Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

forbes.com

Post reply on HN
Print view View original

81–90 of 301 posts

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#81

Post by Gigachad »

ta1243 wrote: post #20
jhgg wrote: post #13

And this is why we should all adopt webuathn, and get rid of totp based 2fa. This attack vector is significantly harder to pull off if a hardware authenticator will assert that the user is logging into the correct domain.

10 years ago "use a strong password with all these symbols" Average person reluctantly moves from 123456 to P@55word! 8 years ago "no passwords such, use a pass phrase" Average person reluctantly moves from P@55word! to correct-horse-battery-staple 6 years ago "ok but you need to use different passwords on each site" Average person reluctantly moves to different passwords per site 4 years ago "but you can be phished,…

The difference is that your door is exposed to the neighbourhood while computers are exposed to the whole planet. Notice how your plain old number password is still sufficient for unlocking your phone.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#82

Post by hulitu »

ta1243 wrote: post #20
jhgg wrote: post #13

And this is why we should all adopt webuathn, and get rid of totp based 2fa. This attack vector is significantly harder to pull off if a hardware authenticator will assert that the user is logging into the correct domain.

10 years ago "use a strong password with all these symbols" Average person reluctantly moves from 123456 to P@55word! 8 years ago "no passwords such, use a pass phrase" Average person reluctantly moves from P@55word! to correct-horse-battery-staple 6 years ago "ok but you need to use different passwords on each site" Average person reluctantly moves to different passwords per site 4 years ago "but you can be phished,…

And what those "security" people do not understand: the user will choose the path of least resistance, making all those measures, useles.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#83

Post by sh4rks »

simonh wrote: post #46
ta1243 wrote: post #20

Earlier quoted context omitted.

10 years ago "use a strong password with all these symbols" Average person reluctantly moves from 123456 to P@55word! 8 years ago "no passwords such, use a pass phrase" Average person reluctantly moves from P@55word! to correct-horse-battery-staple 6 years ago "ok but you need to use different passwords on each site" Average person reluctantly moves to different passwords per site 4 years ago "but you can be phished,…

The Egyptians has wooden door lock mechanisms. It took thousands of years to develop modern door locks. We went from lever tumbler locks in 1778 to the modern Yale lock in 1861 (which fundamentally still operates on similar principles to the Egyptian wooden pin lock). I'm sure authentication technology will settle down in a decade or two.

Yet the time it takes to pick those locks hasn't changed for centuries

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#84

Post by rvz »

jhgg wrote: post #13

And this is why we should all adopt webuathn, and get rid of totp based 2fa. This attack vector is significantly harder to pull off if a hardware authenticator will assert that the user is logging into the correct domain.

Hilarious to see that even companies like Reddit still do not take security seriously despite being around longer than most internet companies.

If this was Meta, or Twitter that got breached via there would be outrage everywhere as to why employees did not use hardware keys.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#85

Post by unglaublich »

Dalewyn wrote: post #57
yreg wrote: post #50

Earlier quoted context omitted.

The "don't use your real name on the internet" advice wasn't great. When I set up a Google account as a kid I used a made up handle because all the adults told me to not use my name on the internet. Decades later and it's still my main account and I often need to either switch accounts to the one with my real name or embarassingly ask people to invite my nickname account to various shared documents, calendars, etc. N…

What's embarrassing about a nickname? Having a disconnected online entity means less-than-pleasant jackasses can't pull something from years or even decades ago, put it out of context, and proceed to troll your life. Not putting your real life identity on public display for the world to see means you maintain tighter control over how, when, and where your information gets out. Do you really need your real name, face,…

ponyomelette69@hotmail.com begs to differ.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#86

Post by ttctciyf »

devnullbrain wrote: post #24

>While Reddit also suggests that updating passwords every couple of months is a good idea, as well as using a password manager, that's not advice most security professionals would currently condone. Changing passwords regularly, that is, not password manager usage. What inelegant phrasing. Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for yo…

Even if I don't want to throw my reddit account away as such, it's hard for me to imagine ever thinking I'd care more about its security than I would about not giving Reddit my phone contact!

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#87

Post by thatnerdyguy »

criley2 wrote: post #71
kriops wrote: post #68

Earlier quoted context omitted.

WebAuthn is an UX improvement as well as a security improvement. I sympathize with your point, but in this case it’s easily sellable as the cure to the rest of your list … unless you somehow lose your key.

Not a UX improvement. Most users need a yubikey for the computer unless they have a new Mac. Asking my 65 year old dad to keep up with a yubikey is not just bad UX, it's failing UX. It simply will not happen. I don't even think it's realistic to get him to use a smartphone for this, he hates the things. WebAuthn works great for your Web 3.0 startup but as soon as you're talking about the average user, who is likely d…

I thought Windows machines just used the TPM to store WebAuthN keys? No yubikey necessary. Just a click on some popup dialog to select your credential for login.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#88

Post by yreg »

Dalewyn wrote: post #57
yreg wrote: post #50

Earlier quoted context omitted.

The "don't use your real name on the internet" advice wasn't great. When I set up a Google account as a kid I used a made up handle because all the adults told me to not use my name on the internet. Decades later and it's still my main account and I often need to either switch accounts to the one with my real name or embarassingly ask people to invite my nickname account to various shared documents, calendars, etc. N…

What's embarrassing about a nickname? Having a disconnected online entity means less-than-pleasant jackasses can't pull something from years or even decades ago, put it out of context, and proceed to troll your life. Not putting your real life identity on public display for the world to see means you maintain tighter control over how, when, and where your information gets out. Do you really need your real name, face,…

Using a weird nickname for professional things seems strange to me. I would rather use my name.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#89

Post by marginalia_nu »

jaclaz wrote: post #3
0___0 wrote: post #2

https://old.reddit.com/r/reddit/comments/10y427y/we_had_a_se...

>On late (PST) February 5, 2023, we became aware of a sophisticated phishing campaign that targeted Reddit employees. As in most phishing campaigns, the attacker sent out plausible-sounding prompts pointing employees to a website that cloned the behavior of our intranet gateway, in an attempt to steal credentials and second-factor tokens. It doesn't seem to me that much sophisticated, rather "normal", unless they are…

The sophisticated aspect of these types of attacks typically isn't in the technical aspects, but the social engineering involved.

It usually involves meticulous research on the target, what and who they work with, and have crafted an email that plausibly looks and sounds like an internal email, that talks about company stuff in company language, mentions coworkers and so on.

Add a note of urgency, make it someone who has discovered something isn't right, there's an urgent technical issue or the company or money is missing from the accounts or something, or perhaps it was dressed up as a memo announcing layoffs at reddit. If it's an urgent "threat" you tend to tunnel vision quite hard.

The result is very far removed from how your typical spam emails tend to look.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#90

Post by causi »

jefftk wrote: post #49
devnullbrain wrote: post #24

>While Reddit also suggests that updating passwords every couple of months is a good idea, as well as using a password manager, that's not advice most security professionals would currently condone. Changing passwords regularly, that is, not password manager usage. What inelegant phrasing. Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for yo…

> treat online accounts as throwaway wherever possible I don't need to know who you actually are, but over time interacting with other people here I've started to get a feel for several hundred accounts. This makes HN more pleasant because I have some sense of what sort of person they are to talk with, and what is likely to go well or poorly. When there have been subreddits I was really into, I would start to get a s…

Interesting. Here I am thinking one of the best things about HN is how the usernames being a lighter shade makes them easy to ignore entirely and focus only on what's being said instead of the speaker.
Post reply on HN