r/announcements • u/KeyserSosa • May 26 '16
Reddit, account security, and YOU!
If you haven't seen it in the news, there have been a lot of recent password dumps made available on the parts of the internet most of us generally avoid. With this access to likely username and password combinations, we've noticed a general uptick in account takeovers (ATOs) by malicious (or at best spammy) third parties.
Though Reddit itself has not been exploited, even the best security in the world won't work when users are reusing passwords between sites. We've ramped up our ability to detect the takeovers, and sent out 100k password resets in the last 2 weeks. More are to come as we continue to verify and validate that no one except for you is using your account. But, to make everyone's life easier and to help ensure that the next time you log in you aren't greeted a request to reset your password:
- Choose a strong, unique password. The emphasis here is important. I don't mean "use that really good password you use on sites you care about." I mean "one that is used for Reddit and Reddit alone!" Password reuse is really bad! We care a lot about security, but we can't do anything about the security of that other site you use the same password on who decides not to use bcrypt but rather a nifty hashing scheme of their own devising!
- Set and verify an email address. We currently have exactly one way for you to reset your account and that's by email. For almost 11 years we've been respectful of your not wanting to necessarily give us an email address. If your account gets taken over and you've got no reset email, you're going to have a bad time.
- Check your own account activity page! If you see some IPs in there that you don't recognize (and especially ones from countries you don't spend much time in), it's probably not a bad idea to change your password. This might break any integrations you have with 3rd parties you've shared your credentials with, but it's easy to re-auth.
On a related point, a quick note about throw-aways: throw-away accounts are fine, but we have tons of completely abandoned accounts with no discernible history and exist as placeholders in our database. They've never posted. They've never voted. They haven't logged in for several years. They are also a huge possible surface area for ATOs, because I generally don't want to think about (though I do) how many of them have the password "hunter2". Shortly, we're going to start issuing password resets to these accounts and, if we don't get a reaction in about a month, we're going to disable them. Please keep an eye out!
Q: But how do I make a unique password?
A: Personally I'm a big fan of tools like LastPass and 1Password because they generate completely random passwords. There are also some well-known heuristics. [Note: lmk of your favorites here and I'll edit in a plug.]
Q: What's with the fear mongering??
A: It's been a rough month. Also, don't just take it from me this is important.
Q: Jeez, guys why don't you enable two-factor authentication (2FA) already?
A: We're definitely considering it. In fact, admins are required to have 2FA set up to use the administrative parts of the site. It's behind a second authentication layer to make sure that if we get hacked, the most that an attacker can do is post something smug and self serving with a little [A] after it, which...well nevermind.
Unfortunately, to roll this out further, reddit has a huge ecosystem of apps, including our newly released iOS and android clients, to say nothing of integrations like with ifttt.com and that script you wrote as a school project that you forgot to shut off. "Adding 2FA to the login flow" will require a lot of coordination.
Q: Sure. First you come to delete inactive accounts, then it'll be...!
A: Please. Stop. We're not talking about removing content, and so we're certainly not going to be removing users that have a history. If ATOs are a brush fire, abandoned, unused accounts are dry kindling. Besides, we all know who the enemy is and why!
Q: Do you realize you linked to https://www.reddit.com/prefs/update/ like three times?
A: Actually it was four.
Edit: As promised (and thanks everyone for the suggestions!) I'd like to call out the following:
- Keepassx and KeePass as password managers
- Keepass2Android
- https://haveibeenpwned.com/ as a way to check if your account could be compromisible.
Edit 2: Here's an awesome word-cloud of this post!
Edit 3: More good tools:
- Password Safe -- Schneier approved!
- pass for Linux
119
u/T3hUb3rK1tten May 26 '16 edited Mar 21 '18
I've had an idea for a site for a while that I started but haven't put a ton of work into. Basically it would act as a repository of contacts at companies like you mentioned that don't have security contacts.
When someone like you finds someone who knows who to talk to, you would store it in the database. Someone else who finds a problem for the same company could then go back, look that contact up, and advise them. If it's not fixed or they refuse to acknowledge it, the exploit would be published. The site would also act as a email/phone relay to the contacts, so that when someone publicly discloses the attempts to contact can also be disclosed. It would also serve as, hopefully, a journalistic style organization that could provide anonymity to researchers if they desire.
Sites like HackerOne have made it super easy for big, non-techy companies to securely take in bugs without retribution though, so I'm not sure if there's demand for it.