[HN Gopher] Reddit Confirms It Was Hacked-Recommends Users Set U...
___________________________________________________________________
Reddit Confirms It Was Hacked-Recommends Users Set Up 2FA
Author : choult
Score : 284 points
Date : 2023-02-10 09:16 UTC (13 hours ago)
(HTM) web link (www.forbes.com)
(TXT) w3m dump (www.forbes.com)
| greesil wrote:
| So did they store their passwords in plain text? No? Did they
| salt their hashes?
| lakomen wrote:
| Google should drop Reddit indexing, since it full is
| disinformation and agenda
| bawolff wrote:
| The setup 2FA advice is kind of weird. I mean its fine in
| general, but it was an employee who was breached not a user, and
| there is no indication that the attackers got account data.
| [deleted]
| wongarsu wrote:
| And apparently the phishing attack phished both password and
| 2FA for getting into the intranet. So whatever 2FA they used
| internally didn't help.
| ridgered4 wrote:
| Yeah, but every crisis is an opportunity and this is an
| opportunity to scare people into coughing up PII that
| advertisers love so much.
| layer8 wrote:
| TOTP doesn't expose PII.
| ridgered4 wrote:
| True, but the email required to enable it (arguably) is.
|
| Reddit is far from the worst offender in this area. I
| should have specified my opinion as a more general one.
| bawolff wrote:
| Most sites don't let you register at all without an
| email.
| app4soft wrote:
| > _TL:DR Based on our investigation so far, Reddit user passwords
| and accounts are safe_ [0]
|
| [0]
| https://old.reddit.com/r/reddit/comments/10y427y/we_had_a_se...
| anigbrowl wrote:
| (off topic) Davey Winder is a blast from the past, I used to hang
| out with him 30 years ago. Nice to see he's still surfing the
| tech wave.
| indymike wrote:
| It would be nice if Reddit had an easy to find way to turn on
| 2FA.
| 0___0 wrote:
| https://old.reddit.com/r/reddit/comments/10y427y/we_had_a_se...
| welder wrote:
| This is the original source, and way more informative than the
| Forbes article. Please change the post to link here.
| jaclaz wrote:
| >On late (PST) February 5, 2023, we became aware of a
| sophisticated phishing campaign that targeted Reddit employees.
| As in most phishing campaigns, the attacker sent out plausible-
| sounding prompts pointing employees to a website that cloned
| the behavior of our intranet gateway, in an attempt to steal
| credentials and second-factor tokens.
|
| It doesn't seem to me that much sophisticated, rather "normal",
| unless they are omitting some relevant details, it sounds a lot
| like "Action needed urgently, click here to login to ...".
| coffeeblack wrote:
| If any e-mail contains a link to a login webpage, I treat it
| as a Phishing attempt. Only ever log in on the page you have
| bookmarked.
| marginalia_nu wrote:
| That's easier in your private life than in business. A lot
| of common tools (especially jira, confluence, etc.) have
| the flimsiest sessions along with just atrocious
| navigation.
|
| Means almost every other time you're sent a link, you have
| to log in yet again. And man are you sent jira tickets
| often in tech.
| coffeeblack wrote:
| I'm always logged into Jira and Confluence. And if not,
| the browser has the password stored, so an unknown host
| would be obvious.
| marginalia_nu wrote:
| The sophisticated aspect of these types of attacks typically
| isn't in the technical aspects, but the social engineering
| involved.
|
| It usually involves meticulous research on the target, what
| and who they work with, and have crafted an email that
| plausibly looks and sounds like an internal email, that talks
| about company stuff in company language, mentions coworkers
| and so on.
|
| Add a note of urgency, make it someone who has discovered
| something isn't right, there's an urgent technical issue or
| the company or money is missing from the accounts or
| something, or perhaps it was dressed up as a memo announcing
| layoffs at reddit. If it's an urgent "threat" you tend to
| tunnel vision quite hard.
|
| The result is very far removed from how your typical spam
| emails tend to look.
| sillysaurusx wrote:
| Yep. We had a charming English fellow at NCC Group in
| charge of doing this for a living. He had it down to a
| science. Everything from the phrasing to the phishing.
| dkarl wrote:
| Cloning an _intranet_ site is also a nice wrinkle that
| probably trips up a lot of less-tech-savvy employees who
| are trained to recognize phishing attempts that use
| replicas of Amazon, Google, Facebook, and other big well-
| known public web sites, which they mentally categorize as a
| different thing from their company 's internal tools.
| pixl97 wrote:
| It doesn't help companies have so many internal tools. It
| seems like once a month I'm asking my team if the invite
| to X service is something we're doing or a phish.
| xeromal wrote:
| This is what interested me. How do you clone an intranet
| site without gaining access to it?
| dghughes wrote:
| The "sophisticated" term maybe (100% for sure) was meant to
| save face. As in reddit staff should have known better and
| were supposed to be IT, social media, Internet culture
| experts. But fell for it anyway.
| PM_me_your_math wrote:
| "Sophisticated"
|
| The employee's password was probably passw0rd, and that's
| being generous for reddit.
| jwestbury wrote:
| Every company describes successful breaches as
| "sophisticated," because if it wasn't sophisticated then it's
| their own failure.
| asddubs wrote:
| was it the north korean government using military level
| hacking technology? yes. i mean, we don't know. but
| probably.
| ilyt wrote:
| "Military level" is another means-nothing term.
|
| Could be anything from average phishing or some 0-day
| that happened to be found by gov employee or phishing
| email, to "a bunch of men kidnapped target and beat them
| till they gave them access
| PenguinCoder wrote:
| And for this case, highly highly doubt a threat actor
| would burn a zero day for a Reddit phish.
| likis wrote:
| If they have a clone of an intranet gateway, I would have to
| agree that the phishing attempt is a bit more advanced, so
| calling it sophisticated is not too far fetched.
| lynx23 wrote:
| "One of our employees was tricked. The attack must have been
| sophisticated, because we are a cool gang."
|
| Basically applies to every team there is.
| pixl97 wrote:
| I'd say it depends on how much homework was done by an
| attacker. The company I work for was adding some new
| services. One of the service setup emails came in and was
| off just enough that I reported it rather than following
| it, and yes, it was an internal phishing test, but one I
| found very valuable because the service providers could be
| hacked, and the URLs that are used are generally terrible
| if you're trying to figure out where you're going.
| bawolff wrote:
| Its sophisticated in the sense it sounds targeted. They had
| to do research, setup a clone of an internal site, etc.
| That's on the high end of sophistication for phishing, which
| in general is usually not the most sophisticated of attacks.
| jaclaz wrote:
| Yep, but targeted doesn't have the same meaning as
| sophisticated, maybe the sophistication relates to
| obtaining a list of reddit employees, in that sense the
| sophistication is before and besides the phishing in
| itself.
| [deleted]
| paulschreiber wrote:
| Not requiring security keys for staff in 2023 is inexcusable.
| mikewarot wrote:
| I'm not giving reddit my phone number, I get enough junk calls as
| it is.
|
| Edit: Reads comment by Maxburn, googles TOTP and Authy
|
| Why the heck do I need a 3rd party involved? Ugh
| Maxburn wrote:
| It's actually TOTP so I stuck that in Authy.
| philjohn wrote:
| You don't.
|
| Have a look at Yubikey's - there, the seed is stored on the key
| itself, the calculation done on the key itself, and all the app
| does is read it all via NFC.
| Maxburn wrote:
| I just spent a minute and I'm having trouble wrapping my head
| around TOTP challenges with yubikey. Like scanning the QR to
| get the key in it, how do you query it to answer the
| challenge etc. Must be an app involved?
| [deleted]
| dicknuckle wrote:
| No 3rd party is involved. You're localizing the 2nd factor of
| authentication. Google could burn down tomorrow andb cease to
| exist, you could still use authenticator. It's a cryptographic
| verification scheme, not a service.
|
| RSA was a big one that was similar. Not sure if it's still used
| today but there was a little hardware fob that wasn't connected
| to the internet or anything, the whole thing works on Time. The
| only thing that fob needed was a constant battery power, if it
| died you'd have to replace the battery and call the helpdesk to
| get it resynced with your account. The only thing your phone
| needs is a good time source like GPS or network time. I believe
| authenticator app works even if your phone doesn't have
| service. You could be on a landline in a remote region with no
| Internet, talking to your significant other on the other side
| of the world, have them log in to your account and give them
| the code displayed by the authenticator app and they could send
| that important email you forgot.
| andylynch wrote:
| RSA SecurId - big problem with that was RSA had the tokens'
| seeds, as well as their customers. Recalling all their
| customers' tokens after getting hacked back in 2011 must have
| been expensive.
| dicknuckle wrote:
| Big oooof, wasn't aware of that. I believe TOTP works much
| differently based on my CLI interaction with it, but an
| expert would need to confirm.
| corobo wrote:
| You're welcome to calculate the code yourself by hand!
|
| Those apps keep track of it for you, you can use any 2FA app
| that supports TOTP. You could even make your own if you want.
|
| https://en.wikipedia.org/wiki/Time-based_one-time_password
| Maxburn wrote:
| This was my first thought after OP edit, lol, good luck doing
| this all yourself under the time limit. OP needs to educate
| themselves on 2FA methods.
|
| Google authenticator exists, but I'm trying to get google out
| of my life. I think Bitwarden has one. I'm only using Authy
| because it was among the first to offer a backup/restore
| solution that I stumbled on.
| say_it_as_it_is wrote:
| The hacker stole the source code and shortly thereafter died of
| radiation poisoning
| webdoodle wrote:
| I'd love to see the source code and compare it to the open
| source code, before they went closed source. I bet there are
| some real fun things in there, from an attack surface
| standpoint.
| [deleted]
| spokeonawheel wrote:
| No.
| TEP_Kim_Il_Sung wrote:
| Just what I need: Another big social media platform connecting
| one of my many anonymous pseudonyms to my phone number!
| timmywil wrote:
| Could use an app for 2fa tho right?
| cristoperb wrote:
| I just set up 2FA on my reddit account and at least it uses
| totp rather than sms.
| leereeves wrote:
| It's a ridiculous request. In short:
|
| "We've been hacked, so you should give us your phone number."
|
| Hilarious!
| jhgg wrote:
| And this is why we should all adopt webuathn, and get rid of totp
| based 2fa.
|
| This attack vector is significantly harder to pull off if a
| hardware authenticator will assert that the user is logging into
| the correct domain.
| daneel_w wrote:
| Are you really suggesting that a billion netizens should stop
| using TOTP on their smartphones and go buy another hardware
| device?
| 0xCMP wrote:
| Both latest versions of Android and iOS support passkeys plus
| support on Chrome/Brave/Edge/Safari.
|
| While not as secure or convenient as a security key for
| initially logging in there is no need for a new device in
| many cases.
|
| besides the fact that the webauthn yubikey is $20 vs $50-70
| for it's more popular and well known versions.
| Avamander wrote:
| Ideally yes, but let's not let the perfect become the enemy of
| good. If that's what available right now, it should still be
| used and recommended.
| rightbyte wrote:
| In practice in many services 2FA is about hoarding PI to
| target ads, not improve security. I don't buy into that.
| layer8 wrote:
| TOTP doesn't expose PII.
| rightbyte wrote:
| Don't you need to send the generator hardware dongle
| thingy (whatever it is called in English) to the user?
| ta1243 wrote:
| 10 years ago "use a strong password with all these symbols"
|
| Average person reluctantly moves from 123456 to P@55word!
|
| 8 years ago "no passwords such, use a pass phrase"
|
| Average person reluctantly moves from P@55word! to correct-
| horse-battery-staple
|
| 6 years ago "ok but you need to use different passwords on each
| site"
|
| Average person reluctantly moves to different passwords per
| site
|
| 4 years ago "but you can be phished, you have to use 2FA"
|
| Average person reluctantly moves to SMS
|
| 2 years ago "no in some countries it's easy to take over SMS,
| use TOTP"
|
| Average person reluctantly moves to TOTP
|
| Today "no TOTP is rubbish, you can be phished, use this
| hardware authenticator"
|
| Normal people don't like new shiny ways of working every year
| or so. My house's front door lock is broadly the same interface
| as my great-grandparent's front door lock, but technologists
| think changing the way things work every couple of years is
| acceptable.
| latexr wrote:
| > Average person reluctantly moves from (...)
|
| A reluctant move is still a move, and thus beneficial. But we
| definitely have different ideas of the "average person". I
| sincerely doubt the average has moved on from P@55word, and
| even then only because the website they're trying to register
| an account with imposes the rule. I'd be happy to be proven
| wrong; do we have data on it?
| wongarsu wrote:
| For applications where it really mattered, harware
| authenticators have long been established. Big companies use
| smart cards, and my bank has always offered the choice
| between the 2FA-du-jour (switching from pre-distributed TAN
| lists to SMS 2FA to various iterations of 2FA apps, currently
| push tan) or just getting a $20 reader for my existing bank
| card (which has a chip since forever in europe).
|
| The list you are describing could as well be seen as every
| service trying to implement the simplest and least disruptive
| technology, only to find out two years later that it was
| insufficient and switching to the next best thing, only for
| the cycle to repeat each time.
|
| Which of course from the users perspective doesn't make a
| difference, but it gives a different perspective on how to
| solve it for the future.
| kriops wrote:
| WebAuthn is an UX improvement as well as a security
| improvement. I sympathize with your point, but in this case
| it's easily sellable as the cure to the rest of your list ...
| unless you somehow lose your key.
| tengwar2 wrote:
| That is a "when" event rather than an "if" event.
| criley2 wrote:
| Not a UX improvement. Most users need a yubikey for the
| computer unless they have a new Mac. Asking my 65 year old
| dad to keep up with a yubikey is not just bad UX, it's
| failing UX. It simply will not happen.
|
| I don't even think it's realistic to get him to use a
| smartphone for this, he hates the things.
|
| WebAuthn works great for your Web 3.0 startup but as soon
| as you're talking about the average user, who is likely
| decades older than the commenters here, and far less
| interested in keeping up with these things, and far less
| patient with the hassles... asking them to carry hardware
| is a nonstarter for so many.
| aledalgrande wrote:
| It also is a way worse UX if you lose the authorized
| device and you're traveling.
| thatnerdyguy wrote:
| I thought Windows machines just used the TPM to store
| WebAuthN keys? No yubikey necessary. Just a click on some
| popup dialog to select your credential for login.
| criley2 wrote:
| Windows has a service called "Windows Hello" which can
| work with WebAuthn (otherwise it's hardware keys). It
| requires your computer to have various biometric or
| camera technology built in, such as a finger print
| scanner. I'm sure windows laptops are more equipped for
| this, but desktops obviously are not, and I'm certainly
| not advising folks to leave some insecure cheap imported
| webcam hooked up 24/7 "for security purposes".
|
| I don't know anyone using "Hello" but I suppose it's an
| option. Most Windows users would likely have to use a
| hardware key though.
| Bluecobra wrote:
| I would be weary of using this, I have been using Windows
| since Windows 95 and seen enough things go wrong that I
| wouldn't want to be locked out of my online accounts. For
| example one thing I noticed is that by simply updating my
| BIOS in Windows 11 causes havoc and everything gets
| signed out. A cross-platform hardware token sounds more
| appealing to me. I could see Hello being something to
| secure corporate laptops/accounts in an enterprise
| environment though.
| Arnavion wrote:
| >For example one thing I noticed is that by simply
| updating my BIOS in Windows 11 causes havoc and
| everything gets signed out.
|
| That's surprising. As in, the fact that that happens is
| to be expected from the firmware's point of view -
| updating the firmware changes the measurements made to
| the TPM so any secrets can no longer be unlocked. But I
| would've expected Windows to update the expected
| measurements before applying the update to prevent that
| from happening.
| simonh wrote:
| The Egyptians has wooden door lock mechanisms. It took
| thousands of years to develop modern door locks. We went from
| lever tumbler locks in 1778 to the modern Yale lock in 1861
| (which fundamentally still operates on similar principles to
| the Egyptian wooden pin lock).
|
| I'm sure authentication technology will settle down in a
| decade or two.
| sh4rks wrote:
| Yet the time it takes to pick those locks hasn't changed
| for centuries
| the_duke wrote:
| You are talking about the average developer.
|
| Most regular users never moved beyond using 'P@55word!'
| everywhere.
| vkou wrote:
| > My house's front door lock is broadly the same interface as
| my great-grandparent's front door lock,
|
| It can also be defeated by any idiot with a bump key in about
| 10 seconds.
| sleepybrett wrote:
| > Normal people don't like new shiny ways of working every
| year or so. My house's front door lock is broadly the same
| interface as my great-grandparent's front door lock, but
| technologists think changing the way things work every couple
| of years is acceptable.
|
| Your front door doesn't have thousands of anonymous bots a
| day trying to brute force it.
| xnorswap wrote:
| I'm not sure what your point is, the recommendations improve
| and evolve over time.
| danaris wrote:
| More realistically:
|
| 8 years ago "no passwords, use a pass phrase"
|
| Average person reluctantly moves from "P@55word!" to
| "P@55word! P@55word! P@55word!"
|
| 6 years ago "different passwords on each set"
|
| Average person shrugs and changes nothing
|
| 2 years ago "use TOTP 2FA"
|
| Average person already using SMS changes nothing, and the
| sites allow this as a grandfathered exception effectively
| indefinitely
| flangola7 wrote:
| That's fine, but don't be a hypocrite who comes complaining
| when they get hacked. It's your personal responsibility to
| maintain your own security.
| bawolff wrote:
| This isn't really the way that advice played out:
|
| Nobody should ever suggest you use TOTP or SMS 2fa to prevent
| phishing.
|
| > 6 years ago "ok but you need to use different passwords on
| each site"
|
| Really the only one that matters in practise. TOTP is
| basically just a work around to get users to actually do
| this.
|
| Edit: i would also add this is a corporate environment where
| its reasonable to be more picky. And webauth really is the
| best (only?) Solution to phishing.
| Tepix wrote:
| Well, if you use a compromised device temporarily and your
| password gets stolen and you have 2FA, it will sort of be
| ok once you stop using that device.
| bawolff wrote:
| Depends how long your session cookie lasts for the site.
| Some high security sites are paranoid, but most of the
| time they last for like a year.
|
| It also depends on how sophisticated the attacker is. Do
| they fake log you out so they could capture a second 2fa
| token in order to change the totp token to a new device
| and change your email?
|
| And of course, for the most part damage can usually be
| done in minutes - copying confidential files does not
| need long term access.
| Gigachad wrote:
| The difference is that your door is exposed to the
| neighbourhood while computers are exposed to the whole
| planet. Notice how your plain old number password is still
| sufficient for unlocking your phone.
| hulitu wrote:
| And what those "security" people do not understand: the user
| will choose the path of least resistance, making all those
| measures, useles.
| toxicFork wrote:
| Yeah, security is a cat and mouse game. You need to keep
| adapting.
| sushibowl wrote:
| > My house's front door lock is broadly the same interface as
| my great-grandparent's front door lock
|
| True, but your house's front door lock is very likely to
| offer quite poor security. Most house locks are vulnerable to
| bumping attacks that are almost trivial to pull off. The only
| reason this is acceptable is the threat model you're dealing
| with when securing a physical house is very different from
| securing an internet-connected computer.
|
| Moreover, while the threats against your front door have
| remained marginally the same as those against your great-
| grandparent's door, computers and the network they are
| operating in change extremely frequently. All the security
| recommendations you're naming were quite reasonable for their
| time but rapidly became outdated.
| mjevans wrote:
| If someone _really_ wants in, the windows are an even
| weaker point. Obvious at a glance breakage probably not
| even necessary... (those latches seem awfully flimsy).
| Izkata wrote:
| Would a keychain window breaker (sold as an emergency
| escape for a car) work on home windows? Or is the glass
| handled differently somehow?
| corobo wrote:
| At a certain point the walls will be the weak point to a
| dedicated attacker. Time to dig a moat to scare off the
| backhoes!
|
| Something I found out recently is that my lockable desk
| drawer can be thwarted by giving it a sharp shove to the
| right while pulling the drawer. It juuust about pops the
| metal locking rod out of the mechanism for a moment, if
| you're pulling on the drawer it'll just open.. Found it
| out when I misplaced the key, haha.
| pwython wrote:
| A similar argument I have with my wife: She insists on
| only living in gated communities. I'm like, "it's just a
| PVC pipe that goes up and down, it's not fort knox." But
| for some reason that gives her peace of mind, and worth
| the HOA fee of $350/mo.
| tigeroil wrote:
| Funnily enough where I live those gated communities have
| actually ended up being specifically targeted, because
| funnily enough people assume that if you can afford to
| live there you probably have stuff worth taking.
| wing-_-nuts wrote:
| My God. My condo complex is responsible for all external
| maintenance. It has steel gates that would stop an f150.
| They handle water, gas and trash pickup and it only costs
| $230/mo. It's in a fairly pricey area. I feel like you're
| getting robbed.
| xeromal wrote:
| My HOA is 250 a year. haha
| InitialLastName wrote:
| > I feel like you're getting robbed.
|
| They very explicitly said they're paying enormous amounts
| of money to _avoid_ being robbed (I 'm not missing the
| irony here).
| orra wrote:
| Also, people should definitely upgrade their front door
| locks! A three star euro cylinder will snap, instead of
| letting the intruder in.
|
| While surely nothing offers complete security, it massively
| increases the effort required to break in (from essentially
| zero).
| njarboe wrote:
| Well constructed deadbolt on inside only. Much more
| concerned with a break in when I'm home than when I'm
| away and this will help dramatically.
| sleepybrett wrote:
| Very few break-ins are accomplished via defeating a lock
| with something in the vein of a pick (bumping, pick gun,
| etc). Most break in are accomplished via a broken
| window/glass door.
| sysihyk wrote:
| [dead]
| stavros wrote:
| Ten years ago, everyone got hacked all the time. Today,
| basically the only way to get you hacked is to hack the
| actual site you're using. I'd say that's progress.
| jefftk wrote:
| And if you _are_ stuck using TOTP, you can mitigate with a
| password manager that fills it for you only when the domain
| matches.
| cheschire wrote:
| You know, I used to think the same thing. But then lastpass
| got hacked and it made me realize password managers have a
| lot of eggs in those baskets. It might be worth using two
| separate password managers and keep TOTP in the second one.
| xaduha wrote:
| > And this is why we should all adopt webuathn, and get rid of
| totp based 2fa.
|
| I'd be glad to personally, but if a site supports 2fa at all,
| then it's mostly likely TOTP. And some require TOTP first and
| allow webauth only in addition to it.
| rvz wrote:
| Hilarious to see that even companies like Reddit still do not
| take security seriously despite being around longer than most
| internet companies.
|
| If this was Meta, or Twitter that got breached via there would
| be outrage everywhere as to why employees did not use hardware
| keys.
| 7ewis wrote:
| Is this similar to how hardware wallets show the true addresses
| on their displays?
| Avamander wrote:
| It's very vaguely similar to TLS connections with mutual
| authentication, you can't normally MITM/proxy it.
| bawolff wrote:
| Webauth checks the http origin so it only gives the code to
| the correct website, taking the human out of the decision
| loop.
| spokeonawheel wrote:
| idk what the big deal is, my password is plenty secure, see? its
| hunter2
| rascul wrote:
| All I can see is *******
| paganel wrote:
| Why would I give reddit my email or, God forbid, my phone number?
| devnullbrain wrote:
| >While Reddit also suggests that updating passwords every couple
| of months is a good idea, as well as using a password manager,
| that's not advice most security professionals would currently
| condone. Changing passwords regularly, that is, not password
| manager usage.
|
| What inelegant phrasing.
|
| Another option is to treat online accounts as throwaway wherever
| possible. As much as Reddit would like to sell you gizmos for
| your profile, there's no benefit to the user to have an old
| account with lots of karma. Just keep re-rolling with strong
| random passwords and you have nothing to lose.
| grapesurgeon wrote:
| [dead]
| adolph wrote:
| many ephemeral identities, treated like cattle
| dghughes wrote:
| That's a good idea and I've thought about it but I think many
| feel attached to their usernames and account history "15 yeas
| with.." site X. And sites often balk and say "username or email
| already has an account here".
|
| It's a bit funny since alias was meant to hide who you were or
| at least make ire less formal than a person's full name. Then I
| go and use my name for an alias!
| yreg wrote:
| The "don't use your real name on the internet" advice wasn't
| great. When I set up a Google account as a kid I used a made
| up handle because all the adults told me to not use my name
| on the internet.
|
| Decades later and it's still my main account and I often need
| to either switch accounts to the one with my real name or
| embarassingly ask people to invite my nickname account to
| various shared documents, calendars, etc. No way to migrate
| my YouTube channel either...
| adolph wrote:
| In the time that has passed since that advice better name
| generators have been developed so you don't have to make
| something up.
|
| https://github.com/moby/moby/blob/master/pkg/namesgenerator
| /...
| Dalewyn wrote:
| What's embarrassing about a nickname?
|
| Having a disconnected online entity means less-than-
| pleasant jackasses can't pull something from years or even
| decades ago, put it out of context, and proceed to troll
| your life.
|
| Not putting your real life identity on public display for
| the world to see means you maintain tighter control over
| how, when, and where your information gets out. Do you
| really need your real name, face, place of employment,
| telephone number, email address (with your name in it), and
| maybe even your home address publicized? More than likely
| you don't.
|
| Having online identities disconnected from real life means
| you can use them to safeguard your actually really-fucking-
| important real life things. Your bank account? Use an email
| that uses a nickname instead of your real name so any would
| be hackers have to second guess your email too.
|
| Worst comes to shove and shit hits the fan, you can throw
| away an online identity and make another one. You can't
| throw away your real name and face.
|
| There are nothing but benefits by keeping your online and
| real life identities separate, and if you ask me it's one
| of the first steps to being truly internet literate.
| yreg wrote:
| Using a weird nickname for professional things seems
| strange to me. I would rather use my name.
| propogandist wrote:
| buy a domain name (~$9/yr) and get managed e-mail
| provider that supports wildcard emails (~$50/yr). Now you
| have unlimited email options.
| yreg wrote:
| I have that and do that, but it doesn't solve the Google
| Drive thing.
| propogandist wrote:
| You can create a new Google account tied to your domain
| and use that to collaborate with others. You can elect to
| stop using Gmail and your old nickname, unless I've
| missed something.
| hgsgm wrote:
| You can use a neutral nickname.
| pbhjpbhj wrote:
| I assume that Reddit keeps a list of IP addresses and
| advertising buyers can correlate them with data from
| other sources to associates accounts with real people.
|
| Presumably, a Reddit leak means even more opportunity to
| unmask (dox) users who have responded truthfully to
| threads that say things like "what's the worst thing you
| ever did". Lots of blackmail opportunities.
| propogandist wrote:
| It's worse than this. Reddit, several years ago,
| introduced outbound click tracking.
|
| All outbound clicks from the site are redirected via
| out.reddit.com which ties click activity to an individual
| (username / IP / device fingerprint based). This can only
| be blocked with aggressive old.reddit script blocking
| which breaks portions of the site.
|
| The outbound click data is used for profiling and
| interest based advertising, but the data can be much
| worse than simply linking comments to identity.
|
| They also tie IP/identity to individuals to serve
| relevant ads and this is the push to get people
| installing reddit on phones, where deviceIDs is an easy
| UUID for ads.
| webdoodle wrote:
| Did that finally go out to all subs, because for a while
| it was only on certain subs? I don't use Reddit anymore,
| after they suspended my account for promoting a peaceful
| protest of the Billionaire's Summer Camp, where the
| corporate media meets every year to consolidate the
| industry and plan the years narrative. This, after they
| allowed me to be harassed, threatened with sexual
| violence and doxxed. Good times!
| [deleted]
| unglaublich wrote:
| ponyomelette69@hotmail.com begs to differ.
| jefftk wrote:
| _> What inelegant phrasing._
|
| Reddit's own phrasing is much better:
|
| _Since we're talking about security and safety, this is a good
| time to remind you how to protect your Reddit account. The most
| important (and simple) measure you can take is to set up 2FA
| (two-factor authentication) which adds an extra layer of
| security when you access your Reddit account. Learn how to
| enable 2FA in Reddit Help. And if you want to take it a step
| further, it's always a good idea to update your password every
| couple of months - just make sure it's strong and unique for
| greater protection._
|
| _Also: use a password manager! Besides providing great
| complicated passwords, they provide an extra layer of security
| by warning you before you use your password on a phishing
| site... because the domains won't match!_
|
| --
| https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_se...
| zulban wrote:
| Nothing to lose..? Old and popular reddit accounts are worth
| more when sold for a reason. If I'm sharing an idea or business
| update, it's useful to show mods and algorithms that I'm a
| decade old user and not a bot created this month.
| oauea wrote:
| If you're a spammer then yeah, there's value to be had. But
| for moral people there really isn't any.
| andybak wrote:
| I'm mostly a "moral person" whatever that means and I
| disagree. My Reddit account has value to me for multiple
| reasons.
| yreg wrote:
| Just FYI while they suggest updating passwords they also claim
| that user accounts are safe at this time.
| kingcobraninja wrote:
| >there's no benefit to the user to have an old account with
| lots of karma
|
| Some subs have a minimum amount age or karma requirement to
| post. This is ostensibly to combat bots.
| hgsgm wrote:
| Those are very low thresholds.
| onionisafruit wrote:
| You are right, but it is still annoying when cycling
| accounts.
| pixl97 wrote:
| Yea, you have to precycle effectively and create accounts
| before hand and let them build at least a small amount of
| karma.
|
| These days I don't even log into reddit. After wide
| spread banning from subreddits for random reasons it's
| not worthwhile. I'll keep browsing old.red as long as it
| exists but if it goes away I'll DNS block all reddit at
| the router.
| cragfar wrote:
| That's how most treat it. Just go to any thread even 3 months
| old and 1/4th of the users are deleted.
| EVa5I7bHFq9mnYK wrote:
| >> to treat online accounts as throwaway wherever possible
|
| works for me everywhere except HN, because of the silly
| requirement of 500 karma to be able to downvote.
| netule wrote:
| If you use the old/classic Reddit experience and you can't find
| the option to enable 2FA in your profile, use this URL directly
| instead: https://www.reddit.com/2fa/enable/
| wycy wrote:
| > there's no benefit to the user to have an old account
|
| I used to think so until I decided to reroll my old account
| into a new one, and it was such a pain re-subscribing to all my
| subreddits again.
| flandish wrote:
| That seems like a solvable thing with a 3rd party app/script.
|
| I reroll every time I am banned from a sub I like because
| that sub notices I play in other subs - that whole "thing" is
| horseshit to me. So I just reroll to get around that autoban
| bot.
| wycy wrote:
| Do you happen to have a script for this? If so, I'd love to
| have it as it's about time I reroll too.
| flandish wrote:
| No, but I have thought about trying to make one. Hrm.
| codq wrote:
| See, I don't mind this process.
|
| It gives you a chance to re-evaluate what is actually giving
| you value. It's like spring cleaning.
|
| It's the same reason I enjoy setting up a new or freshly
| reformatted phone or laptop. Feels good to clean out the
| cobwebs.
| user764743 wrote:
| Just create a mutlireddit of your subscriptions by going on
| https://old.reddit.com/subreddits/ and clicking 'multireddit
| of your subscriptions' on the right. Bookmark that link and
| voila, you have a backup of your subreddits for your new
| account.
| jefftk wrote:
| _> treat online accounts as throwaway wherever possible_
|
| I don't need to know who you actually are, but over time
| interacting with other people here I've started to get a feel
| for several hundred accounts. This makes HN more pleasant
| because I have some sense of what sort of person they are to
| talk with, and what is likely to go well or poorly. When there
| have been subreddits I was really into, I would start to get a
| sense for the more prolific commenters there too.
|
| If I regularly attended some sort of social club and it was
| common for people to replace their faces I would find it
| frustrating as well.
| causi wrote:
| Interesting. Here I am thinking one of the best things about
| HN is how the usernames being a lighter shade makes them easy
| to ignore entirely and focus only on what's being said
| instead of the speaker.
| yamtaddle wrote:
| On the contrary, it makes it harder to immediate spot and
| ignore shitposters or people who consistently make really
| stupid posts on certain kinds of thread, of which sort
| there are several very active posters. It's a big part of
| why a _certain kind_ of trolly posting thrives on HN in a
| way that it doesn 't some other places with sigs or user
| images or otherwise more-prominent user ID.
|
| My kingdom for an ignore-list.
| darkerside wrote:
| That's what makes it so awesome when you start recognizing
| the same username on comments where you subconsciously
| bother to check the name because it was so interesting
| layer8 wrote:
| > check the name because [the comment] was so interesting
|
| I wonder how many people have that reflex. I usually only
| notice usernames when mentioned by others.
| pohl wrote:
| I would hope most people. I can't imagine being so
| incurious that I'd read an awesome comment and not wonder
| who wrote it.
| layer8 wrote:
| Why should it matter who wrote it?
| pohl wrote:
| I guess it wouldn't if one didn't value people. YMMV, but
| I think people are kind of cool -- so if I hear a great
| song I want to know who the artist was. It helps me build
| a mental model of what I might be able to expect from
| them. I'm kind of shocked that this might not be obvious
| to everyone, TBH.
| jefftk wrote:
| One big reason I care about who wrote things is
| expertise. Ex: I've consistently seen informed and
| sensible security-related commentary from tptacek, so I
| would pay more attention to security-related advice with
| his name on it than if it was a name I didn't recognize.
| moremetadata wrote:
| [flagged]
| darkerside wrote:
| When you've been on the site 10 years, I guess you start
| to notice more patterns. You'll get there, young buck. ;)
| rondini wrote:
| HN is an accessibility nightmare thanks to the low contrast
| of so many critical UI elements
| causi wrote:
| You can fix that with an extension:
| https://chrome.google.com/webstore/detail/high-
| contrast/djcf...
| devnullbrain wrote:
| If I attended a social club and my comments from 10 years ago
| were permanently engraved on the walls, I'd be much less
| honest and open.
| hgsgm wrote:
| You can use alts and delete old comments.
| devnullbrain wrote:
| There's no deleting beyond a time limit on HN
| tough wrote:
| you can request to the admins if you really need to
| jefftk wrote:
| Changing alts is a lot more pro-social than deleting your
| comments: with alt rotation your old writing is still
| available for others to learn from.
| andybak wrote:
| Yeah. Let's delete old blogs and shut down the internet
| archive as well.
|
| Personally I value the web as a knowledge store that
| persists.
|
| Use a non-logged chat service if you want a transient
| medium.
| grapesurgeon wrote:
| [dead]
| khmii wrote:
| [dead]
| webdoodle wrote:
| Of course Reddit lets is political allies doxx and harass
| Reddit's political enemies without reservation, so this will
| likely affect those accounts more so.
| game_the0ry wrote:
| Personally, I start by not trusting platforms - pw manager and
| 2fa all the way, never re-using passwords. I also use bitwarded
| - open source ftw.
| MildlySerious wrote:
| The last time I tried to change the password of a reddit
| account I lost access to it.
|
| I attempted to change the password, got an error saying
| something went wrong. I figured I'd try again later. so I also
| didn't save the newly generated password.
|
| Got logged out, and couldn't log back in with the old password.
|
| And there's no way that I know of to contact anyone at reddit
| to try and get help.
| djbusby wrote:
| Try the Forgot Password link?
| MildlySerious wrote:
| The email provider that account was tied to doesn't exist
| anymore, and the domain is taken. I didn't notice until
| after it happened, so I am not putting all the blame on
| reddit. It's more of a string of unlucky circumstances. Who
| knows if I could have even changed it without access to the
| email account, anyway.
|
| Fun fact: Reddit for the longest time didn't require an
| email address to create accounts.
| ridgered4 wrote:
| Reddit still doesn't require an email to create accounts,
| even if it now heavily implies it does. Just click next
| without entering one.
| willis936 wrote:
| We're in a crisis of trust. "You have nothing to lose" is
| wrong. You and the community both have something to lose if
| identity is not valued. A throwaway is indistinct from a bot
| paid for by some rich mustache-twirling billionaire or state
| actor trying to control narrative.
| LarryMullins wrote:
| Trusting an anonymous redditor because they have lots of
| "karma" is extremely foolish. For one, they probably got
| those internet points by reposting other people's cat
| pictures and now you're in a conversation with them about
| something that has nothing to do with the subject of stealing
| cat photos, so why should the internet points they earned
| doing that count for _anything_?
|
| Secondly, it's easy to farm up these internet points and sell
| the account to somebody else who's keen on exploiting the
| tendency of people like you to think that the internet points
| confer trustworthiness.
| aww_dang wrote:
| All of these trust systems and platforms are a centralized
| target for the behavior you describe. It makes it easier
| for those with bad intentions to rinse and repeat. Naive
| users may be left behind by those who have optimized their
| strategy.
| willis936 wrote:
| Strawman. I never said anything about karma. A user's
| entire post and comment history is one click away during a
| discussion. That can be skimmed to build a decent picture
| quickly. That too can be faked, but the bar is much higher.
| TEP_Kim_Il_Sung wrote:
| The internet was always about judging the content and quality
| of user's posts/comments, while being unaware of their race,
| sex, origin, religion, and any other traits they didn't
| explicitly mention.
|
| Nowhere else can you have in-depth technical discussions
| about the implications of Humean Projectivism on p2p network
| architecture, with a cybernetic dragonfly, a flying squirrel,
| and with distracting interjections by a literal fantasy
| troll. A bit of personal QA/QC, and individual filtering
| options, are all you need. Anything else is just censorious
| control of the narrative.
| unethical_ban wrote:
| That's great, in theory.
|
| When it comes to political discussions or any kind of
| politically biased graphic, particularly if it is something
| I disagree with, I assume it is astroturf/agitprop. When
| misinformation and propaganda are mainstream, why can I
| trust some random account on the internet for facts?
|
| Tech is certainly different.
| s3p wrote:
| Yes I agree. This just emphasizes OP's point about how we
| can't make these accounts throwaway as there would be no
| content to judge.
| Buttons840 wrote:
| You judge each comment by its own merits. Online forums
| like HN are a source of ideas, not necessarily correct
| ideas.
| pixl97 wrote:
| Eh in many ways that is not how humans work. We tend to
| build close in groups with higher trust level, because
| not trusting everything any anyone is physically and
| mentally exhausting. If you met a person that behaved in
| this manner in real life most people would conclude they
| had a mental illness or were an abuse victim.
| dfxm12 wrote:
| Interacting with accounts in a huge, pseudo-anonymous
| social media sites based on discussion with voting
| systems is quite different from interacting with people
| in real life. For big sites like HN and most subreddits,
| the users may as well be anonymous. HN goes a step
| further and deemphasizes usernames a bit by making them
| lighter in color and smaller compared to the black body
| text. How do you build a "close in group" on a site this
| big with not a lot of emphasis on who you are? I've been
| on smaller message boards where you can actually get to
| know people and have an avatar and some public info about
| yourself attached to every post. It's a different
| experience in that case, for sure.
|
| You wanna talk about how humans work - strangers in real
| life also don't just walk up to you and start talking
| about Reddit account security out of the blue! We also
| don't trust a talking head on TV or on the radio just
| because they're human. Relationships are built over time
| & higher trust has to be earned. Even if you're referring
| to the fact that most of us probably live in a relatively
| high trust society, that doesn't mean we trust our
| neighbors' opinions on strong passwords (or whatever)
| just because we trust them as our neighbor!
| willis936 wrote:
| It would be nice for everyone to achieve the platonic
| ideal of having a gapless empirical understanding of the
| world from root to stem. It is not possible for a single
| person to do that, let alone everyone. At some point it
| becomes necessary to trust if we are going to provide and
| consume information remotely.
|
| Ideas do not exist without context. Arguably the context
| is more essential than individual ideas. Judging ideas
| without context is not a useful exercise. It's easy to
| fall into a local minimum that's actually quite bad.
| Eugenics is a common example. Eliminating genetic disease
| sounds great as long as you don't have the context of
| genocide or humanism.
| pavel_lishin wrote:
| A discussion, maybe. But you can't have a conversation if
| you're not even sure that your conversational partner is
| the same person you replied to.
|
| I know that there's a difference between spinning up a new
| account every few months, and for every reply. But long-
| term relationships in communities matter.
| dkarl wrote:
| It's interesting; with many sites I'd agree with you, but on
| Reddit, I don't look at usernames much. I recognize a few
| usernames in most of the subreddits I visit, just from
| repeated exposure, but I don't value my own accounts or the
| karma they accumulate. I use different accounts for different
| subsets of subreddits the way I wear different clothes for
| different occasions. If I lost an account I'd sign up for a
| new one like buying a new outfit. I wonder why it's
| different.
| 43jyBySqu7818 wrote:
| [dead]
| rcme wrote:
| We are in a crisis of trust, but I'm not sure the solution
| involves stronger identities. I've used Reddit for well over
| a decade at this point. I _hate_ that my high school opinions
| are just out there permanently on the internet. It 's much
| more damaging to communities for people to feel like they
| can't participate for fear of leaving a permanent record. If
| you were at a party, would you feel comfortable knowing you
| were being recorded the entire time? I think the same thing
| applies to digital communities.
|
| We need some way of verifying that a real human is on the
| other end, but we don't necessarily need to know who that
| person is.
| throwA29B wrote:
| This. 2FA (implying a phone number which is most likely most
| important number in your life) for a link sharing web site? You
| _must_ be joking.
| chimeracoder wrote:
| > This. 2FA (implying a phone number which is most likely
| most important number in your life) for a link sharing web
| site? You must be joking.
|
| SMS is no longer recommended as a means of 2FA, as it's very
| vulnerable. Some sites still rely on it, unfortunately.
| However, it appears Reddit does support TOTP.
| throwA29B wrote:
| Somehow this reminds me of a wise saying: "Every problem in
| CS can be solved by adding level of indirection. Except for
| the problem of excessive number of indirections".
| crest wrote:
| They do, but TOTP is only as secure as the seed stored by
| reddit.
| unshavedyak wrote:
| > Another option is to treat online accounts as throwaway
| wherever possible. As much as Reddit would like to sell you
| gizmos for your profile, there's no benefit to the user to have
| an old account with lots of karma. Just keep re-rolling with
| strong random passwords and you have nothing to lose.
|
| I (used to, i guess) do the same. I must have 40 accounts in
| total over the years. Funny enough i didn't even make a strong
| password - a stupidly bad one, unique for each account,
| actually. I had almost hoped it was hacked because it would be
| interesting to be hacked and not care.
| Tepix wrote:
| These days it seems you should change your password (and your
| 2FA token) every now and then not because _you_ are the one
| getting hacked but the sites you sign up at.
| ttctciyf wrote:
| Even if I don't want to throw my reddit account away as such,
| it's hard for me to imagine ever thinking I'd care more about
| its security than I would about not giving Reddit my phone
| contact!
| Verdex wrote:
| Yeah, this was my first reaction.
|
| <Reddit hacked>
|
| "Huh, I guess I better change my password."
|
| <Recommends TFA>
|
| "Hmm, give reddit my phone number .... no."
| pwildani wrote:
| Reddit's TFA is not phone number based. You use a one time
| password generator.
| sjagoe wrote:
| No need for phone number, they just give you a TOTP private
| key you can use in Google Authenticator or something like
| that.
| webdoodle wrote:
| Yep. Looking forward to buying /u/maxwellhill off the dark
| web, so we can read all those private messages, and finally
| put to rest all the speculation of it being Ghislaine
| Maxwell's account (which went dark the day she was arrested).
| kahrl wrote:
| Reads like an 8th grader's report trying to meet the teacher's
| word count.
| dobbysfirstsock wrote:
| I've actually noticed how _bad_ the writing of some articles
| can be. I'm not a good writer by any means... but the best I
| can say is it sounds like an essay cranked out by someone in
| high school.
|
| Just reminded me of my first "wtf." A journalist for our
| local university wrote a review for the movie "Hustlers"
| where they justified sexually assaulting and robbing men in
| New York because "men in New York were responsible for the
| 2008 financial crisis." All without missing a beat. Can't
| believe what passes these days.
| sleepybrett wrote:
| When you find out how little these writers are paid you can
| understand the amount of effort they can put into these
| articles and still make enough money to eat.
| bamboozled wrote:
| So many hacks lately, it's hard to believe that it's a
| coincidence ?
| kristiandupont wrote:
| I don't know if you are implying that it's related to the war
| or something. Sadly, I am more of the belief that it's a trend.
| I think we will see much more of it.
| bamboozled wrote:
| It might be related to layoffs too? Maybe you're implying
| something :)
| lynx23 wrote:
| "to the war", I smeel a singularity. Can you be more
| specific, to which war exactly are you refering to?
|
| https://en.wikipedia.org/wiki/List_of_ongoing_armed_conflict.
| ..
| Miraste wrote:
| I suppose you're trying to make a point about the relative
| attention devoted to Ukraine vs other conflicts, but in
| this case there really is only one war with large state
| actors who have the motive and cyberwarfare ability for
| mass hacking campaigns.
| kataklasm wrote:
| Parent is pretty obviously referring to the 2022 Russian
| invasion of Ukraine, the single biggest (regarding media
| coverage) armed conflict right now.
| bdhcuidbebe wrote:
| Its just more news worthy, is all.
| corobo wrote:
| It's feasible it's related to layoffs. I dunno if it is
| actually related but no time like the present if everyone's on
| edge.
|
| Want to phish someone in 2023? Send an email saying they've
| been laid off. Link to an article (which requires auth to read,
| of course) for full details of their redundancy payout.
| duckmysick wrote:
| So many compared to when?
| wongarsu wrote:
| This hack was very sophisticated and targeted ("plausible-
| sounding prompts pointing employees to a website that cloned
| the behavior of our intranet gateway") but wasn't after the
| easily monetizable stuff (user emails, which in combination
| with their most used subreddits would be very valuable for
| targeted spam), but instead went for data on employees and
| business partners. This sure seems like a setup for attacking a
| more valuable target.
| gonzo41 wrote:
| Security done well is a bit expensive and boring. Thus lots of
| hacks because everyone is cheap and every one has a short
| attention span
| bigDinosaur wrote:
| You've been downvoted, but of course it's reasonable to think
| 'not a coincidence'. But I'd actually say that it's not a
| particularly interesting observation given how many nation
| state backed intelligence (or even crime, assuming a
| difference) groups there are that do frequently hack large
| companies and government agencies. The pertinent thing here is
| that we simply don't know, and there are also plenty of boring
| criminal groups that also hack.
| Am4TIfIsER0ppos wrote:
| Definitely a coincidence and not a conspiracy of spooks working
| for the NSA (and similar) breaching servers in order to con you
| into getting a government spying device (cell phone).
| butz wrote:
| <tinfoil-hat>Now that is an easy way to collect phone numbers
| from all users</tinfoil-hat>
| huhtenberg wrote:
| Earlier thread on this -
| https://news.ycombinator.com/item?id=34731407
| iLoveOncall wrote:
| > Reddit recommends users set up 2FA to protect accounts
|
| How about Reddit follows their own recommendation and forces 2FA
| for their employees?
|
| Those kinds of attacks are 100% avoidable. Nobody with my company
| username and password can do ANYTHING, unless they have physical
| access to my computer...
| Havoc wrote:
| >Reddit also stated that there was no evidence the systems used
| to run Reddit itself and store the majority of data, the primary
| production systems in other words, was breached.
|
| Ah the classic PR blur. Could mean anything from "all good" to
| "we don't log - ignorance is bliss".
| hgsgm wrote:
| That's always true of everything. How do you know you weren't
| hacked yesterday?
|
| Reddit also said they haven't seen the data advertised at data-
| selling sites.
| pgrote wrote:
| >Ah the classic PR blur. Could mean anything from "all good" to
| "we don't log - ignorance is bliss".
|
| After what lastpass did I cannot trust any self reporting.
| suslik wrote:
| Maybe I missed that - did they misreport anything? I know
| they royally fucked up, put they didn't really hide the fact
| that the (encrypted) vault data was stolen.
| TallGuyShort wrote:
| After their initial announcement, they updated the same
| post after months as they had since discovered it was
| worse. And in some cases it turns out the vault data was
| not as encrypted as they had ever said. Here's one of the
| better write-ups I've seen:
| https://palant.info/2022/12/26/whats-in-a-pr-statement-
| lastp...
| remus wrote:
| I think this is overly pessimistic. While there's definitely
| shady companies out there who will say this while having very
| poor security practices, it's tricky demonstrating that
| something didn't happen.
|
| Say you had detailed audit logs for example. What happens if
| there's a subtle bug in those systems that allowed the hacker
| to proceed without logs being recorded?
| mannykannot wrote:
| The difficulty of verifying the claim is not somehow a
| justification for making it - quite the opposite, in fact.
|
| As it happens, there is something that would help, though
| if and only if they can do it: Explain what evidence they
| would have if the breach had occurred.
| PuppyTailWags wrote:
| There's no regulation with teeth to hold companies
| accountable for breaches, by and large, and therefore this
| is exactly the appropriate amount of pessimism.
| genmud wrote:
| Having worked professionally in security and incident
| response for 15+ years now, this take is not just spot on,
| but might be overly _optimistic_.
|
| I can't tell you how many large, well known companies I
| have worked with that either intentionally mislead,
| downplay, obscure or straight up lie in these types of
| notifications.
|
| I have had legal teams tell me that they don't have to
| notify customers of a breach because an event happened on
| their test/dev systems, or a developer was compromised and
| not their actual service.
|
| I have had companies intentionally not give information
| (like what an attacker was able to exfiltrate from a
| particular set of customers) that would been extremely
| helpful to inform or assess their risk. Instead they put
| out a generic "sophisticated attacker compromised our
| system, but no credentials or PII from our application were
| stolen".
| Dalewyn wrote:
| Specifically with regards to Reddit, spez is now known to
| have edited the database holding comments without making
| that fact known in any way.
|
| So absolutely nothing coming out of Reddit should be
| trusted or quoted.
| [deleted]
| piva00 wrote:
| Yup, I don't trust spez, I don't trust reddit's
| management (even less after the Chinese investments).
| This is a case to be cynical, reddit is not transparent
| and their leadership has been riddled with stupid
| politics, including the whole weird saga they did with
| Ellen Pao.
| pokepim wrote:
| [dead]
| gruez wrote:
| >Yup, I don't trust spez, I don't trust reddit's
| management (even less after the Chinese investments)
|
| I think you (and many other people) are overestimating
| how much chinese influence there is on reddit,
| considering that they have < 10% stake (according to
| wikipedia they "led" a funding round that raised 10% of
| valuation, and since then there was another funding round
| that presumably diluted their stake).
| corbulo wrote:
| Above 0 is too much. Could 10% buy you mod spot over a
| large major subreddit? Maybe get reddit to look the other
| way for your astroturf campaigns?
|
| Reddit is just as shady with its Overton Window
| manipulation tactics & strategies as Twitter has been
| exposed to be. Remember when Ghislaine Maxwell was
| revealed as a mod of r/Worldnews? I'm convinced any
| relevant PR company worth its salt has infiltrated
| moderator teams of every major subreddit. Whats stopping
| them? Or anyone else for that matter
| sillysaurusx wrote:
| Ehh. Spez being human makes me inclined to trust him a
| little more. I'm neutral in politics, but editing those
| comments was objectively funny. Stupid, yes --
| astonishingly so. But it finally broke the illusion that
| users own their comments. That's all it ever was: an
| illusion.
|
| I don't trust authority in general. But given the choice
| between spez and musk, I'd take spez any day. He's at
| least not hopped up on drugs running around making crazy
| decisions.
|
| And in terms of Reddit's trustworthiness, it makes even
| less sense that editing comments would be of any
| consequence. If they detect a hacker and have the logs to
| prove it, they'd gain nothing by modifying the logs. And
| if they don't, they gain nothing by fabricating the logs.
| So it seems reasonable to conclude that they just don't
| have the logs.
|
| Which is also reasonable. When I was hacking into systems
| at Matasano, it always made me uncomfortable just how
| undetectable I was. I wasn't trying particularly hard to
| conceal myself, but a few well-chosen bash incantations
| and opening things in vi means all anyone sees is that a
| vi process is running.
| ineptech wrote:
| Obviously this is an unpopular opinion, but I think
| you're right about spez. Editing those comments in his
| AMA was dumb, but pretty obviously not malicious in the
| way that's being suggested here. I think a fair analogy
| would be if he gave a speech in a clown wig, and was then
| accused of having tried to disguise himself.
| raspberry1337 wrote:
| I'd take the devil over musk! At least he is not hopped
| up on drugs and running around making crazy bad decisions
| nkozyra wrote:
| Getting some Poe's Law vibes here.
| qingdao99 wrote:
| How hard is it to resist directly editing user data on
| your site? It's a pretty clear-cut case of abuse of
| power.
| doubled112 wrote:
| I've always strongly believed in "ignorance is bliss",
| and "if somebody wants me to know something they will
| tell me".
|
| The idea of snooping barely crosses my mind, let alone
| editing.
|
| Maybe it is different because Reddit comments are
| intended to be public.
| 7speter wrote:
| > But it finally broke the illusion that users own their
| comments. That's all it ever was: an illusion.
|
| Makes me wonder about all what else about reddit is an
| "illusion"
| malfist wrote:
| > Spez being human makes me inclined to trust him a
| little more
|
| You realize what you're saying right? You're saying
| someone's actions that breach trust makes you trust them
| more?
|
| Actions speak louder than words, if someone is showing
| you that you can't trust them, you don't decide that
| you're going to trust them more!
| cmh89 wrote:
| >I'd take spez any day. He's at least not hopped up on
| drugs running around making crazy decisions.
|
| spez fostered a pedophile subreddit where they posted
| creepshots of children because it was the top driver of
| users to his site. It took hitting the mainstream media
| for him to shut it down.
|
| He's a terrible person
| LarryMullins wrote:
| So basically "he lied to me, lying is a human behavior,
| so I trust him."
|
| Wew.
| albert-thomas wrote:
| I've had a few interactions with him person to person, he
| seems like an alright guy.
|
| Then again, so did my last boss till i got to know him
| better
| LarryMullins wrote:
| Never trust any company with a PR department at all,
| they're all opportunistic liars who's priority is limited
| damage to the company, not telling the truth. They only do
| the latter when they think it will have the effect of the
| former.
|
| Really, don't trust corporations at all. Even if the
| circumstances of life force you to do business with them
| and _hope_ nothing goes wrong, that 's no reason to ever
| trust them. The bigger the corporation the more true this
| is, since the structure of corporations makes people feel
| less personally responsible for the bad things they might
| do to you, like lying to you about the scope of a data
| breach. The "just following orders" mentality allows
| workers to do things they'd never otherwise do to you, and
| that's just one example.
|
| If any sort of business is safe to trust, it's the one-man-
| shop owner-operator kind of business and you can only trust
| those guys insofar as you can trust any other person at
| all. In that case you have to consider it on a case-by-case
| basis.
| bithead wrote:
| Not trusting corporations is possibly the best advice
| available. I used to work for the largest insurer on
| Earth, a "health insurance" company. They quit paying for
| my insulin, which I need to live. They have enough
| lawyers they could just pile them physically on my house
| and suffocate me. They then laid me off due to age. My
| group of layoffs was 155, and of those 17 were under 40.
| They did give me a pile of cash not to sue - which I took
| like the opportunistic bastard I am in the end.
| hn_go_brrrrr wrote:
| > Never trust any company with a PR department at all
|
| So you're saying we should trust Twitter? :)
| LarryMullins wrote:
| Heh, but what is Elon, if not a one-man PR department?
| dcow wrote:
| One man department. Such praise.
| LarryMullins wrote:
| To say that a man is a PR department is the most grave of
| insults.
| [deleted]
| boppo1 wrote:
| Reddit is a shady company. Doing everything they can on the
| browser experience including interrupting me while I'm
| typing to try to shunt me over to the app is shady. I don't
| want the app. I have clicked 'continue in browser' at least
| 200 times. My preference ought to be clear and recorded by
| now.
|
| I'd stop visiting altogether if I didn't have a general
| problem with compulsive browsing.
| jungledeuce wrote:
| Sure, shady companies exist. And you shouldn't trust
| shady companies to self report. But... you already know
| that, it's in the name! "Shady". So I think the idea that
| you should _never_ trust self reporting is indeed an over
| reaction.
|
| However, having been at (what I deemed) non-shady
| companies, there's still the _very human desire_ to
| downplay as much as is reasonable. Shady companies
| overstep reasonability on purpose.
| stefantalpalaru wrote:
| [dead]
| throwaway2056 wrote:
| Why use reddit's official app? There are several decent
| opensource apps. (BTW, you can use libredd.it to just
| read-only reddit)
| tstrimple wrote:
| Thanks I may look into libredd.it. I intentionally
| removed the 3rd party apps because they were too good and
| enabled me to doom scroll too efficiently. I used the
| website in part because it's a painful experience which
| will keep me from staying on there too long. A read-only
| version may help that even more because then I'd have to
| switch to the full website if I wanted to rage post about
| how someone is wrong on the internet.
| fragmede wrote:
| Reddit pushing their app so hard annoys the hell out of
| me too, but what are they doing that qualifies as
| "shady"?
| seanw444 wrote:
| Sounds like a job for uBlock Origin. Just block the
| element.
| dfxm12 wrote:
| You used to be able to create a reddit account without an email
| address. If all they can get is a username and password, by and
| large, who cares? Just create another account and you're on your
| way. It's way less likely hackers will figure out your creds on
| other sites if they don't have an email address to act as a key.
|
| Why require email for dumb social media sites? You can talk about
| password recovery, but emails aren't necessarily required for
| that, and it could be something to opt in to. It seems like email
| is required to make data collection, tracking and advertising
| easier. It sucks that all this creepy data collection is not only
| an annoyance, but also makes us less secure.
| _aavaa_ wrote:
| There are legitimate reasons for requiring an email, e.g.
| increasing the difficult of making bots and for banned people
| to make a new account.
| from wrote:
| Phone verification raises account creation costs to at least
| 20-30 cents an account (assuming you ban VOIP and only take
| first world countries, can be lower otherwise), email
| verification if you still allow yandex rambler outlook
| hotmail addresses raises it to a cent at max.
| _aavaa_ wrote:
| Take my parent's complaint and replace email with phone and
| the complaint gets worse since the privacy concerns are
| even greater.
| ridgered4 wrote:
| Most email services now demand SMS verification to sign
| up for them now as well.
| lghh wrote:
| Reddit doesn't require an email. They use dark patterns to make
| it look like you do, but anywhere it asks for an email in
| signup can be left blank.
| layer8 wrote:
| Doesn't work for me. The Continue button is only enabled once
| you enter an email address. Furthermore, activating 2FA
| requires a verified email address.
|
| Edit: It works when using the right URL, see
| https://news.ycombinator.com/item?id=34742134 below.
| Sakos wrote:
| It only works on the desktop site. Did you try on mobile?
| layer8 wrote:
| It works when manually going to
| https://www.reddit.com/account/register/ (both on mobile
| and desktop), but it doesn't work when following the Log
| In / Sign Up links from the Reddit page, which have
| additional URL parameters attached. Maybe this is also an
| A/B testing situation, as the additional parameters have
| "experimental" in their name.
| Sakos wrote:
| I might be thinking of old.reddit.com. I know that the
| mobile version requires an email there but the desktop
| version asks for it, but if you click continue, it
| doesn't check if you've entered one.
|
| That experimental part is interesting.
| sva_ wrote:
| I think the mods can see if your account has a verified email
| attached to it though? At least it seems like subs can choose
| to not let unverified accounts post.
| banana_giraffe wrote:
| Anyone can see if an account is email verified. It shows up
| as a "trophy" in the account info page.
| Workaccount2 wrote:
| Yea, you cannot post in /r/news for instance without a
| verified e-mail. Automod will remove your posts/comments.
|
| I don't know what they think they are accomplishing since
| burner e-mails are trivial, but perhaps it gives a
| semblance of doing something.
| skybrian wrote:
| My Reddit account got hacked a few years ago because I created
| a Reddit account using a throwaway password, since I didn't
| care much about Reddit when I started. The hacker started using
| it to promote crypto.
|
| I was able to get the old account disabled, but couldn't get it
| back because I couldn't prove I'd ever owned it. So I created a
| new account, and it wasn't a big deal, but I was annoyed that I
| lost my preferred username. Fortunately I'm not a moderator for
| any subreddits.
|
| Don't get the privacy concerns. I'm totally fine if people know
| what I post on Reddit. It's public. I wouldn't want any friends
| to get confused by private messages sent as me, though.
|
| People who don't care about losing their account probably
| aren't doing anything they care about with it, and that's okay,
| but it's not everyone.
| pavel_lishin wrote:
| > _Don 't get the privacy concerns. I'm totally fine if
| people know what I post on Reddit._
|
| Good for you. But for others, pseudonimity is a way of
| protecting themselves in real life. There are people who
| cannot express their views on certain subjects without
| inviting scrutiny, or even danger, in their real lives.
|
| > _It 's public._
|
| There are private subreddits.
| sizzle wrote:
| I'm not following, how did a throwaway password get you
| hacked? Did they use a common password leak list to guess via
| bruteforcing? Does Reddit not rate limit login attempts?
| pavel_lishin wrote:
| > _If all they can get is a username and password, by and
| large, who cares? Just create another account and you 're on
| your way._
|
| Who cares? Those of us who treat subreddits as communities, and
| as such have built relationships there.
| [deleted]
| bmitc wrote:
| Kind of weird posting this here. Hacker News provides little
| ability to manage an account, much less setup 2FA.
| notacoward wrote:
| No 2FA, no muting/blocking or following, non-transparent
| moderation using long-discredited techniques, security through
| obscurity. For a site devoted to discussing the latest tech,
| the site itself is curiously stuck in the 90s and the grognards
| like it that way.
| Arnavion wrote:
| >no muting/blocking
|
| https://news.ycombinator.com/item?id=33365189
| Shaggy2000 wrote:
| At least it has kept the nice 90s atmosphere too. Generally
| HN users are high value targets - how little spam or trolling
| there is to be found here by outsiders is incredible
| considering the lack of safeguards you mentioned.
| mkr-hn wrote:
| What's weird about posting news of a breach of a major site on
| a news aggregator?
| bmitc wrote:
| Just that Hacker News doesn't provide the protections being
| discussed given the also discussed assumption that sites will
| be breached at some point.
___________________________________________________________________
(page generated 2023-02-10 23:02 UTC)