It’s been rather too long coming but Reddit users can finally secure their accounts with two-factor authentication (2FA).
- Sophos blocks damn near everything by default. It's definitely not plug and play, so be prepared to spend a lot of time 'training' the software to your system after deployment. That being said, it is pretty good and blocking and reporting stuff, and he hangs out quietly in the background.
- Sophos blocks damn near everything by default. It's definitely not plug and play, so be prepared to spend a lot of time 'training' the software to your system after deployment. That being said, it is pretty good and blocking and reporting stuff, and he hangs out quietly in the background.
Read the announcement:
You asked for it, and we’re delivering!
Which ignores that Reddit is probably the last of the big internet brands to offer what, by 2018, has become a standard security option.
It is at least easy to turn on, by clicking on a link at the bottom of the preferences tab, which is also used to set the account password.
A small glitch Naked Security noticed is that the words “two factor authentication” don’t appear on all accounts in the appropriate space on the page. If that’s the case, look for the term ‘status’, beside which should be the phrase ‘click to enable’ to turn on authentication.
7 internet giants, including Mozilla, Reddit and Twitter, asked the House to do what the Senate narrowly missed doing: protect browsing history.
Using a 2FA app supporting the TOTP (Time-Based One-Time) protocol, such as Google’s Authenticator or Authy, the process is completed by scanning the QR code and entering a one-time six-digit verification code. A different code will be generated for every subsequent login.
Once finished, it’s important to generate and print out 10 backup codes in case there is a problem with the authentication app or the user mislays their smartphone.
The positive aspect of the announcement is that Reddit has jumped straight to app-based 2FA, eschewing the established but now insecure SMS text-based codes still offered by many sites.
It’s just a pity it’s taken so long. Pioneer Google first offered multi-factor authentication (called two-step verification) as long ago as 2011, as did Facebook (Login Approvals), both after noticing increases in attacks fuelled by weak passwords, password re-use and phishing attacks.
Twitter and Microsoft added the same in 2013 (login verification), while even Instagram and WhatsApp had it by 2016 and 2017, respectively.
A turning point for Reddit was the 2016 incident when a hacker broke into moderator accounts and defaced subreddits. This drew attention to the weakness of securing accounts using passwords alone – which some speculated might have been the point of the attack.
After eventually resetting the passwords on 100,000 accounts, the company admitted it was looking at implementing 2FA. As it said at the time:
Reddit itself has not been exploited, but even the best security in the world won’t work when people are reusing passwords between sites.
Equally, enabling 2FA will only make a difference to security if people bother to activate it.
Reddit Sophos Free
A week ago, a Google engineer fessed that fewer than 10% of its Gmail users had bothered to turn on its 2-step verification security – and that’s after seven years in which the company has nagged its users relentlessly to do this.
Reddit Sophos Security
It’s possible that users have grown weary of having to enable 2FA on lots of sites but apps like Google’s Authenticator (which works for multiple sites) is one way to streamline this.