Hacker News Reader

Information on the attack is scarce, but it sounds like attackers obtained credentials from prior breaches and used them against super funds. It is shameful that many of these funds have not yet implemented MFA in this day and age, but it's not like the actual fund got compromised.

Obviously, information at the moment is very light so this understanding may change, but this is the current position.

View on HN

Convincing and training old retirees to use 2FA is not something I will wish on my worst enemy.

The way it's commonly implemented - through SMS - isn't secure anyway. It's relatively easy to persuade an overworked employee at the phone company to issue a new SIM card.

Having to call/visit and social engineer an employee is an order of magnitude more work than just logging in with stolen credentials, which can be entirely automated. SMS 2FA is valuable when it can prevent credential stuffing attacks. It's a vulnerability when it can be used to reset passwords and recover accounts.

I don’t think this is as true as it once was. These days this stuff is all handled by an automated system that makes you prove your identity / ownership of the number. And support staff likely aren’t given access to override this.

Reply on news.ycombinator.com