{"id":270581,"date":"2018-08-02T10:23:27","date_gmt":"2018-08-02T08:23:27","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=270581"},"modified":"2018-08-02T10:24:59","modified_gmt":"2018-08-02T08:24:59","slug":"reddit-staff-used-sms-for-two-factor-authentication-and-got-hacked","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/270581-reddit-staff-used-sms-for-two-factor-authentication-and-got-hacked.html","title":{"rendered":"Reddit staff used SMS for two-factor authentication and got hacked"},"content":{"rendered":"

Reddit has disclosed<\/a><\/strong> that “a few” of its employees’ accounts at its cloud and source code hosting providers were recently compromised, and that the attackers gained access to a significant amount of user data.<\/p>\n

Between 14 and 18 June 2018, the attackers gained access to all\u00a0Reddit data from 2007 and before, including account credentials and email addresses.<\/p>\n

They also obtained email digests sent from 3 to 17 June 2018.<\/p>\n

The BBC reported<\/a><\/strong> that Reddit has received criticism for the way it is handling the incident, as it is not contacting users affected by the email breach.<\/p>\n

Security researcher Troy Hunt told the publication that Reddit’s refusal to notify those users doesn’t make sense. He noted that particularly in the case of the email digest, it is potentially exposing the identities behind what is a “deliberately anonymous account.”<\/p>\n

Reddit explained that the main attack was executed via an SMS intercept.<\/p>\n

“Already having our primary access points for code and infrastructure behind strong authentication requiring two factor authentication, we learned that SMS-based authentication is not nearly as secure as we would hope,” said Reddit.<\/p>\n

“We point this out to encourage everyone here to move to token-based 2FA.”<\/p>\n

Now read:\u00a0Reddit surprise in US website rankings<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

Reddit has disclosed information on a recent attack.<\/p>\n","protected":false},"author":23,"featured_media":197907,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[8045,33196],"class_list":["post-270581","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-reddit","tag-troy-hunt"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/270581"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=270581"}],"version-history":[{"count":2,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/270581\/revisions"}],"predecessor-version":[{"id":270603,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/270581\/revisions\/270603"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/197907"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=270581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=270581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=270581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}