Thursday, May 26, 2016 2:09:00 PM
Though Reddit itself has not been exploited, even the best security in the world won't work when users are reusing passwords between sites. We've ramped up our ability to detect the takeovers, and sent out 100k password resets in the last 2 weeks. More are to come as we continue to verify and validate that no one except for you is using your account. But, to make everyone's life easier and to help ensure that the next time you log in you aren't greeted a request to reset your password:
Choose a strong, unique password. The emphasis here is important. I don't mean "use that really good password you use on sites you care about." I mean "one that is used for Reddit and Reddit alone!" Password reuse is really bad! We care a lot about security, but we can't do anything about the security of that other site you use the same password on who decides not to use bcrypt but rather a nifty hashing scheme of their own devising!
Set and verify an email address. We currently have exactly one way for you to reset your account and that's by email. For almost 11 years we've been respectful of your not wanting to necessarily give us an email address. If your account gets taken over and you've got no reset email, you're going to have a bad time.
Check your own account activity page! If you see some IPs in there that you don't recognize (and especially ones from countries you don't spend much time in), it's probably not a bad idea to change your password. This might break any integrations you have with 3rd parties you've shared your credentials with, but it's easy to re-auth.
On a related point, a quick note about throw-aways: throw-away accounts are fine, but we have tons of completely abandoned accounts with no discernible history and exist as placeholders in our database. They've never posted. They've never voted. They haven't logged in for several years. They are also a huge possible surface area for ATOs, because I generally don't want to think about (though I do) how many of them have the password "hunter2". Shortly, we're going to start issuing password resets to these accounts and, if we don't get a reaction in about a month, we're going to disable them. Please keep an eye out!
Q: But how do I make a unique password?
A: Personally I'm a big fan of tools like LastPass and 1Password because they generate completely random passwords. There are also some well-known heuristics. [Note: lmk of your favorites here and I'll edit in a plug.]
Q: What's with the fear mongering??
A: It's been a rough month. Also, don't just take it from me this is important.
Q: Jeez, guys why don't you enable two-factor authentication (2FA) already?
A: We're definitely considering it. In fact, admins are required to have 2FA set up to use the administrative parts of the site. It's behind a second authentication layer to make sure that if we get hacked, the most that an attacker can do is post something smug and self serving with a little [A] after it, which...well nevermind.
Unfortunately, to roll this out further, reddit has a huge ecosystem of apps, including our newly released iOS and android clients, to say nothing of integrations like with iffft.com and that script you wrote as a school project that you forgot to shut off. "Adding 2FA to the login flow" will require a lot of coordination.
Q: Sure. First you come to delete inactive accounts, then it'll be...!
A: Please. Stop. We're not talking about removing content, and so we're certainly not going to be removing users that have a history. If ATOs are a brush fire, abandoned, unused accounts are dry kindling. Besides, we all know who the enemy is and why!
Q: Do you realize you linked to https://www.reddit.com/prefs/update/ like three times?
A: Actually it was four.
Recent ZRFY News
- Form NT 10-Q - Notification of inability to timely file Form 10-Q or 10-QSB • Edgar (US Regulatory) • 05/16/2024 07:03:19 PM
VHAI - Vocodia Partners with Leading Political Super PACs to Revolutionize Fundraising Efforts • VHAI • Sep 19, 2024 11:48 AM
Dear Cashmere Group Holding Co. AKA Swifty Global Signs Binding Letter of Intent to be Acquired by Signing Day Sports • DRCR • Sep 19, 2024 10:26 AM
HealthLynked Launches Virtual Urgent Care Through Partnership with Lyric Health. • HLYK • Sep 19, 2024 8:00 AM
Element79 Gold Corp. Appoints Kevin Arias as Advisor to the Board of Directors, Strengthening Strategic Leadership • ELMGF • Sep 18, 2024 10:29 AM
Mawson Finland Limited Further Expands the Known Mineralized Zones at Rajapalot: Palokas step-out drills 7 metres @ 9.1 g/t gold & 706 ppm cobalt • MFL • Sep 17, 2024 9:02 AM
PickleJar Announces Integration With OptCulture to Deliver Holistic Fan Experiences at Venue Point of Sale • PKLE • Sep 17, 2024 8:00 AM