Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

Post by s3p » Fri, Feb 10, 2023, 3:17 PM UTC

TEP_Kim_Il_Sung wrote: post #135

willis936 wrote: post #56

Earlier quoted context omitted.

We're in a crisis of trust. "You have nothing to lose" is wrong. You and the community both have something to lose if identity is not valued. A throwaway is indistinct from a bot paid for by some rich mustache-twirling billionaire or state actor trying to control narrative.

The internet was always about judging the content and quality of user's posts/comments, while being unaware of their race, sex, origin, religion, and any other traits they didn't explicitly mention. Nowhere else can you have in-depth technical discussions about the implications of Humean Projectivism on p2p network architecture, with a cybernetic dragonfly, a flying squirrel, and with distracting interjections by a l…

Post by _aavaa_ » Fri, Feb 10, 2023, 3:18 PM UTC

from wrote: post #180

_aavaa_ wrote: post #150

Earlier quoted context omitted.

There are legitimate reasons for requiring an email, e.g. increasing the difficult of making bots and for banned people to make a new account.

Phone verification raises account creation costs to at least 20-30 cents an account (assuming you ban VOIP and only take first world countries, can be lower otherwise), email verification if you still allow yandex rambler outlook hotmail addresses raises it to a cent at max.

Post by pohl » Fri, Feb 10, 2023, 3:20 PM UTC

layer8 wrote: post #157

darkerside wrote: post #110

Earlier quoted context omitted.

That's what makes it so awesome when you start recognizing the same username on comments where you subconsciously bother to check the name because it was so interesting

> check the name because [the comment] was so interesting I wonder how many people have that reflex. I usually only notice usernames when mentioned by others.

Post by layer8 » Fri, Feb 10, 2023, 3:23 PM UTC

lghh wrote: post #151

dfxm12 wrote: post #148

You used to be able to create a reddit account without an email address. If all they can get is a username and password, by and large, who cares? Just create another account and you're on your way. It's way less likely hackers will figure out your creds on other sites if they don't have an email address to act as a key. Why require email for dumb social media sites? You can talk about password recovery, but emails ar…

Reddit doesn't require an email. They use dark patterns to make it look like you do, but anywhere it asks for an email in signup can be left blank.

Post by PuppyTailWags » Fri, Feb 10, 2023, 3:28 PM UTC

remus wrote: post #111

pgrote wrote: post #93

Earlier quoted context omitted.

>Ah the classic PR blur. Could mean anything from "all good" to "we don't log - ignorance is bliss". After what lastpass did I cannot trust any self reporting.

I think this is overly pessimistic. While there's definitely shady companies out there who will say this while having very poor security practices, it's tricky demonstrating that something didn't happen. Say you had detailed audit logs for example. What happens if there's a subtle bug in those systems that allowed the hacker to proceed without logs being recorded?