Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

forbes.com

Post reply on HN
Print view View original

151–160 of 301 posts

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#151

Post by lghh »

dfxm12 wrote: post #148

You used to be able to create a reddit account without an email address. If all they can get is a username and password, by and large, who cares? Just create another account and you're on your way. It's way less likely hackers will figure out your creds on other sites if they don't have an email address to act as a key. Why require email for dumb social media sites? You can talk about password recovery, but emails ar…

Reddit doesn't require an email. They use dark patterns to make it look like you do, but anywhere it asks for an email in signup can be left blank.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#153

Post by malfist »

sillysaurusx wrote: post #132
piva00 wrote: post #116

Earlier quoted context omitted.

Yup, I don't trust spez, I don't trust reddit's management (even less after the Chinese investments). This is a case to be cynical, reddit is not transparent and their leadership has been riddled with stupid politics, including the whole weird saga they did with Ellen Pao.

Ehh. Spez being human makes me inclined to trust him a little more. I’m neutral in politics, but editing those comments was objectively funny. Stupid, yes — astonishingly so. But it finally broke the illusion that users own their comments. That’s all it ever was: an illusion. I don’t trust authority in general. But given the choice between spez and musk, I’d take spez any day. He’s at least not hopped up on drugs run…

> Spez being human makes me inclined to trust him a little more

You realize what you're saying right? You're saying someone's actions that breach trust makes you trust them more?

Actions speak louder than words, if someone is showing you that you can't trust them, you don't decide that you're going to trust them more!

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#154

Post by philjohn »

mikewarot wrote: post #66

I'm not giving reddit my phone number, I get enough junk calls as it is. Edit: Reads comment by Maxburn, googles TOTP and Authy Why the heck do I need a 3rd party involved? Ugh

You don't.

Have a look at Yubikey's - there, the seed is stored on the key itself, the calculation done on the key itself, and all the app does is read it all via NFC.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#155

Post by sva_ »

lghh wrote: post #151
dfxm12 wrote: post #148

You used to be able to create a reddit account without an email address. If all they can get is a username and password, by and large, who cares? Just create another account and you're on your way. It's way less likely hackers will figure out your creds on other sites if they don't have an email address to act as a key. Why require email for dumb social media sites? You can talk about password recovery, but emails ar…

Reddit doesn't require an email. They use dark patterns to make it look like you do, but anywhere it asks for an email in signup can be left blank.

I think the mods can see if your account has a verified email attached to it though? At least it seems like subs can choose to not let unverified accounts post.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#156

Post by Maxburn »

corobo wrote: post #96
mikewarot wrote: post #66

I'm not giving reddit my phone number, I get enough junk calls as it is. Edit: Reads comment by Maxburn, googles TOTP and Authy Why the heck do I need a 3rd party involved? Ugh

You're welcome to calculate the code yourself by hand! Those apps keep track of it for you, you can use any 2FA app that supports TOTP. You could even make your own if you want. https://en.wikipedia.org/wiki/Time-based_one-time_password

This was my first thought after OP edit, lol, good luck doing this all yourself under the time limit. OP needs to educate themselves on 2FA methods.

Google authenticator exists, but I'm trying to get google out of my life. I think Bitwarden has one. I'm only using Authy because it was among the first to offer a backup/restore solution that I stumbled on.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#157

Post by layer8 »

darkerside wrote: post #110
causi wrote: post #90

Earlier quoted context omitted.

Interesting. Here I am thinking one of the best things about HN is how the usernames being a lighter shade makes them easy to ignore entirely and focus only on what's being said instead of the speaker.

That's what makes it so awesome when you start recognizing the same username on comments where you subconsciously bother to check the name because it was so interesting

> check the name because [the comment] was so interesting

I wonder how many people have that reflex. I usually only notice usernames when mentioned by others.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#158

Post by Maxburn »

philjohn wrote: post #154
mikewarot wrote: post #66

I'm not giving reddit my phone number, I get enough junk calls as it is. Edit: Reads comment by Maxburn, googles TOTP and Authy Why the heck do I need a 3rd party involved? Ugh

You don't. Have a look at Yubikey's - there, the seed is stored on the key itself, the calculation done on the key itself, and all the app does is read it all via NFC.

I just spent a minute and I'm having trouble wrapping my head around TOTP challenges with yubikey. Like scanning the QR to get the key in it, how do you query it to answer the challenge etc. Must be an app involved?

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#159

Post by grapesurgeon »

devnullbrain wrote: post #24

>While Reddit also suggests that updating passwords every couple of months is a good idea, as well as using a password manager, that's not advice most security professionals would currently condone. Changing passwords regularly, that is, not password manager usage. What inelegant phrasing. Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for yo…

[dead]

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#160

Post by adolph »

devnullbrain wrote: post #24

>While Reddit also suggests that updating passwords every couple of months is a good idea, as well as using a password manager, that's not advice most security professionals would currently condone. Changing passwords regularly, that is, not password manager usage. What inelegant phrasing. Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for yo…

many ephemeral identities, treated like cattle
Post reply on HN