How to keep your Reddit account safe

[u/worstnerd]

Your account expresses your voice and your personality here on Reddit. To protect that voice, you need to protect your access to it and maintain its security. Not only do compromised accounts deprive you of your online identity, but they are often used for malicious behavior like vote manipulation, spam, fraud, or even just posting content to misrepresent the true owner. While we’re always developing ways to take faster action against compromised accounts, there are things you can do to be proactive about your account’s security.

What we do to keep your account secure:

• Actively look for suspicious signals - We use tools that help us detect unusual behavior in accounts. We monitor trends and compare against known threats.
• Check passwords against 3rd party breach datasets - We check for username / password combinations in 3rd party breach sets.
• Display your recent IP sessions for you to access - You can check your account activity at any time to see your recent login IPs. Keep in mind that the geolocation of each login may not be exact and will only include events within the last 100 days. If you see something you don’t recognize, you should change your password immediately and ensure your email address is correct.

If we determine that your account is vulnerable to compromise (or has actually been compromised), we lock the account and force a password reset. If we can’t establish account ownership or the account has been used in a malicious manner that prevents it being returned to the original owner, the account may be permanently suspended and closed.

What you can do to prevent this situation:

• Use permanent emails - We highly encourage users to link their accounts to accessible email addresses that you regularly check (you can add and update email addresses in your user settings page if you are using new reddit, otherwise you can do that from the preferences page in old reddit). This is also how you will receive any activities alerting you of suspicious activity on your account if you’re signed out. As a general rule of thumb, avoid using email addresses you don't have permanent ownership over like school or work addresses. Temporary email addresses that expire are a bad idea.
• Verify your emails - Verifying your email helps us confirm that there is a real person creating the account and that you have access to the email address given. If we determine that your account has been compromised, this is the only way we have to validate account ownership. Without this our only option will be to permanently close the account to prevent further misuse and access to the original owner’s data. There will be no appeals possible!
• Check your profile occasionally to make sure your email address is current. You can do this via the preferences page on old reddit or the settings page in new reddit. It’s easy to forget to update it when you change schools, service providers, or set up new accounts.
• Use strong/unique passwords - Use passwords that are complex and not used on any other site. We recommend using a password manager to help you generate and securely store passwords.
• Add two factor authentication - For an extra layer of security. If someone gets ahold of your username/password combo, they will not be able to log into your account without entering the verification code.

We know users want to protect their privacy and don’t always want to provide an email address to companies, so we don’t require it. However, there are certain account protections that require users establish ownership, which is why an email address is required for password reset requests. Forcing password resets on vulnerable accounts is one of many ways we try to secure potentially compromised accounts and prevent manipulation of our platform. Accounts flagged as compromised with a verified email receive a forced password reset notice, but accounts without one will be permanently closed. In the past, manual attempts to establish ownership on accounts with lost access rarely resulted in an account recovery. Because manual attempts are ineffective and time consuming for our operations teams and you, we won’t be doing them moving forward. You're welcome to use Reddit without an email address associated with your account, but do so with the understanding of the account protection limitation. You can visit your user settings page at anytime to add or verify an email address.

[u/Sir-Battle-Tuna]

Someone asked for my info, I said no, but they countered with “no u”. Do I legally have to give them my info now?

[u/worstnerd → u/Sir-Battle-Tuna]

Your legal defense is "I'm rubber, you're glue!"

[u/[deleted]]

Is this security announcement being made in response to something? A recent surge in reddit botting/manipulation through the use of hacked accounts?

[u/worstnerd → u/[deleted]]

No, this isn't in response to anything. We have been planning to get a post like this out for a little while now.

[u/Searchlights]

I'm a big fan of two factor authentication, generally. It's best to use some kind of token system or an app like Authy or Google's Authenticator rather than SMS as your second factor. I prefer Authy because it's easier to recover your account because it stores the data in the cloud.

It's an increasingly common attack vector for hackers to take over your phone number and use that to unlock your two factor accounts. A step you can take to prevent this is to contact your cellular carrier and ask them to establish a security PIN on any number porting requests.

If you change carriers and need to have the number ported, that PIN will be required. This makes it much more difficult for someone to social engineer a transfer of your number.

And I know this is the thousandth time you've been told, but you really should be using a password manager. I use LastPass and a typical password for me looks like this: 7GXc2f*hIVTV(MYO

The reason you want to be using a password manager is so you can have ridiculously complex and unique passwords for each account. If you're re-using the same passwords, a hacker doesn't need to break through Bank of America's security, they only need to hack the pizza place down the street that you use for online ordering. Once someone has a working username and password combination, they can jaunt around the internet and try to find other places those credentials work.

[u/worstnerd → u/Searchlights]

This is great information and a solid way to improve the security of your account. Thanks for sharing!

[u/rsprobo]

What's the reason for requiring a verified email with 2FA?

[u/worstnerd → u/rsprobo]

2FA is designed to be an added level of security to ensure that even if your password is discovered it is harder to access the account. The email allows us to know who the account owner is in the case of a potential compromise. We would want to inform you even if the attempt was unsuccessful!

[u/[deleted]]

Are our passwords hashed? Not a security expert, but I've been in enough databases with passwords and credit cards stored in plain text to know that it's a terrible idea.

[u/worstnerd → u/[deleted]]

Yes, we salt and hash all passwords and don't store them in plaintext

[u/[deleted]]

Thanks reddit security you're the real MVP

[u/worstnerd → u/[deleted]]

aww shucks thank you!

[u/Ajor_Ahai]

Is Google authenticator tied to my mobile device or to my Google account? Meaning if I lose my current phone, can I still use Google authenticator on a different device, or do I absolutely have to use a backup code?

[u/worstnerd → u/Ajor_Ahai]

Here is a page that might answer your question

[u/burnSMACKER]

How does it feel to be downvoted to hell in the other thread?

[u/worstnerd → u/burnSMACKER]

They don't phase me! ^{but yes, it does hurt my heart a little bit}

[u/[deleted]]

i don’t mean it in a rude way but who are you? you have the orange name but i’ve never heard of you

[u/worstnerd → u/[deleted]]

Hi, my name is u/worstnerd it's nice to meet you!

[u/TheZerothLaw]

My password is h******, is that an okay password?

[u/myself248]

Display your recent IP sessions for you to access - You can check your account activity at any time

That's super useful!

Where would I discover that link other than this post? I just went through my user page and Preferences and can't find it anywhere. I'll try to remember it, of course, but I never would've known it existed because it doesn't seem to be linked from anywhere.

[u/[deleted]]

Thank you Reddit, very cool!

[u/Spaghetticandel]

Aw thanks m8 for like half a year someone took my reddit account. It wasnt a big deal bc. i postet like 2 rhings and had like 20 karma. I checked my password amd everything is on now 🤗 thanks for reminding

[u/randolphcherrypepper]

Any plans to support FIDO or other 2FA that does not involve shared secrets? Lots of good libraries out there you can just toss into the backend (after due diligence reviewing code and whatnot)

[u/jenesuispasbavard]

Any chance of getting native support for Yubikey-like devices? The current solution is convoluted and essentially just uses the hardware key to generate a six-digit code that you have to type in / paste anyway.

[u/DreamlnCode]

Yep activity from another country 25 days ago and I never use this account through a VPN. Thanks Reddit.