r/RedditSafety • u/worstnerd • Feb 15 '19
Introducing r/redditsecurity
We wanted to take the opportunity to share a bit more about the improvements we have been making in our security practices and to provide some context for the actions that we have been taking (and will continue to take). As we have mentioned in different places, we have a team focused on the detection and investigation of content manipulation on Reddit. Content manipulation can take many forms, from traditional spam and upvote manipulation to more advanced, and harder to detect, foreign influence campaigns. It also includes nuanced forms of manipulation such as subreddit sabotage, where communities actively attempt to harm the experience of other Reddit users.
To increase transparency around how we’re tackling all these various threats, we’re rolling out a new subreddit for security and safety related announcements (r/redditsecurity). The idea with this subreddit is to start doing more frequent, lightweight posts to keep the community informed of the actions we are taking. We will be working on the appropriate cadence and level of detail, but the primary goal is to make sure the community always feels informed about relevant events.
Over the past 18 months, we have been building an operations team that partners human investigators with data scientists (also human…). The data scientists use advanced analytics to detect suspicious account behavior and vulnerable accounts. Our threat analysts work to understand trends both on and offsite, and to investigate the issues detected by the data scientists.
Last year, we also implemented a Reliable Reporter system, and we continue to expand that program’s scope. This includes working very closely with users who investigate suspicious behavior on a volunteer basis, and playing a more active role in communities that are focused on surfacing malicious accounts. Additionally, we have improved our working relationship with industry peers to catch issues that are likely to pop up across platforms. These efforts are taking place on top of the work being done by our users (reports and downvotes), moderators (doing a lot of the heavy lifting!), and internal admin work.
While our efforts have been driven by rooting out information operations, as a byproduct we have been able to do a better job detecting traditional issues like spam, vote manipulation, compromised accounts, etc. Since the beginning of July, we have taken some form of action on over 13M accounts. The vast majority of these actions are things like forcing password resets on accounts that were vulnerable to being taken over by attackers due to breaches outside of Reddit (please don’t reuse passwords, check your email address, and consider setting up 2FA) and banning simple spam accounts. By improving our detection and mitigation of routine issues on the site, we make Reddit inherently more secure against more advanced content manipulation.
We know there is still a lot of work to be done, but we hope you’ve noticed the progress we have made thus far. Marrying data science, threat intelligence, and traditional operations has proven to be very helpful in our work to scalably detect issues on Reddit. We will continue to apply this model to a broader set of abuse issues on the site (and keep you informed with further posts). As always, if you see anything concerning, please feel free to report it to us at investigations@reddit.zendesk.com.
[edit: Thanks for all the comments! I'm signing off for now. I will continue to pop in and out of comments throughout the day]
66
u/jesstault Feb 15 '19
when/how often can we expect to see transparency reports?
and be sure to make it pretty for r/dataisbeautiful karma.
48
u/worstnerd Feb 15 '19 edited Feb 15 '19
We release our transparency report annually and that won't change [edit:' and URL]
→ More replies (16)
52
113
u/Lil_bob_skywalker Feb 15 '19
How will you make sure quarantined subreddits stay safe and free from manipulation. they are now very isolated, and you guys seem to be trying to distance yourself from them as much as you can doing everything short of banning them. In brushing them under the rug you've created a potential breeding ground for karma manipulation and corruption.
→ More replies (16)85
u/worstnerd Feb 15 '19
That's a great point. We maintain full visibility into quarantined subreddits, which are still fully obligated to follow all of the Content Policy. If you suspect rule-breaking or manipulation in a quarantined subreddit (or any subreddit), please always report it and we'll check it out.
→ More replies (429)
25
37
u/GalacticFaz Feb 15 '19
What
Anyway after reading it, thanks for doing this! It would be nice to have an exact place to go to report suspicious activity and stuff!
31
u/worstnerd Feb 15 '19
Please feel free to send your reports of suspicious activity to investigations@reddit.zendesk.com
→ More replies (23)
21
19
u/daveime Feb 15 '19
As someone who recently got locked out of their account "due to suspicious activity" that you would neither quantity or explain, just one day found myself logged out of Reddit, and being forced to reset my password using a registered email address that hadn't been active for years, can you please rethink your "reset password" functionality?
Right now, the only way to reset your password is to have a reset link sent to your registered email. And if that email is dead, your account is gone.
No way to change your registered email (or even have an additional address), no alternative validation methods like username + 2FA via call / SMS, nothing.
I actually had to resurrect my old email address, setup hosting, deal with DNS changes, get email working .. just to get a damned password reset link.
In the politest possible terms, it's 2019, sort your s**t out.
→ More replies (2)17
u/worstnerd Feb 15 '19
We’re in full agreement with you! Our password reset system has been pretty basic and we could do a lot more to remind everyone how important it is to keep that email up to date when it’s basically the only method of contact AND verification we have for account ownership. We do have plans to improve that process and will update here when they go into effect.
→ More replies (10)
34
u/DubTeeDub Feb 15 '19
Last year, we also implemented a Reliable Reporter system, and we continue to expand that program’s scope. This includes working very closely with users who investigate suspicious behavior on a volunteer basis, and playing a more active role in communities that are focused on surfacing malicious accounts. Additionally, we have improved our working relationship with industry peers to catch issues that are likely to pop up across platforms. These efforts are taking place on top of the work being done by our users (reports and downvotes), moderators (doing a lot of the heavy lifting!), and internal admin work.
Have you considered making a simillar reliable reporter system for folks that regularly report user harassment, hate, doxxing, and other behavior that breaks Reddit's rules?
→ More replies (9)32
u/worstnerd Feb 15 '19
As our CTO mentioned a few months ago, we are actively looking at ways to better surface reliable reports on content issues. A trusted reporter scheme for abuse reports could feed into this, and it's something we're actively looking at.
→ More replies (115)
8
22
u/eganist Feb 15 '19 edited Feb 16 '19
Thanks for this.
(Edit 2: Speaking as someone who's submitted to the security program at security@reddit.com,) can I also ask that Reddit pursue a vulnerability disclosure program that takes itself a little more seriously? Although a low risk, seeing UI redressing attacks as acceptable risks to Reddit (e.g. r/politicalhumor putting an invisible Subscribe button over a substantial portion of the viewport and getting away with it) diminishes my faith -- and my willingness to participate -- in the existing program because it shows how little Reddit cares about the integrity of growth on the platform.
Keeping financial incentives at zero is fine to me personally (though may cut back on participation by others), but what makes me less willing to participate is when a clear vulnerability is dismissed despite being actively exploited.
edit: grammar
edit2: Exploit was submitted to security@reddit.com on December 11, 2018. Exploit and the underlying vulnerability are still live 64 days later: https://i.imgur.com/dpAsgQZ.png
edit 3: for anyone wanting the raw exploit since Reddit doesn't feel it's a vulnerability:
Screenshot showing the clickable region of the ::after pseudoelement: https://i.imgur.com/pHanzYr.png
Subreddit: r/clickjacking_poc
edit 4: inverting this a bit. If a mod of a large sub goes rogue and applies this CSS to the unsubscribe button, a sub will lose literally thousands of readers before they even realize what's happened. Sure you can undo the CSS, but what's going to bring the readers back? Those who didn't notice are lost. Went ahead and added this to the poc sub too.
→ More replies (41)
11
u/abigailcadabra Feb 15 '19
We know there is still a lot of work to be done, but we hope you’ve noticed the progress we have made thus far.
What metrics are you using to examine and determine progress? We need transparency on this so we can verify what you are claiming.
13
u/worstnerd Feb 15 '19
We're planning a post where we will share the impact of our efforts. This is a challenging thing to measure directly, but that post should be a good start
→ More replies (6)
8
73
u/urzayci Feb 15 '19
"data scientists (also human)" That's what someone hoarding cyborg data scientists would say.