Hacker News Reader

Comment by BelleOfTheBall | Hacker News Reader

I've recently had a similar problem with Spotify. My account was stolen. In part because I did not have 2FA turned on... because the app doesn't offer it for some reason. And, in part, because whoever logged into my account from a different IP and device supposedly didn't trip any of their security measures. So I was never even told that someone took hold of my account until I tried to get on.

It's baffling to me that any popular app wouldn't have 2FA (or any app, for that matter.)

View on HN

Same thing happened to me... I just noticed one day that my recent music was a bit odd, completely different to what I usually listen to. I changed my password, but 2FA should be a given at this stage.

I'm curious as to how stolen Spotify accounts are monetised? What's the value of them?

https://www.ebay.com/sch/i.html?_&_nkw=spotify+warranty&_sac...

All keylogged/phished/etc.

This is fascinating - the individual prices are so low that they really must be moving a great number to turn a worthwhile profit.

Sell them on the black market to other people for dirt cheap like Netflix accounts used to (may still be?) done with.

Free music.

2FA for spotify? I'm curious where you draw the line for 2FA. Should every app (and web app) have 2FA?

I'd argue, in 2019, every app/service that requires a login should offer a 2FA option to add an additional layer of security - the person logging in most likely is the owner of the 2FA device.

Maybe not every app but definitely one through which I make any type of payment. Spotify wants me to buy Premium, Spotify should offer me security.

If it involves money (paid service, even if the hijacker never gets access to your actual card data and can't make any payments) or private data (name, address, etc.) then it really should.

I agree for the most part about the money part. I would still want the option for them to not allow me to upgrade plans without re-entering my credit card info. But with regards to personal information, that is almost everything I log into. And those companies share your personal info anyway, so it just gives you a false sense of privacy/security.

> it just gives you a false sense of privacy/security

No more that the password already does. 2FA isn't supposed to protect you from the company you already have the data too. And it's not really for the "privacy" of that personal data but for securing it.

Reply on news.ycombinator.com