{"action":"created","issue":{"url":"https://api.github.com/repos/jdavis/twofactorauth/issues/1181","labels_url":"https://api.github.com/repos/jdavis/twofactorauth/issues/1181/labels{/name}","comments_url":"https://api.github.com/repos/jdavis/twofactorauth/issues/1181/comments","events_url":"https://api.github.com/repos/jdavis/twofactorauth/issues/1181/events","html_url":"https://github.com/jdavis/twofactorauth/issues/1181","id":88878518,"number":1181,"title":"Facebook 2FA is also one account per phone number","user":{"login":"alx9r","id":11237922,"avatar_url":"https://avatars.githubusercontent.com/u/11237922?v=3","gravatar_id":"","url":"https://api.github.com/users/alx9r","html_url":"https://github.com/alx9r","followers_url":"https://api.github.com/users/alx9r/followers","following_url":"https://api.github.com/users/alx9r/following{/other_user}","gists_url":"https://api.github.com/users/alx9r/gists{/gist_id}","starred_url":"https://api.github.com/users/alx9r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alx9r/subscriptions","organizations_url":"https://api.github.com/users/alx9r/orgs","repos_url":"https://api.github.com/users/alx9r/repos","events_url":"https://api.github.com/users/alx9r/events{/privacy}","received_events_url":"https://api.github.com/users/alx9r/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-06-17T00:51:15Z","updated_at":"2015-06-18T02:29:48Z","closed_at":null,"body":"I just witnessed the following on Facebook:\r\n\r\n* user has two accounts on Facebook: one for a business and another for personal use (I'll call these `account1` and `account2`.)\r\n* user enables 2FA for `account1` using phone number and Google Authenticator\r\n* user enables 2FA for `account2` using same phone number and Google Authenticator\r\n* Facebook sends the following email to the address associated with `account1`:\r\n\r\n>\"You recently removed your primary phone from your account.  Because of this, we turned off login approvals on your account to ensure that you don't get locked out when using an unrecognized computer or mobile device to login.\"\r\n\r\n* user is now able to login to `account1` on a new device with just their password and no second factor\r\n* checking the 2FA settings on `account1` reveals 2FA is indeed turned off for that account\r\n\r\n### The Facebook Entry Should have a Hazard Symbol like Twitter\r\n\r\n![image](https://cloud.githubusercontent.com/assets/11237922/8197599/e874ab3a-144e-11e5-8d83-db7098a40a40.png)\r\n\r\n_À la_ the twitter entry, the Facebook entry should have a hazard symbol that states something like the following:\r\n\r\n>\"SMS required for 2FA, 1 account per phone\""},"comment":{"url":"https://api.github.com/repos/jdavis/twofactorauth/issues/comments/113016220","html_url":"https://github.com/jdavis/twofactorauth/issues/1181#issuecomment-113016220","issue_url":"https://api.github.com/repos/jdavis/twofactorauth/issues/1181","id":113016220,"user":{"login":"alx9r","id":11237922,"avatar_url":"https://avatars.githubusercontent.com/u/11237922?v=3","gravatar_id":"","url":"https://api.github.com/users/alx9r","html_url":"https://github.com/alx9r","followers_url":"https://api.github.com/users/alx9r/followers","following_url":"https://api.github.com/users/alx9r/following{/other_user}","gists_url":"https://api.github.com/users/alx9r/gists{/gist_id}","starred_url":"https://api.github.com/users/alx9r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alx9r/subscriptions","organizations_url":"https://api.github.com/users/alx9r/orgs","repos_url":"https://api.github.com/users/alx9r/repos","events_url":"https://api.github.com/users/alx9r/events{/privacy}","received_events_url":"https://api.github.com/users/alx9r/received_events","type":"User","site_admin":false},"created_at":"2015-06-18T02:29:48Z","updated_at":"2015-06-18T02:29:48Z","body":"I see.  That is true.  I wonder if Facebook has a bug submission process..."}}