7 ms·

It took two days for a company the size of DO to get an actionable response. What hope do the rest of us have? Interesting write up and 2FA by default sounds l

It took two days for a company the size of DO to get an actionable response. What hope do the rest of us have? Interesting write up and 2FA by default sounds like a sensible move. If you’re the type of user to have a DO account, you should be perfectly capable of using 2FA.

throwntoday 4y ago
MFA is inconvenient
- deleted 4y ago
  [deleted]
- teeray 4y ago
  Especially when you generate one-off passwords with enough entropy to busy an attacker until the heat death of the universe. OTPs are not meaningfully increasing security in that scenario.
  - nerdawson 4y ago
    That statement directly contradicts the article. A number of accounts would have been accessed were it not for 2FA. The best password won’t save you if a reset email is intercepted. Something you have plus something you know should be what we cone to expect from any service that deals with anything of importance.
    - diarrhea 4y ago
      That doesn’t make too much sense. An intercepted password reset email requires access to the email account. That’s a whole different scenario. If both the email and DO account are behind strong, unique passwords, that won’t happen from a mere DO email leak. Now, if the same, weak passwords are used for both accounts, sure. That’s terrible practice. But it’s also not what the GP was talking about.
      - Godel_unicode 4y ago
        The article is about a security breach at a company which sends emails. This scenario requires access to the email, the email account is irrelevant.
      - shreddit 4y ago
        I am astonished by the amount of people commenting under an article they obviously didn’t read…
        dotancohen 4y ago
        You must be new here.
    - slavik81 4y ago
      A password is something you know, but password reset is a bypass for that factor. They could drop the option of password reset and thereby eliminate that vulnerability, but I presume they don't because that would inevitably result in people getting locked out of their accounts. That's not something fundamental to passwords. It's just that the culture of security in the industry seems to be more willing to lock people out of their account when they lose the factor they have than when they lose the factor they know.
      - autoexec 4y ago
        > It's just that the culture of security in the industry seems to be more willing to lock people out of their account when they lose the factor they have than when they lose the factor they know. It could be that losing what you have is easier for people to remedy than a forgotten password, but somehow I suspect that it probably comes down to which one generates the fewest angry customers/calls/support tickets. Maybe it's easier for us to blame ourselves if we forget to carry a token or our cell phone?
ipaddr 4y ago
I'm suprised 3FA isn't enabled by default.
- yen223 4y ago
  I suspect more people would rather have their email leaked than to have to deal with 3 factor auth
- formerkrogemp 4y ago
  - born-jre 4y ago
    - haint_ 4y ago
      - somebodythere 4y ago
        mechaKurdi 4y ago
        ivan_gammel 4y ago
      - javea71 4y ago
        Ok reddit

throwntoday 4y ago

MFA is inconvenient

deleted 4y ago
[deleted]
teeray 4y ago
Especially when you generate one-off passwords with enough entropy to busy an attacker until the heat death of the universe. OTPs are not meaningfully increasing security in that scenario.
- nerdawson 4y ago
  That statement directly contradicts the article. A number of accounts would have been accessed were it not for 2FA. The best password won’t save you if a reset email is intercepted. Something you have plus something you know should be what we cone to expect from any service that deals with anything of importance.
  - diarrhea 4y ago
    That doesn’t make too much sense. An intercepted password reset email requires access to the email account. That’s a whole different scenario. If both the email and DO account are behind strong, unique passwords, that won’t happen from a mere DO email leak. Now, if the same, weak passwords are used for both accounts, sure. That’s terrible practice. But it’s also not what the GP was talking about.
    - Godel_unicode 4y ago
      The article is about a security breach at a company which sends emails. This scenario requires access to the email, the email account is irrelevant.
    - shreddit 4y ago
      I am astonished by the amount of people commenting under an article they obviously didn’t read…
      - dotancohen 4y ago
        You must be new here.
  - slavik81 4y ago
    A password is something you know, but password reset is a bypass for that factor. They could drop the option of password reset and thereby eliminate that vulnerability, but I presume they don't because that would inevitably result in people getting locked out of their accounts. That's not something fundamental to passwords. It's just that the culture of security in the industry seems to be more willing to lock people out of their account when they lose the factor they have than when they lose the factor they know.
    - autoexec 4y ago
      > It's just that the culture of security in the industry seems to be more willing to lock people out of their account when they lose the factor they have than when they lose the factor they know. It could be that losing what you have is easier for people to remedy than a forgotten password, but somehow I suspect that it probably comes down to which one generates the fewest angry customers/calls/support tickets. Maybe it's easier for us to blame ourselves if we forget to carry a token or our cell phone?

ipaddr 4y ago

I'm suprised 3FA isn't enabled by default.

yen223 4y ago
I suspect more people would rather have their email leaked than to have to deal with 3 factor auth
formerkrogemp 4y ago
- born-jre 4y ago
  - haint_ 4y ago
    - somebodythere 4y ago
      - mechaKurdi 4y ago
        ivan_gammel 4y ago
    - javea71 4y ago
      Ok reddit