We [Reddit] had a security incident. Here’s what we know

Re:We [Reddit] had a security incident. Here’s what we know by NoPicklez on Thursday February 09, 2023 @11:50PM (#34735750)

My point being is that by not having hardware based MFA, but still have a form of soft token MFA doesn't make the IT personnel completely incompetent or negligent.

Not requiring MFA at all and having weak passwords would be an example of that.

[ Parent | on HN ]

Re:We [Reddit] had a security incident. Here’s what we know by sneak on Friday February 10, 2023 @05:25AM (#34737873)

Then why are they still getting owned via common/routine phishing attacks? Ones that are entirely, cheaply, and easily preventable?

[ Parent | on HN ]

Re:We [Reddit] had a security incident. Here’s what we know by iinnPP on Friday February 10, 2023 @09:56AM (#34740443)

Because they don't pay a competent person to do their security or because the person they paid isn't able/willing to make decisions.

Phishing is not obviously sophisticated but an argument could be made. The problem with letting that kind of language slide is that it skirts responsibility. Society has a huge accountability problem currently and there isn't really an end in sight. There's no need to continue allowing corporations to use such language and continuing the problem.

If a solution to phishing is available and not used, the easy mode hack is attributed to the security of the people so responsible. They took a risk and that went bad. Fire them(the people ACTUALLY RESPONSIBLE) and move forward with a better model of security.

The person actually responsible is the person(s) who made the final call on using security susceptible to phishing attacks where a better option exists.

[ Parent | on HN ]