Hacker News Reader

Comment by devnullbrain | Hacker News Reader

>While Reddit also suggests that updating passwords every couple of months is a good idea, as well as using a password manager, that's not advice most security professionals would currently condone. Changing passwords regularly, that is, not password manager usage.

What inelegant phrasing.

Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for your profile, there's no benefit to the user to have an old account with lots of karma. Just keep re-rolling with strong random passwords and you have nothing to lose.

View on HN

> treat online accounts as throwaway wherever possible

I don't need to know who you actually are, but over time interacting with other people here I've started to get a feel for several hundred accounts. This makes HN more pleasant because I have some sense of what sort of person they are to talk with, and what is likely to go well or poorly. When there have been subreddits I was really into, I would start to get a sense for the more prolific commenters there too.

If I regularly attended some sort of social club and it was common for people to replace their faces I would find it frustrating as well.

Interesting. Here I am thinking one of the best things about HN is how the usernames being a lighter shade makes them easy to ignore entirely and focus only on what's being said instead of the speaker.

On the contrary, it makes it harder to immediate spot and ignore shitposters or people who consistently make really stupid posts on certain kinds of thread, of which sort there are several very active posters. It's a big part of why a certain kind of trolly posting thrives on HN in a way that it doesn't some other places with sigs or user images or otherwise more-prominent user ID.

My kingdom for an ignore-list.

That's what makes it so awesome when you start recognizing the same username on comments where you subconsciously bother to check the name because it was so interesting

> check the name because [the comment] was so interesting

I wonder how many people have that reflex. I usually only notice usernames when mentioned by others.

I would hope most people. I can't imagine being so incurious that I'd read an awesome comment and not wonder who wrote it.

Why should it matter who wrote it?

One big reason I care about who wrote things is expertise. Ex: I've consistently seen informed and sensible security-related commentary from tptacek, so I would pay more attention to security-related advice with his name on it than if it was a name I didn't recognize.

I guess it wouldn't if one didn't value people. YMMV, but I think people are kind of cool — so if I hear a great song I want to know who the artist was. It helps me build a mental model of what I might be able to expect from them. I'm kind of shocked that this might not be obvious to everyone, TBH.

When you've been on the site 10 years, I guess you start to notice more patterns. You'll get there, young buck. ;)

HN is an accessibility nightmare thanks to the low contrast of so many critical UI elements

You can fix that with an extension: https://chrome.google.com/webstore/detail/high-contrast/djcf...

If I attended a social club and my comments from 10 years ago were permanently engraved on the walls, I'd be much less honest and open.

There is also the aspect of upvoting/downvoting that completely skews honest opinion.

Instead of acting like a bullshit filter, upvote/downvote tends to act like a dog getting petted for echoing back a popular opinion to the group or the dog being scolded for echoing an unpopular opinion. Dogs like to get pats on the head and don't like being yelled at.

It is really one of the dumbest ideas of the last 30 years. Total disregard for human behavior and total disregard for the truth considering how often the truth is an unpopular opinion at a specific moment in time.

Throwaway accounts to me are a small protest to this ridiculous system.

You can use alts and delete old comments.

Yeah. Let's delete old blogs and shut down the internet archive as well.

Personally I value the web as a knowledge store that persists.

Use a non-logged chat service if you want a transient medium.

Changing alts is a lot more pro-social than deleting your comments: with alt rotation your old writing is still available for others to learn from.

There's no deleting beyond a time limit on HN

you can request to the admins if you really need to

Of course Reddit lets is political allies doxx and harass Reddit's political enemies without reservation, so this will likely affect those accounts more so.

We're in a crisis of trust. "You have nothing to lose" is wrong. You and the community both have something to lose if identity is not valued. A throwaway is indistinct from a bot paid for by some rich mustache-twirling billionaire or state actor trying to control narrative.

The internet was always about judging the content and quality of user's posts/comments, while being unaware of their race, sex, origin, religion, and any other traits they didn't explicitly mention.

Nowhere else can you have in-depth technical discussions about the implications of Humean Projectivism on p2p network architecture, with a cybernetic dragonfly, a flying squirrel, and with distracting interjections by a literal fantasy troll. A bit of personal QA/QC, and individual filtering options, are all you need. Anything else is just censorious control of the narrative.

A discussion, maybe. But you can't have a conversation if you're not even sure that your conversational partner is the same person you replied to.

I know that there's a difference between spinning up a new account every few months, and for every reply. But long-term relationships in communities matter.

Yes I agree. This just emphasizes OP's point about how we can't make these accounts throwaway as there would be no content to judge.

You judge each comment by its own merits. Online forums like HN are a source of ideas, not necessarily correct ideas.

Eh in many ways that is not how humans work. We tend to build close in groups with higher trust level, because not trusting everything any anyone is physically and mentally exhausting. If you met a person that behaved in this manner in real life most people would conclude they had a mental illness or were an abuse victim.

Interacting with accounts in a huge, pseudo-anonymous social media sites based on discussion with voting systems is quite different from interacting with people in real life. For big sites like HN and most subreddits, the users may as well be anonymous. HN goes a step further and deemphasizes usernames a bit by making them lighter in color and smaller compared to the black body text. How do you build a "close in group" on a site this big with not a lot of emphasis on who you are? I've been on smaller message boards where you can actually get to know people and have an avatar and some public info about yourself attached to every post. It's a different experience in that case, for sure.

You wanna talk about how humans work - strangers in real life also don't just walk up to you and start talking about Reddit account security out of the blue! We also don't trust a talking head on TV or on the radio just because they're human. Relationships are built over time & higher trust has to be earned. Even if you're referring to the fact that most of us probably live in a relatively high trust society, that doesn't mean we trust our neighbors' opinions on strong passwords (or whatever) just because we trust them as our neighbor!

It would be nice for everyone to achieve the platonic ideal of having a gapless empirical understanding of the world from root to stem. It is not possible for a single person to do that, let alone everyone. At some point it becomes necessary to trust if we are going to provide and consume information remotely.

Ideas do not exist without context. Arguably the context is more essential than individual ideas. Judging ideas without context is not a useful exercise. It's easy to fall into a local minimum that's actually quite bad. Eugenics is a common example. Eliminating genetic disease sounds great as long as you don't have the context of genocide or humanism.

That's great, in theory.

When it comes to political discussions or any kind of politically biased graphic, particularly if it is something I disagree with, I assume it is astroturf/agitprop. When misinformation and propaganda are mainstream, why can I trust some random account on the internet for facts?

Tech is certainly different.

It's interesting; with many sites I'd agree with you, but on Reddit, I don't look at usernames much. I recognize a few usernames in most of the subreddits I visit, just from repeated exposure, but I don't value my own accounts or the karma they accumulate. I use different accounts for different subsets of subreddits the way I wear different clothes for different occasions. If I lost an account I'd sign up for a new one like buying a new outfit. I wonder why it's different.

We are in a crisis of trust, but I'm not sure the solution involves stronger identities. I've used Reddit for well over a decade at this point. I hate that my high school opinions are just out there permanently on the internet. It's much more damaging to communities for people to feel like they can't participate for fear of leaving a permanent record. If you were at a party, would you feel comfortable knowing you were being recorded the entire time? I think the same thing applies to digital communities.

We need some way of verifying that a real human is on the other end, but we don't necessarily need to know who that person is.

Trusting an anonymous redditor because they have lots of "karma" is extremely foolish. For one, they probably got those internet points by reposting other people's cat pictures and now you're in a conversation with them about something that has nothing to do with the subject of stealing cat photos, so why should the internet points they earned doing that count for anything?

Secondly, it's easy to farm up these internet points and sell the account to somebody else who's keen on exploiting the tendency of people like you to think that the internet points confer trustworthiness.

All of these trust systems and platforms are a centralized target for the behavior you describe. It makes it easier for those with bad intentions to rinse and repeat. Naive users may be left behind by those who have optimized their strategy.

Strawman. I never said anything about karma. A user's entire post and comment history is one click away during a discussion. That can be skimmed to build a decent picture quickly. That too can be faked, but the bar is much higher.

If a website or platform doesn't have sufficient measures, technological or otherwise, to deal with bots, spam, low effort posting, astroturfing, advertising, etc, it's the platform that shouldn't be trusted. If a platform could deal with bots entirely, or associate accounts with a real identity, it still doesn't mean that the platform or the user can be trusted, as identity and trust are not the same thing.

When millionaires, state actors, politicians, corporations, etc, switch from using bot farms to manipulate public opinion to paying influencers to do the same thing, people whose identity is inherently valued and trusted, you end up in the same position as we're currently in.

Even if I don't want to throw my reddit account away as such, it's hard for me to imagine ever thinking I'd care more about its security than I would about not giving Reddit my phone contact!

Yep. Looking forward to buying /u/maxwellhill off the dark web, so we can read all those private messages, and finally put to rest all the speculation of it being Ghislaine Maxwell's account (which went dark the day she was arrested).

Yeah, this was my first reaction.

"Huh, I guess I better change my password."

"Hmm, give reddit my phone number .... no."

No need for phone number, they just give you a TOTP private key you can use in Google Authenticator or something like that.

Reddit's TFA is not phone number based. You use a one time password generator.

>there's no benefit to the user to have an old account with lots of karma

Some subs have a minimum amount age or karma requirement to post. This is ostensibly to combat bots.

Those are very low thresholds.

You are right, but it is still annoying when cycling accounts.

Yea, you have to precycle effectively and create accounts before hand and let them build at least a small amount of karma.

These days I don't even log into reddit. After wide spread banning from subreddits for random reasons it's not worthwhile. I'll keep browsing old.red as long as it exists but if it goes away I'll DNS block all reddit at the router.

These days it seems you should change your password (and your 2FA token) every now and then not because you are the one getting hacked but the sites you sign up at.

This. 2FA (implying a phone number which is most likely most important number in your life) for a link sharing web site? You must be joking.

> This. 2FA (implying a phone number which is most likely most important number in your life) for a link sharing web site? You must be joking.

SMS is no longer recommended as a means of 2FA, as it's very vulnerable. Some sites still rely on it, unfortunately. However, it appears Reddit does support TOTP.

Somehow this reminds me of a wise saying: "Every problem in CS can be solved by adding level of indirection. Except for the problem of excessive number of indirections".

They do, but TOTP is only as secure as the seed stored by reddit.

That's a good idea and I've thought about it but I think many feel attached to their usernames and account history "15 yeas with.." site X. And sites often balk and say "username or email already has an account here".

It's a bit funny since alias was meant to hide who you were or at least make ire less formal than a person's full name. Then I go and use my name for an alias!

The "don't use your real name on the internet" advice wasn't great. When I set up a Google account as a kid I used a made up handle because all the adults told me to not use my name on the internet.

Decades later and it's still my main account and I often need to either switch accounts to the one with my real name or embarassingly ask people to invite my nickname account to various shared documents, calendars, etc. No way to migrate my YouTube channel either…

What's embarrassing about a nickname?

Having a disconnected online entity means less-than-pleasant jackasses can't pull something from years or even decades ago, put it out of context, and proceed to troll your life.

Not putting your real life identity on public display for the world to see means you maintain tighter control over how, when, and where your information gets out. Do you really need your real name, face, place of employment, telephone number, email address (with your name in it), and maybe even your home address publicized? More than likely you don't.

Having online identities disconnected from real life means you can use them to safeguard your actually really-fucking-important real life things. Your bank account? Use an email that uses a nickname instead of your real name so any would be hackers have to second guess your email too.

Worst comes to shove and shit hits the fan, you can throw away an online identity and make another one. You can't throw away your real name and face.

There are nothing but benefits by keeping your online and real life identities separate, and if you ask me it's one of the first steps to being truly internet literate.

I assume that Reddit keeps a list of IP addresses and advertising buyers can correlate them with data from other sources to associates accounts with real people.

Presumably, a Reddit leak means even more opportunity to unmask (dox) users who have responded truthfully to threads that say things like "what's the worst thing you ever did". Lots of blackmail opportunities.

It’s worse than this. Reddit, several years ago, introduced outbound click tracking.

All outbound clicks from the site are redirected via out.reddit.com which ties click activity to an individual (username / IP / device fingerprint based). This can only be blocked with aggressive old.reddit script blocking which breaks portions of the site.

The outbound click data is used for profiling and interest based advertising, but the data can be much worse than simply linking comments to identity.

They also tie IP/identity to individuals to serve relevant ads and this is the push to get people installing reddit on phones, where deviceIDs is an easy UUID for ads.

Did that finally go out to all subs, because for a while it was only on certain subs? I don't use Reddit anymore, after they suspended my account for promoting a peaceful protest of the Billionaire's Summer Camp, where the corporate media meets every year to consolidate the industry and plan the years narrative. This, after they allowed me to be harassed, threatened with sexual violence and doxxed. Good times!

To my knowledge, it was broadly rolled out, I don't use anything by old.reddit.com and it's rare, but it doesn't seem limited to a specific sub-reddit. Ads, for reddit is also bought at the reddit.com level, and each sub-reddit is a monetizable segment with unique demographics. There were reps from reddit ad sales that were telling me how excited they were with what they were working on ads/tracking pipeline several years ago, and I've seen more tracking get implemented since.

ponyomelette69@hotmail.com begs to differ.

Using a weird nickname for professional things seems strange to me. I would rather use my name.

You can use a neutral nickname.

buy a domain name (~$9/yr) and get managed e-mail provider that supports wildcard emails (~$50/yr). Now you have unlimited email options.

I have that and do that, but it doesn't solve the Google Drive thing.

You can create a new Google account tied to your domain and use that to collaborate with others. You can elect to stop using Gmail and your old nickname, unless I’ve missed something.

That would mean losing everything that cannot be migrated. (Not meaning that it would be gone, but that it would no longer be in the account I use.) I don't want that.

In the time that has passed since that advice better name generators have been developed so you don't have to make something up.

https://github.com/moby/moby/blob/master/pkg/namesgenerator/...

Nothing to lose..? Old and popular reddit accounts are worth more when sold for a reason. If I'm sharing an idea or business update, it's useful to show mods and algorithms that I'm a decade old user and not a bot created this month.

If you're a spammer then yeah, there's value to be had. But for moral people there really isn't any.

I'm mostly a "moral person" whatever that means and I disagree. My Reddit account has value to me for multiple reasons.

The last time I tried to change the password of a reddit account I lost access to it.

I attempted to change the password, got an error saying something went wrong. I figured I'd try again later. so I also didn't save the newly generated password.

Got logged out, and couldn't log back in with the old password.

And there's no way that I know of to contact anyone at reddit to try and get help.

Try the Forgot Password link?

The email provider that account was tied to doesn't exist anymore, and the domain is taken. I didn't notice until after it happened, so I am not putting all the blame on reddit. It's more of a string of unlucky circumstances. Who knows if I could have even changed it without access to the email account, anyway.

Fun fact: Reddit for the longest time didn't require an email address to create accounts.

Reddit still doesn't require an email to create accounts, even if it now heavily implies it does. Just click next without entering one.

> there's no benefit to the user to have an old account

I used to think so until I decided to reroll my old account into a new one, and it was such a pain re-subscribing to all my subreddits again.

Just create a mutlireddit of your subscriptions by going on https://old.reddit.com/subreddits/ and clicking 'multireddit of your subscriptions' on the right. Bookmark that link and voila, you have a backup of your subreddits for your new account.

That seems like a solvable thing with a 3rd party app/script.

I reroll every time I am banned from a sub I like because that sub notices I play in other subs - that whole “thing” is horseshit to me. So I just reroll to get around that autoban bot.

Do you happen to have a script for this? If so, I’d love to have it as it’s about time I reroll too.

No, but I have thought about trying to make one. Hrm.

See, I don’t mind this process.

It gives you a chance to re-evaluate what is actually giving you value. It’s like spring cleaning.

It’s the same reason I enjoy setting up a new or freshly reformatted phone or laptop. Feels good to clean out the cobwebs.

> Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for your profile, there's no benefit to the user to have an old account with lots of karma. Just keep re-rolling with strong random passwords and you have nothing to lose.

I (used to, i guess) do the same. I must have 40 accounts in total over the years. Funny enough i didn't even make a strong password - a stupidly bad one, unique for each account, actually. I had almost hoped it was hacked because it would be interesting to be hacked and not care.

> What inelegant phrasing.

Reddit's own phrasing is much better:

Since we’re talking about security and safety, this is a good time to remind you how to protect your Reddit account. The most important (and simple) measure you can take is to set up 2FA (two-factor authentication) which adds an extra layer of security when you access your Reddit account. Learn how to enable 2FA in Reddit Help. And if you want to take it a step further, it’s always a good idea to update your password every couple of months – just make sure it’s strong and unique for greater protection.

Also: use a password manager! Besides providing great complicated passwords, they provide an extra layer of security by warning you before you use your password on a phishing site… because the domains won’t match!

-- https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_se...

If you use the old/classic Reddit experience and you can't find the option to enable 2FA in your profile, use this URL directly instead: https://www.reddit.com/2fa/enable/

Just FYI while they suggest updating passwords they also claim that user accounts are safe at this time.

>> to treat online accounts as throwaway wherever possible

works for me everywhere except HN, because of the silly requirement of 500 karma to be able to downvote.

Personally, I start by not trusting platforms - pw manager and 2fa all the way, never re-using passwords. I also use bitwarded - open source ftw.

That's how most treat it. Just go to any thread even 3 months old and 1/4th of the users are deleted.

Reads like an 8th grader's report trying to meet the teacher's word count.

I've actually noticed how _bad_ the writing of some articles can be. I'm not a good writer by any means... but the best I can say is it sounds like an essay cranked out by someone in high school.

Just reminded me of my first "wtf." A journalist for our local university wrote a review for the movie "Hustlers" where they justified sexually assaulting and robbing men in New York because "men in New York were responsible for the 2008 financial crisis." All without missing a beat. Can't believe what passes these days.

When you find out how little these writers are paid you can understand the amount of effort they can put into these articles and still make enough money to eat.

Well, seems there's more people wanting to write than demand.

many ephemeral identities, treated like cattle

Reply on news.ycombinator.com