s to hoping Meta watched Twitter’s brand & ad rev impact during *The Great Impersonation* of Fall 2022 and made that rule for a reason.
Paid verification isn’t an option for FB or Instagram business accounts (yet).
Here’s to hoping Meta watched Twitter’s brand & ad rev impact during *The Great Impersonation* of Fall 2022 and made that rule for a reason.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
