For Facebook, I have two-step verification activated, and whenever I have been signed in and then sign out, I clear the Facebook cookies. I sign into Facebook proper (i.e not counting the Messenger app on my phone) like maybe once or twice a month.
A few months ago when I signed into Facebook, it didn't send me an sms, instead it sent a code to my e-mail. I entered that code, and was then asked to change my password. Then I received the two-step verification code via sms.
I was a bit confused by this behavior. It hadn't happened to me before. But I thought maybe it is some security measure that I have to change my password from time to time. Could be, I guess.
But then when I signed in today, the same thing happened. Got a code via e-mail, and was then asked to change my password. Then I received the two-step verification code via sms.
Why does Facebook do this?
I figure out that if someone got my account password, I would have gotten sms:es with two-step verification codes. Likewise, I tried later today to sign in with a known wrong password, i.e a deliberate fail, to see if it would result in any reaction from Facebook. Soon after Facebook sent me an e-mail saying that they had discovered I had problems signing in. As I have not received such an e-mail before, I would guess there have not been massive brute force attempts against my Facebook account.
So why does Facebook do this?
A few months ago when I signed into Facebook, it didn't send me an sms, instead it sent a code to my e-mail. I entered that code, and was then asked to change my password. Then I received the two-step verification code via sms.
I was a bit confused by this behavior. It hadn't happened to me before. But I thought maybe it is some security measure that I have to change my password from time to time. Could be, I guess.
But then when I signed in today, the same thing happened. Got a code via e-mail, and was then asked to change my password. Then I received the two-step verification code via sms.
Why does Facebook do this?
I figure out that if someone got my account password, I would have gotten sms:es with two-step verification codes. Likewise, I tried later today to sign in with a known wrong password, i.e a deliberate fail, to see if it would result in any reaction from Facebook. Soon after Facebook sent me an e-mail saying that they had discovered I had problems signing in. As I have not received such an e-mail before, I would guess there have not been massive brute force attempts against my Facebook account.
So why does Facebook do this?
