4 ms·

SMS hijacking? Really? How is it that Reddit’s security team is continually learning security lessons that have been common knowledge among non-technical peopl

SMS hijacking? Really? How is it that Reddit’s security team is continually learning security lessons that have been common knowledge among non-technical people for 5+ years? They seem to treat their production systems more carelessly than the average person treats their Nintendo switch account.

vesinisa 8y ago
For example GitHub Enterprise account does not differentiate between security levels of token and SMS based 2FA so the issue seems more widespread.
StriverGuy 8y ago
This is not common knowledge among non-technical people. In fact, many non-technical people don't even know what 2FA is. Additionally, it can take some time to change security standards in a large company. Most companies that are not in high compliance environments focus their engineering efforts on features.
gmjosack 8y ago
> been common knowledge among non-technical people for 5+ years Who are these non-technical people that you know that are not only using MFA but also know that SMS is insecure for MFA? Rather than putting them down I'm happy they're willing to share and bring knowledge, that some communities already know, to even more people.
- Alex3917 8y ago
  > Who are these non-technical people that you know that are not only using MFA but also know that SMS is insecure for MFA? Anyone who reads pretty much any mainstream newspaper? At this point it would be easier to name mainstream media publications that haven’t covered this issue extensively. E.g. just google: site:nytimes.com sms hijacking site:wsj.com sms hijacking site:latimes.com sms hijacking Not to mention the fact that it’s been discussed on Reddit itself hundreds of times. And on the front page of HN dozens of times as well. E.g.: https://news.ycombinator.com/item?id=14480191 https://news.ycombinator.com/item?id=14480191
praneshp 8y ago
> common knowledge among non-technical people You should talk to non-technical people when you get some time.
rdl 8y ago
Non-technical people should not have admin credentials on a top-20 website, ffs.

vesinisa 8y ago

For example GitHub Enterprise account does not differentiate between security levels of token and SMS based 2FA so the issue seems more widespread.

StriverGuy 8y ago

This is not common knowledge among non-technical people. In fact, many non-technical people don't even know what 2FA is. Additionally, it can take some time to change security standards in a large company. Most companies that are not in high compliance environments focus their engineering efforts on features.

gmjosack 8y ago

> been common knowledge among non-technical people for 5+ years Who are these non-technical people that you know that are not only using MFA but also know that SMS is insecure for MFA? Rather than putting them down I'm happy they're willing to share and bring knowledge, that some communities already know, to even more people.

Alex3917 8y ago
> Who are these non-technical people that you know that are not only using MFA but also know that SMS is insecure for MFA? Anyone who reads pretty much any mainstream newspaper? At this point it would be easier to name mainstream media publications that haven’t covered this issue extensively. E.g. just google: site:nytimes.com sms hijacking site:wsj.com sms hijacking site:latimes.com sms hijacking Not to mention the fact that it’s been discussed on Reddit itself hundreds of times. And on the front page of HN dozens of times as well. E.g.: https://news.ycombinator.com/item?id=14480191 https://news.ycombinator.com/item?id=14480191

praneshp 8y ago

> common knowledge among non-technical people You should talk to non-technical people when you get some time.

rdl 8y ago

Non-technical people should not have admin credentials on a top-20 website, ffs.