Stories
Slash Boxes
Comments

SoylentNews is people

posted by chromas on Friday August 03 2018, @02:41PM   Printer-friendly
from the who-knew-sms-was-still-a-thing? dept.

Computer security journalist Brian Krebs has posted in his blog that Reddit, a well-known social news aggravation site, has announced that an attacker compromised a several employee accounts at its cloud and source code hosting providers. The way in turned out to be Reddit's reliance on mobile text messages (SMS) in an imitation of two-factor authentication (2FA). Mobile application-based keys are an option. Hardware tokens would have also been reasonably secure instead but few sites do more than partially support them.

Reddit said the exposed data included internal source code as well as email addresses and obfuscated passwords for all Reddit users who registered accounts on the site prior to May 2007. The incident also exposed the email addresses of some users who had signed up to receive daily email digests of specific discussion threads.

Specific details of how the SMS messages were intercepted have not yet been made public.

Earlier on SN:
Google Defeats Employee Phishing With Physical Security Keys (2018)
SIM Hijacking as a Second Factor (2018)
Authentication Today: Moving Beyond Passwords (2018)


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 5, Funny) by RS3 on Friday August 03 2018, @02:53PM

    by RS3 (6367) on Friday August 03 2018, @02:53PM (#716728)

    ... Reddit, a well-known social news aggravation site

    It's "aggregation" in the article, but "aggravation" is much funnier. Was that a typo or satire?

    Starting Score:    1  point
    Moderation   +3  
       Interesting=1, Funny=2, Total=3
    Extra 'Funny' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   5