Hacker News Reader

The setup 2FA advice is kind of weird. I mean its fine in general, but it was an employee who was breached not a user, and there is no indication that the attackers got account data.

View on HN

And apparently the phishing attack phished both password and 2FA for getting into the intranet. So whatever 2FA they used internally didn't help.

Yeah, but every crisis is an opportunity and this is an opportunity to scare people into coughing up PII that advertisers love so much.

TOTP doesn’t expose PII.

True, but the email required to enable it (arguably) is.

Reddit is far from the worst offender in this area. I should have specified my opinion as a more general one.

Most sites don't let you register at all without an email.

Reply on news.ycombinator.com