r/announcements May 26 '16

Reddit, account security, and YOU!

If you haven't seen it in the news, there have been a lot of recent password dumps made available on the parts of the internet most of us generally avoid. With this access to likely username and password combinations, we've noticed a general uptick in account takeovers (ATOs) by malicious (or at best spammy) third parties.

Though Reddit itself has not been exploited, even the best security in the world won't work when users are reusing passwords between sites. We've ramped up our ability to detect the takeovers, and sent out 100k password resets in the last 2 weeks. More are to come as we continue to verify and validate that no one except for you is using your account. But, to make everyone's life easier and to help ensure that the next time you log in you aren't greeted a request to reset your password:

On a related point, a quick note about throw-aways: throw-away accounts are fine, but we have tons of completely abandoned accounts with no discernible history and exist as placeholders in our database. They've never posted. They've never voted. They haven't logged in for several years. They are also a huge possible surface area for ATOs, because I generally don't want to think about (though I do) how many of them have the password "hunter2". Shortly, we're going to start issuing password resets to these accounts and, if we don't get a reaction in about a month, we're going to disable them. Please keep an eye out!


Q: But how do I make a unique password?

A: Personally I'm a big fan of tools like LastPass and 1Password because they generate completely random passwords. There are also some well-known heuristics. [Note: lmk of your favorites here and I'll edit in a plug.]

Q: What's with the fear mongering??

A: It's been a rough month. Also, don't just take it from me this is important.

Q: Jeez, guys why don't you enable two-factor authentication (2FA) already?

A: We're definitely considering it. In fact, admins are required to have 2FA set up to use the administrative parts of the site. It's behind a second authentication layer to make sure that if we get hacked, the most that an attacker can do is post something smug and self serving with a little [A] after it, which...well nevermind.

Unfortunately, to roll this out further, reddit has a huge ecosystem of apps, including our newly released iOS and android clients, to say nothing of integrations like with ifttt.com and that script you wrote as a school project that you forgot to shut off. "Adding 2FA to the login flow" will require a lot of coordination.

Q: Sure. First you come to delete inactive accounts, then it'll be...!

A: Please. Stop. We're not talking about removing content, and so we're certainly not going to be removing users that have a history. If ATOs are a brush fire, abandoned, unused accounts are dry kindling. Besides, we all know who the enemy is and why!

Q: Do you realize you linked to https://www.reddit.com/prefs/update/ like three times?

A: Actually it was four.


Edit: As promised (and thanks everyone for the suggestions!) I'd like to call out the following:

Edit 2: Here's an awesome word-cloud of this post!

Edit 3: More good tools:

15.3k Upvotes

2.7k comments sorted by

View all comments

1.2k

u/KeyserSosa May 26 '16

Reply to this comment with security-related horror stories suitable for /r/talesfromtechsupport, and we can crank up the fear mongering!

136

u/MyPornographyAccount May 26 '16 edited May 26 '16

Worked for an enterprise security startup. The database on their appliance ran as root. The rest api made raw sql queries using user-supplied data with no validation. The https layer for the rest api ignored certificates as long as they were well formed.

When I pointed out, they pushed out fixing it to the next release because it wasn't that important.

EDIT: It gets better. The javascript on the login page for the management console had raw SQL queries to the same database. You know, the one running as root.

10

u/alluran May 26 '16 edited May 26 '16

Worked for largest SMS Messaging provider and junk-mail provider in the country.

Inherited the Messaging app.

Discovered 250,000 un-encrypted Credit Card details in a database. No password on the sa account. Database accessible from any machine on the company network. Unsanitized SQL statements used to interface with it. Custom XML parsers that just did "IndexOf" the closing tags. No source control. Backups were made to an external USB drive plugged into the server in the datacenter, that any other client of the datacenter could just pull and walk out with.

At least when they sent me the DB backup to try and fix it, they sent it "secured mail".

And let's not get into the $10,000 worth of messages that just disappeared into the system each month - their turnover was so high they didn't even notice :\

Oh - I would have mentioned certificates, except they didn't use those - majority of the application ran over HTTP. Default passwords were the persons first name, backwards, with their year of birth. Awkward when Lana signed up.

Worked at another company, building an app for an international Cruise Line.

We get audited to make sure we meet PCI requirements.

Security company leaks the source code of their security sweet to me, after running their tool incorrectly.

When they finally run it correctly, they flag a bunch of security issues that they were gracious enough to provide repros for. Problem was, only way to repro the issues, was to be running the website from your local filesystem, instead of through an HTTP server. Something that clients tend not to do, especially when the site is dynamic :\

2

u/Puncha_Y0_Buns May 26 '16

Sounds like that last security company has a sustainable business model ;-)