Why You Shouldn’t Use Facebook to Log In to Other Sites

Facebook offered a convenient and secure way to sign up for online services. A major hack shows it failed at its one job.

Farhad Manjoo


Photo: Jaap Arriens/NurPhoto via Getty Images

I’m going to quit using Facebook to log in to apps and sites online. You should, too.

That’s the most reasonable way to respond to Facebook’s announcement last week that a security breach allowed hackers to infiltrate the accounts of at least 50 million users, and possibly tens of millions more. The hack gave attackers access to not just your Facebook account but also possibly the many accounts you used Facebook to log in with — services like Instagram, Spotify, Airbnb, Tinder, Pinterest, Expedia, The New York Times and more than 100,000 other places online.

I say “possibly” because neither Facebook nor third-party sites seem to know the precise extent of the damage. In a statement on Tuesday, Guy Rosen, Facebook’s vice president of product management, said the company had “no evidence” that attackers breached other sites through the hack, but that the company was building more sophisticated ways for sites to do their own deeper investigation.

But the mere possibility is highly troubling — and if the hack allowed access to any other sites, Facebook should be disqualified from acting as your sign-on service.

This is a classic you-had-one-job situation. Like a trusty superintendent in a Brooklyn walk-up, Facebook offered to carry keys for every lock online. The arrangement was convenient — the super was always right there, at the push of a button. It was also more secure than creating and remembering dozens of passwords for different sites. Facebook had a financial and reputational incentive to hire the best security people to protect your keys; tons of small sites online don’t — and if they got hacked and if you reused your passwords elsewhere, you were hosed.

But the extensive hack vaporizes those arguments. If the entity with which you trusted your keys loses your keys, you take your keys elsewhere. And there are many more-secure and just-as-convenient ways to sign on to things online.

The best way is to use a dedicated password manager — a service, like LastPass or 1Password…