From TFA: > in an attempt to steal credentials and second-factor tokens. > > After successfully obtaining a single employee’s credentials So was the attempt t

From TFA: > in an attempt to steal credentials and second-factor tokens. > > After successfully obtaining a single employee’s credentials So was the attempt to steal second-factor successful or was it the account of an employee without 2FA that was compromised? Because then... On the page as to how to set up 2FA linked from TFA: https://reddithelp.com/hc/en-us/articles/360043470031-What-is-two-factor-authentication-and-how-do-I-set-it-up- https://reddithelp.com/hc/en-us/articles/360043470031-What-i... > "After setup, you may be asked to log out and log back in to your account. Moving forward, you’ll need to enter a 6-digit code from your authenticator app every time you log in to Reddit." There's 2FA and 2FA. TOTP like Google Authenticator giving these six digits are easy to phish. I much prefer FIDO(2) devices and the webauthn protocol (Chrome doesn't even allow U2F anymore but webauthn is backward compatible with old security keys), especially when the device uses a different method for registering a service the first time and for then authenticating to that service (for example by using a different PIN for registering and for authenticating or by displaying on the device itself if you're registering or authenticating).