News for hackers. Stuff that matters.

A comment on A Data Leak Exposed the Personal Information of over 3k Ring Users. Parent comment

Re:A Data Leak Exposed the Personal Information of over 3k R... by BelleOfTheBall on Thursday December 19, 2019 @08:31PM (#21841032)
I've recently had a similar problem with Spotify. My account was stolen. In part because I did not have 2FA turned on... because the app doesn't offer it for some reason. And, in part, because whoever logged into my account from a different IP and device supposedly didn't trip any of their security measures. So I was never even told that someone took hold of my account until I tried to get on.

It's baffling to me that any popular app wouldn't have 2FA (or any app, for that matter.)

[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by zerkla on Friday December 20, 2019 @11:14AM (#21845184)
Same thing happened to me... I just noticed one day that my recent music was a bit odd, completely different to what I usually listen to. I changed my password, but 2FA should be a given at this stage.
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by caf on Friday December 20, 2019 @04:48AM (#21842858)
I'm curious as to how stolen Spotify accounts are monetised? What's the value of them?
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by dylz on Friday December 20, 2019 @01:33PM (#21846370)
https://www.ebay.com/sch/i.html?_&_nkw=spotify+warranty&_sac...

All keylogged/phished/etc.

[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by caf on Saturday December 28, 2019 @01:46AM (#21897548)
This is fascinating - the individual prices are so low that they really must be moving a great number to turn a worthwhile profit.
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by scohesc on Friday December 20, 2019 @11:14AM (#21845179)
Sell them on the black market to other people for dirt cheap like Netflix accounts used to (may still be?) done with.
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by SideburnsOfDoom on Friday December 20, 2019 @04:55AM (#21842885)
Free music.
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by choward on Friday December 20, 2019 @12:02AM (#21841824)
2FA for spotify? I'm curious where you draw the line for 2FA. Should every app (and web app) have 2FA?
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by lighthazard on Friday December 20, 2019 @12:05AM (#21841837)
I'd argue, in 2019, every app/service that requires a login should offer a 2FA option to add an additional layer of security - the person logging in most likely is the owner of the 2FA device.
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by BelleOfTheBall on Friday December 20, 2019 @01:35AM (#21842124)
Maybe not every app but definitely one through which I make any type of payment. Spotify wants me to buy Premium, Spotify should offer me security.
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by close04 on Friday December 20, 2019 @08:21AM (#21843910)
If it involves money (paid service, even if the hijacker never gets access to your actual card data and can't make any payments) or private data (name, address, etc.) then it really should.
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by choward on Friday December 20, 2019 @12:47PM (#21845919)
I agree for the most part about the money part. I would still want the option for them to not allow me to upgrade plans without re-entering my credit card info. But with regards to personal information, that is almost everything I log into. And those companies share your personal info anyway, so it just gives you a false sense of privacy/security.
[ Parent | on HN ]
Re:A Data Leak Exposed the Personal Information of over 3k R... by buran77 on Monday December 23, 2019 @08:00AM (#21863323)
> it just gives you a false sense of privacy/security

No more that the password already does. 2FA isn't supposed to protect you from the company you already have the data too. And it's not really for the "privacy" of that personal data but for securing it.

[ Parent | on HN ]