Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

forbes.com

Post reply on HN
Print view View original

61–70 of 301 posts

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#61

Post by sysihyk »

ta1243 wrote: post #20
jhgg wrote: post #13

And this is why we should all adopt webuathn, and get rid of totp based 2fa. This attack vector is significantly harder to pull off if a hardware authenticator will assert that the user is logging into the correct domain.

10 years ago "use a strong password with all these symbols" Average person reluctantly moves from 123456 to P@55word! 8 years ago "no passwords such, use a pass phrase" Average person reluctantly moves from P@55word! to correct-horse-battery-staple 6 years ago "ok but you need to use different passwords on each site" Average person reluctantly moves to different passwords per site 4 years ago "but you can be phished,…

[dead]

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#62

Post by orra »

sushibowl wrote: post #32
ta1243 wrote: post #20

Earlier quoted context omitted.

10 years ago "use a strong password with all these symbols" Average person reluctantly moves from 123456 to P@55word! 8 years ago "no passwords such, use a pass phrase" Average person reluctantly moves from P@55word! to correct-horse-battery-staple 6 years ago "ok but you need to use different passwords on each site" Average person reluctantly moves to different passwords per site 4 years ago "but you can be phished,…

> My house's front door lock is broadly the same interface as my great-grandparent's front door lock True, but your house's front door lock is very likely to offer quite poor security. Most house locks are vulnerable to bumping attacks that are almost trivial to pull off. The only reason this is acceptable is the threat model you're dealing with when securing a physical house is very different from securing an intern…

Also, people should definitely upgrade their front door locks! A three star euro cylinder will snap, instead of letting the intruder in.

While surely nothing offers complete security, it massively increases the effort required to break in (from essentially zero).

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#63

Post by pwython »

mjevans wrote: post #39
sushibowl wrote: post #32

Earlier quoted context omitted.

> My house's front door lock is broadly the same interface as my great-grandparent's front door lock True, but your house's front door lock is very likely to offer quite poor security. Most house locks are vulnerable to bumping attacks that are almost trivial to pull off. The only reason this is acceptable is the threat model you're dealing with when securing a physical house is very different from securing an intern…

If someone _really_ wants in, the windows are an even weaker point. Obvious at a glance breakage probably not even necessary... (those latches seem awfully flimsy).

A similar argument I have with my wife: She insists on only living in gated communities. I'm like, "it's just a PVC pipe that goes up and down, it's not fort knox." But for some reason that gives her peace of mind, and worth the HOA fee of $350/mo.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#64

Post by daneel_w »

jhgg wrote: post #13

And this is why we should all adopt webuathn, and get rid of totp based 2fa. This attack vector is significantly harder to pull off if a hardware authenticator will assert that the user is logging into the correct domain.

Are you really suggesting that a billion netizens should stop using TOTP on their smartphones and go buy another hardware device?

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#65

Post by PenguinCoder »

ilyt wrote: post #54
asddubs wrote: post #47

Earlier quoted context omitted.

was it the north korean government using military level hacking technology? yes. i mean, we don't know. but probably.

"Military level" is another means-nothing term. Could be anything from average phishing or some 0-day that happened to be found by gov employee or phishing email, to "a bunch of men kidnapped target and beat them till they gave them access

And for this case, highly highly doubt a threat actor would burn a zero day for a Reddit phish.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#67

Post by devnullbrain »

jefftk wrote: post #49
devnullbrain wrote: post #24

>While Reddit also suggests that updating passwords every couple of months is a good idea, as well as using a password manager, that's not advice most security professionals would currently condone. Changing passwords regularly, that is, not password manager usage. What inelegant phrasing. Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for yo…

> treat online accounts as throwaway wherever possible I don't need to know who you actually are, but over time interacting with other people here I've started to get a feel for several hundred accounts. This makes HN more pleasant because I have some sense of what sort of person they are to talk with, and what is likely to go well or poorly. When there have been subreddits I was really into, I would start to get a s…

If I attended a social club and my comments from 10 years ago were permanently engraved on the walls, I'd be much less honest and open.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#68

Post by kriops »

ta1243 wrote: post #20
jhgg wrote: post #13

And this is why we should all adopt webuathn, and get rid of totp based 2fa. This attack vector is significantly harder to pull off if a hardware authenticator will assert that the user is logging into the correct domain.

10 years ago "use a strong password with all these symbols" Average person reluctantly moves from 123456 to P@55word! 8 years ago "no passwords such, use a pass phrase" Average person reluctantly moves from P@55word! to correct-horse-battery-staple 6 years ago "ok but you need to use different passwords on each site" Average person reluctantly moves to different passwords per site 4 years ago "but you can be phished,…

WebAuthn is an UX improvement as well as a security improvement. I sympathize with your point, but in this case it’s easily sellable as the cure to the rest of your list … unless you somehow lose your key.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#70

Post by cheschire »

jefftk wrote: post #53
jhgg wrote: post #13

And this is why we should all adopt webuathn, and get rid of totp based 2fa. This attack vector is significantly harder to pull off if a hardware authenticator will assert that the user is logging into the correct domain.

And if you are stuck using TOTP, you can mitigate with a password manager that fills it for you only when the domain matches.

You know, I used to think the same thing. But then lastpass got hacked and it made me realize password managers have a lot of eggs in those baskets. It might be worth using two separate password managers and keep TOTP in the second one.
Post reply on HN