Facebook says it will stop asking for email passwords to verify new accounts; previously, it used them to verify accounts whose email addresses didn't use OAuth
Responding to criticism, Facebook says it will stop asking users for their email passwords as a means of verifying some new accounts.
Context & Ripple Effects
Facebook has spent years experimenting with alternatives to email-based account proof: a CAPTCHA that asks users to upload a photo of their face, and a Delegated Recovery trial explicitly designed to obviate email's role in account recovery. Asking new signups for the password to an email address that didn't support OAuth sat awkwardly next to that work — it meant Facebook holding credentials it didn't issue.
First-order effects
- New users whose email provider lacks OAuth no longer have to hand their email password to Facebook during signup, removing a practice that let one company hold a second company's credential.
- Facebook's verification funnel shifts entirely onto tokens (OAuth) and its own checks instead of raw passwords, closing a credential-exposure surface it had defended as necessary.
Second-order effects
- Any platform still collecting third-party email passwords for verification now faces an obvious comparison point, since Facebook — hardly a privacy standard-bearer — has publicly abandoned the practice under criticism.
- Email providers gain leverage in the relationship: with OAuth positioned as the only acceptable bridge, services without token-based login face pressure to implement it or lose signup flows at large platforms.
Third-order effects
- If the pattern holds, identity verification consolidates around two models — delegated tokens like OAuth and platform-side behavioral checks such as the identity verification Facebook applies to profiles showing inauthentic behavior — rather than users surrendering credentials across service boundaries.
- Email's role as a trust anchor keeps eroding: between Delegated Recovery, OAuth-only verification, and encrypted notification channels like OpenPGP keys in profiles, the inbox becomes one signal among many rather than the root of account identity.
The trend: Account verification is migrating from collecting users' raw credentials toward delegated authorization and platform-side behavioral signals, with each high-profile abandonment of password harvesting raising the floor for everyone else.