<story><title>Researcher shows how to &quot;friend&quot; anyone on Facebook within 24 hours</title><url>http://arstechnica.com/tech-policy/news/2011/11/researcher-shows-how-to-friend-anyone-on-facebook-within-24-hours.ars</url></story><parent_chain></parent_chain><comment><author>anorwell</author><text>There seems to a lot of confusion, both in the article and in the comments, about the &quot;3 trusted friends&quot; password recovery. You have to manually select your trusted friends [1]. A fake account mimicking one of your friends will not be a &quot;trusted friend&quot; unless you make him or her one.&lt;p&gt;Furthermore, this is an opt-in feature.&lt;p&gt;[1] &lt;a href=&quot;https://www.facebook.com/help/?faq=119897751441086&quot; rel=&quot;nofollow&quot;&gt;https://www.facebook.com/help/?faq=119897751441086&lt;/a&gt;</text></comment>
<story><title>Researcher shows how to &quot;friend&quot; anyone on Facebook within 24 hours</title><url>http://arstechnica.com/tech-policy/news/2011/11/researcher-shows-how-to-friend-anyone-on-facebook-within-24-hours.ars</url></story><parent_chain></parent_chain><comment><author>tryke</author><text>I was surprised to learn that Facebook has a &quot;3 trusted friends&quot; method for recovering your account without the original email or security question response.&lt;p&gt;EDIT: tried to find a better source for that, came up with &lt;a href=&quot;https://www.facebook.com/notes/facebook-security/national-cybersecurity-awareness-month-updates/10150335022240766&quot; rel=&quot;nofollow&quot;&gt;https://www.facebook.com/notes/facebook-security/national-cy...&lt;/a&gt;&lt;p&gt;Looks like the feature is still being rolled out, and the attacker doesn&apos;t get to choose which friends he trusts.</text></comment>