Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

forbes.com

Post reply on HN
Print view View original

271–280 of 301 posts

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#271

Post by game_the0ry »

devnullbrain wrote: post #24

>While Reddit also suggests that updating passwords every couple of months is a good idea, as well as using a password manager, that's not advice most security professionals would currently condone. Changing passwords regularly, that is, not password manager usage. What inelegant phrasing. Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for yo…

Personally, I start by not trusting platforms - pw manager and 2fa all the way, never re-using passwords. I also use bitwarded - open source ftw.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#272

Post by ridgered4 »

_aavaa_ wrote: post #183
from wrote: post #180

Earlier quoted context omitted.

Phone verification raises account creation costs to at least 20-30 cents an account (assuming you ban VOIP and only take first world countries, can be lower otherwise), email verification if you still allow yandex rambler outlook hotmail addresses raises it to a cent at max.

Take my parent's complaint and replace email with phone and the complaint gets worse since the privacy concerns are even greater.

Most email services now demand SMS verification to sign up for them now as well.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#273

Post by pavel_lishin »

TEP_Kim_Il_Sung wrote: post #135
willis936 wrote: post #56

Earlier quoted context omitted.

We're in a crisis of trust. "You have nothing to lose" is wrong. You and the community both have something to lose if identity is not valued. A throwaway is indistinct from a bot paid for by some rich mustache-twirling billionaire or state actor trying to control narrative.

The internet was always about judging the content and quality of user's posts/comments, while being unaware of their race, sex, origin, religion, and any other traits they didn't explicitly mention. Nowhere else can you have in-depth technical discussions about the implications of Humean Projectivism on p2p network architecture, with a cybernetic dragonfly, a flying squirrel, and with distracting interjections by a l…

A discussion, maybe. But you can't have a conversation if you're not even sure that your conversational partner is the same person you replied to.

I know that there's a difference between spinning up a new account every few months, and for every reply. But long-term relationships in communities matter.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#274

Post by Am4TIfIsER0ppos »

bamboozled wrote: post #6

So many hacks lately, it's hard to believe that it's a coincidence ?

Definitely a coincidence and not a conspiracy of spooks working for the NSA (and similar) breaching servers in order to con you into getting a government spying device (cell phone).

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#275

Post by pavel_lishin »

dfxm12 wrote: post #148

You used to be able to create a reddit account without an email address. If all they can get is a username and password, by and large, who cares? Just create another account and you're on your way. It's way less likely hackers will figure out your creds on other sites if they don't have an email address to act as a key. Why require email for dumb social media sites? You can talk about password recovery, but emails ar…

> If all they can get is a username and password, by and large, who cares? Just create another account and you're on your way.

Who cares? Those of us who treat subreddits as communities, and as such have built relationships there.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#276

Post by pavel_lishin »

skybrian wrote: post #240
dfxm12 wrote: post #148

You used to be able to create a reddit account without an email address. If all they can get is a username and password, by and large, who cares? Just create another account and you're on your way. It's way less likely hackers will figure out your creds on other sites if they don't have an email address to act as a key. Why require email for dumb social media sites? You can talk about password recovery, but emails ar…

My Reddit account got hacked a few years ago because I created a Reddit account using a throwaway password, since I didn't care much about Reddit when I started. The hacker started using it to promote crypto. I was able to get the old account disabled, but couldn't get it back because I couldn't prove I'd ever owned it. So I created a new account, and it wasn't a big deal, but I was annoyed that I lost my preferred u…

> Don't get the privacy concerns. I'm totally fine if people know what I post on Reddit.

Good for you. But for others, pseudonimity is a way of protecting themselves in real life. There are people who cannot express their views on certain subjects without inviting scrutiny, or even danger, in their real lives.

> It's public.

There are private subreddits.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#277

Post by sizzle »

skybrian wrote: post #240
dfxm12 wrote: post #148

You used to be able to create a reddit account without an email address. If all they can get is a username and password, by and large, who cares? Just create another account and you're on your way. It's way less likely hackers will figure out your creds on other sites if they don't have an email address to act as a key. Why require email for dumb social media sites? You can talk about password recovery, but emails ar…

My Reddit account got hacked a few years ago because I created a Reddit account using a throwaway password, since I didn't care much about Reddit when I started. The hacker started using it to promote crypto. I was able to get the old account disabled, but couldn't get it back because I couldn't prove I'd ever owned it. So I created a new account, and it wasn't a big deal, but I was annoyed that I lost my preferred u…

I’m not following, how did a throwaway password get you hacked? Did they use a common password leak list to guess via bruteforcing? Does Reddit not rate limit login attempts?

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#278

Post by causi »

rondini wrote: post #267
causi wrote: post #90

Earlier quoted context omitted.

Interesting. Here I am thinking one of the best things about HN is how the usernames being a lighter shade makes them easy to ignore entirely and focus only on what's being said instead of the speaker.

HN is an accessibility nightmare thanks to the low contrast of so many critical UI elements

You can fix that with an extension: https://chrome.google.com/webstore/detail/high-contrast/djcf...

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#279

Post by Sakos »

layer8 wrote: post #235
Sakos wrote: post #231

Earlier quoted context omitted.

It only works on the desktop site. Did you try on mobile?

It works when manually going to https://www.reddit.com/account/register/ (both on mobile and desktop), but it doesn’t work when following the Log In / Sign Up links from the Reddit page, which have additional URL parameters attached. Maybe this is also an A/B testing situation, as the additional parameters have “experimental” in their name.

I might be thinking of old.reddit.com. I know that the mobile version requires an email there but the desktop version asks for it, but if you click continue, it doesn't check if you've entered one.

That experimental part is interesting.

Re: Reddit Confirms It Was Hacked–Recommends Users Set Up 2FA

#280

Post by darkerside »

layer8 wrote: post #157
darkerside wrote: post #110

Earlier quoted context omitted.

That's what makes it so awesome when you start recognizing the same username on comments where you subconsciously bother to check the name because it was so interesting

> check the name because [the comment] was so interesting I wonder how many people have that reflex. I usually only notice usernames when mentioned by others.

When you've been on the site 10 years, I guess you start to notice more patterns. You'll get there, young buck. ;)
Post reply on HN