this post was submitted on 26 Jan 2024
320 points (98.5% liked)
Technology
59483 readers
5255 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Holy fuck they're incompetent
Look, I'm as ready as anyone to jump on companies for mishandling data. I work daily with extremely private medical information protected by an ungodly amount of laws, and it pisses me off how whimsical most companies are with customer data. This one wasn't exactly their fault though. If you use the SAME EMAIL AND PASSWORD across multiple different sites it's not site B's fault when site A gets hacked and your login information is attempted on site B. It's also not even that surprising given people willingly giving up information this private aren't exactly the most privacy literate.
Could they have enforced multi-factor 2FA? Sure, and it would've mitigated some of the damage. However, I think we can all reason that they probably had the same password for their email and phone provider. Hardware keys aren't cheap, and most people just don't have them. It's also pretty reasonable that it would take a super long time to figure out someone logging in with a username and password was "hacked".
You have a point. However, I think they should've forced 2fa from the start.
Everyone already has the hardware for 2fa in their pockets too. This was simply a decision this company made to minimise barriers to their customers wallets.
Maybe a lot of us do but the general population might not even know what hardware tokens are and if they exist.
I'm all for security, but god I hate forced 2fa. I'm a power user with a password manager that generates 64 characters long random passwords, different for each site. I don't want to be bothered to take my phone every time I want to login.
Use a password manager that also does totp.
If this guy is this lazy then this might be a good option? Bitwarden comes with one included but I still use a separate app (Aegis) and my yubikey.
I try to keep my fingers in my keyboard as much as possible and having to take out my phone is just a waste of time. I do not need 2fa. Let me do my own security.
Maybe requiring 2fa for passwords shorter than 60 characters would be a good solution. Most people would use 2fa but people with strong passwords can live without it.
I highly disagree with not having 2fa. Even having one in your password manager, allowing you to not take fingers off of keyboard is better than nothing.