Forgotten passwords are bane of the Internet. Facebook wants to fix that

Facebook is unveiling a new service that remedies one of the biggest headaches facing online users today—the forgotten password.

Starting Tuesday, Facebook will offer a service that allows users who lose their GitHub login credentials to securely regain access to their accounts. The process takes only seconds and uses a handful of clicks over encrypted HTTPS Web links. To set it up, Facebook users create a GitHub recovery token in advance and save it with their Facebook account. In the event they lose their GitHub login credentials, they can reauthenticate to Facebook and request the token be sent to GitHub with a time-stamped signature. The token is encrypted so Facebook can't read any of the personal information it stores. After the request is sent, the GitHub account is restored. With the exception of Facebook's assertion that the person recovering the GitHub account is the same person who saved the token, Facebook and GitHub don't share any personal information about the user.

The service is designed to eliminate the hassle and significant insecurity found in most account recovery systems that exist now. One common recovery method involves answering security questions. Many of the questions—for instance, "What is your favorite sport?" and "What is your favorite pizza topping?" asked by United Airlines—are easily guessed. That leaves people susceptible to account takeovers. Other methods, such as delivering security tokens by e-mail or SMS text message, lack the kind of end-to-end encryption that's increasingly expected for secure communications.

Unlike a compromised e-mail account—which often can be used to gain access to dozens of online accounts controlled by the owner—the Facebook service can be rate limited. This is according to Facebook Security Engineer Brad Hill who spoke at the Enigma Usenix conference in Oakland, California, on Monday. In the event a Facebook account is hijacked, the rate limiting can be used to prevent an attacker from accessing all the third-party accounts at once. That feature could prove useful in the future, should the service be adopted by a large number of other third-party services.

For now, the service is available only for GitHub, but Facebook hopes other third-party sites will also use it eventually. The social networking giant has published the technical specifications here, and it is offering cash rewards under the company's bug bounty program to people who find security vulnerabilities. Facebook has more info about the program here.