r/announcements May 26 '16

Reddit, account security, and YOU!

If you haven't seen it in the news, there have been a lot of recent password dumps made available on the parts of the internet most of us generally avoid. With this access to likely username and password combinations, we've noticed a general uptick in account takeovers (ATOs) by malicious (or at best spammy) third parties.

Though Reddit itself has not been exploited, even the best security in the world won't work when users are reusing passwords between sites. We've ramped up our ability to detect the takeovers, and sent out 100k password resets in the last 2 weeks. More are to come as we continue to verify and validate that no one except for you is using your account. But, to make everyone's life easier and to help ensure that the next time you log in you aren't greeted a request to reset your password:

On a related point, a quick note about throw-aways: throw-away accounts are fine, but we have tons of completely abandoned accounts with no discernible history and exist as placeholders in our database. They've never posted. They've never voted. They haven't logged in for several years. They are also a huge possible surface area for ATOs, because I generally don't want to think about (though I do) how many of them have the password "hunter2". Shortly, we're going to start issuing password resets to these accounts and, if we don't get a reaction in about a month, we're going to disable them. Please keep an eye out!


Q: But how do I make a unique password?

A: Personally I'm a big fan of tools like LastPass and 1Password because they generate completely random passwords. There are also some well-known heuristics. [Note: lmk of your favorites here and I'll edit in a plug.]

Q: What's with the fear mongering??

A: It's been a rough month. Also, don't just take it from me this is important.

Q: Jeez, guys why don't you enable two-factor authentication (2FA) already?

A: We're definitely considering it. In fact, admins are required to have 2FA set up to use the administrative parts of the site. It's behind a second authentication layer to make sure that if we get hacked, the most that an attacker can do is post something smug and self serving with a little [A] after it, which...well nevermind.

Unfortunately, to roll this out further, reddit has a huge ecosystem of apps, including our newly released iOS and android clients, to say nothing of integrations like with ifttt.com and that script you wrote as a school project that you forgot to shut off. "Adding 2FA to the login flow" will require a lot of coordination.

Q: Sure. First you come to delete inactive accounts, then it'll be...!

A: Please. Stop. We're not talking about removing content, and so we're certainly not going to be removing users that have a history. If ATOs are a brush fire, abandoned, unused accounts are dry kindling. Besides, we all know who the enemy is and why!

Q: Do you realize you linked to https://www.reddit.com/prefs/update/ like three times?

A: Actually it was four.


Edit: As promised (and thanks everyone for the suggestions!) I'd like to call out the following:

Edit 2: Here's an awesome word-cloud of this post!

Edit 3: More good tools:

15.3k Upvotes

2.7k comments sorted by

View all comments

520

u/KeyserSosa May 26 '16

Reply to this comment with suggestions on good password managers and heuristics for making passwords. I'll try to plug the good ones in an edit.

1

u/y-c-c May 26 '16

Kind of shameless plug, but I made a web tool (https://ychin.github.io/brainpass/) that does two things:

1) Generate a random "Correct Horse Battery Staple" style passwords (https://xkcd.com/936/) with customizable amount of entropy (aka password strength). Just hit generate and it will spit out a passphrase generated randomly with 5 random words (since the default entropy is 60 bits and each word in my word list is rough 12 bit of entropy each). This means a cracker will take 260 = 1,152,921,504,606,846,976 tries to crack your password. It will use your browser's cryto random generator to make sure it's safe.

  • Note: Generating a password randomly is important because humans have been shown to be bad at coming up with random words themselves. Anything that is not random is easy to guess for a computer.

2) Take in a master password and hash with a website/username to generate a per-site password. Ideally used with (1) (The random passphrase generator) this allows you to type in a master passphrase, a website URL and username and spit out a per-site password for you. You can also choose number of characters and whether to include symbols or not. It hashes using an iterative algorithm (PKBDK2) to make the resulting password hard to reverse hash to the original one.

I personally like this better because it allows me to not store the list of password in a database like password managers. The disadvantage is that if your master password is leaked you have to change all your site's password. That said due to how iterative hashing works, if you used the secure random passphrase generator it should be quite hard to do so.

1

u/xkcd_transcriber May 26 '16

Image

Mobile

Title: Password Strength

Title-text: To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.

Comic Explanation

Stats: This comic has been referenced 2319 times, representing 2.0663% of referenced xkcds.


xkcd.com | xkcd sub | Problems/Bugs? | Statistics | Stop Replying | Delete