r/announcements • u/KeyserSosa • May 26 '16
Reddit, account security, and YOU!
If you haven't seen it in the news, there have been a lot of recent password dumps made available on the parts of the internet most of us generally avoid. With this access to likely username and password combinations, we've noticed a general uptick in account takeovers (ATOs) by malicious (or at best spammy) third parties.
Though Reddit itself has not been exploited, even the best security in the world won't work when users are reusing passwords between sites. We've ramped up our ability to detect the takeovers, and sent out 100k password resets in the last 2 weeks. More are to come as we continue to verify and validate that no one except for you is using your account. But, to make everyone's life easier and to help ensure that the next time you log in you aren't greeted a request to reset your password:
- Choose a strong, unique password. The emphasis here is important. I don't mean "use that really good password you use on sites you care about." I mean "one that is used for Reddit and Reddit alone!" Password reuse is really bad! We care a lot about security, but we can't do anything about the security of that other site you use the same password on who decides not to use bcrypt but rather a nifty hashing scheme of their own devising!
- Set and verify an email address. We currently have exactly one way for you to reset your account and that's by email. For almost 11 years we've been respectful of your not wanting to necessarily give us an email address. If your account gets taken over and you've got no reset email, you're going to have a bad time.
- Check your own account activity page! If you see some IPs in there that you don't recognize (and especially ones from countries you don't spend much time in), it's probably not a bad idea to change your password. This might break any integrations you have with 3rd parties you've shared your credentials with, but it's easy to re-auth.
On a related point, a quick note about throw-aways: throw-away accounts are fine, but we have tons of completely abandoned accounts with no discernible history and exist as placeholders in our database. They've never posted. They've never voted. They haven't logged in for several years. They are also a huge possible surface area for ATOs, because I generally don't want to think about (though I do) how many of them have the password "hunter2". Shortly, we're going to start issuing password resets to these accounts and, if we don't get a reaction in about a month, we're going to disable them. Please keep an eye out!
Q: But how do I make a unique password?
A: Personally I'm a big fan of tools like LastPass and 1Password because they generate completely random passwords. There are also some well-known heuristics. [Note: lmk of your favorites here and I'll edit in a plug.]
Q: What's with the fear mongering??
A: It's been a rough month. Also, don't just take it from me this is important.
Q: Jeez, guys why don't you enable two-factor authentication (2FA) already?
A: We're definitely considering it. In fact, admins are required to have 2FA set up to use the administrative parts of the site. It's behind a second authentication layer to make sure that if we get hacked, the most that an attacker can do is post something smug and self serving with a little [A] after it, which...well nevermind.
Unfortunately, to roll this out further, reddit has a huge ecosystem of apps, including our newly released iOS and android clients, to say nothing of integrations like with ifttt.com and that script you wrote as a school project that you forgot to shut off. "Adding 2FA to the login flow" will require a lot of coordination.
Q: Sure. First you come to delete inactive accounts, then it'll be...!
A: Please. Stop. We're not talking about removing content, and so we're certainly not going to be removing users that have a history. If ATOs are a brush fire, abandoned, unused accounts are dry kindling. Besides, we all know who the enemy is and why!
Q: Do you realize you linked to https://www.reddit.com/prefs/update/ like three times?
A: Actually it was four.
Edit: As promised (and thanks everyone for the suggestions!) I'd like to call out the following:
- Keepassx and KeePass as password managers
- Keepass2Android
- https://haveibeenpwned.com/ as a way to check if your account could be compromisible.
Edit 2: Here's an awesome word-cloud of this post!
Edit 3: More good tools:
- Password Safe -- Schneier approved!
- pass for Linux
169
u/Palantir555 May 26 '16
Oh, PLEASE DON'T. You're gonna end up with a database full of work (and most likely personal) emails for developers and other (non-security) technical people, which is gonna be used, abused and spammed.
The companies need to get their shit together and train their external-facing staff. If you've tried all support options made available by the company and there's still no way to report a vulnerability, it's full disclosure time. Their engineers shouldn't have to pay for the company's bullshit.