Basic Facebook Guide: fb password recovery

How To Find My Facebook Password

What to do if you forget your Facebook password: How to reset and login
Whether you document every moment of your life, use it as a platform for your views or just login every other day for a cursory glance at your friends, Facebook is part of life for 1.86 billion people around the world.

Facebook requires a password to login, and at some point many of us will struggle to get in. Fortunately it’s easy to reset your password and login again.

[Read more: How to change a Twitter password]

If you fancy a break for Facebook check out our article, Fed up of Facebook, but want to keep Messenger? Here's how to do it...
I forgot my Facebook password

1: If you have forgotten your password you will need to click on the ‘Forgotten account?’ button on the right hand of the Facebook login home page.

2: This takes you through to the Find Your Account page, where you have the option of typing your username, phone number, email or full name into the box provided. Then simply click ‘Search.’

3: You’ll see a list of accounts that match your search. Find yourself and click ‘This is my account.’

4: Choose the Reset Your Password method to get yourr

5: Follow the instructions on the reset link and enter the code sent

I can’t log in with my mobile number

Drop any ‘0’ and ‘+’ digits and make sure you use your country code.
How do I change or reset my Facebook password?

Related Posts:

If you know what your current password is, but want to change it head to Settings which can be found in the menu at the top right hand corner of any Facebook page.

Once on this page, click Security and login - Change password and type in your current and new passwords before clicking ‘Save changes.’

For advice on picking a strong password we've got advice on keeping your personal accounts secure.

Fb password recovery

Facebook Password Reset Bug Gave Hacker Access To Any Account

Anand Prakash could have hacked your Facebook account or anyone else’s.
The India-based security researcher found a glaring password-reset vulnerability last month that has since been patched. The bug allowed him to crack open any of Facebook’s 1.1 billion accounts using a rudimentary brute force password attack.

But instead of pillaging accounts for financial data, Prakash reported his findings to Facebook which earned him a $15,000 bug bounty on March 2. The dollar value of his discovery, Facebook told Threatpost, is huge by Facebook standards. According to Facebook, only a rare few have earned more as part of its Bug Bounty Program.

Why was Facebook’s payout so much? It’s tied to the seriousness of the potential threat; what Prakash found is unnerving for anyone who values the privacy and security of their Facebook account. Prakash’s discovery was a mix of finding low-hanging fruit, being in the right place at the right time and being a prolific bug hunter, said a Facebook spokesperson.

The vulnerability exploited a hole in the way Facebook handles self-service password resets. “All you needed for this exploit was a Facebook username,” Prakash told Threatpost in an email exchange.

Last month, Prakash said, when he was probing for flaws in Facebook’s security, he noticed Facebook’s developer site (beta.facebook.com) and the company’s stripped-down basic version of its site (mbasic.beta.facebook.com) implemented different security settings when it came to password resets.

Prakash explains, whenever a user forgets their password they have the option to reset the password by entering any phone number or any email address via Facebook’s dedicated password-reset page. Facebook will then send a six digit code to the phone number or the email address you just entered in order to initiate the password reset. “I tried to brute the 6 digit code on www.facebook.com and was blocked after 10-12 invalid attempts,” wrote Prakash in his research notes posted to his personal website.

But Prakash’s brute force password attack wasn’t blocked on beta.facebook.com and mbasic.beta.facebook.com. “Rate limiting was missing on forgotten password endpoints,” he said. That allowed Prakash to easily crack the six digit code using Burp Suite, security testing software.

“It was a very simple exploit. This hack was available to anyone,” Prakash told Threatpost. “All an attacker needed was a username and initiate a forgotten password request.”

For Facebook’s part, it told Threatpost that Prakash had stumbled on a temporary bug that was only a vulnerability for a very short period of time.

Prakash said that only account he hacked open was his own. He said he discovered the bug and reported it the same day. Facebook said it plugged the security hole within hours of learning about it.

“One of the most valuable benefits of bug bounty programs is the ability to find problems even before they reach production. We’re happy to recognize and reward Anand for his excellent report,” a Facebook spokesperson said.

The find also earned Prakash a Twitter shout-out from Alex Stamos, Facebook’s chief security officer. He tweeted “Great bug, Anand. Enjoy the $15K.”

Blog Archive