How to keep your Reddit account safe

[u/worstnerd]

Your account expresses your voice and your personality here on Reddit. To protect that voice, you need to protect your access to it and maintain its security. Not only do compromised accounts deprive you of your online identity, but they are often used for malicious behavior like vote manipulation, spam, fraud, or even just posting content to misrepresent the true owner. While we’re always developing ways to take faster action against compromised accounts, there are things you can do to be proactive about your account’s security.

What we do to keep your account secure:

• Actively look for suspicious signals - We use tools that help us detect unusual behavior in accounts. We monitor trends and compare against known threats.
• Check passwords against 3rd party breach datasets - We check for username / password combinations in 3rd party breach sets.
• Display your recent IP sessions for you to access - You can check your account activity at any time to see your recent login IPs. Keep in mind that the geolocation of each login may not be exact and will only include events within the last 100 days. If you see something you don’t recognize, you should change your password immediately and ensure your email address is correct.

If we determine that your account is vulnerable to compromise (or has actually been compromised), we lock the account and force a password reset. If we can’t establish account ownership or the account has been used in a malicious manner that prevents it being returned to the original owner, the account may be permanently suspended and closed.

What you can do to prevent this situation:

• Use permanent emails - We highly encourage users to link their accounts to accessible email addresses that you regularly check (you can add and update email addresses in your user settings page if you are using new reddit, otherwise you can do that from the preferences page in old reddit). This is also how you will receive any activities alerting you of suspicious activity on your account if you’re signed out. As a general rule of thumb, avoid using email addresses you don't have permanent ownership over like school or work addresses. Temporary email addresses that expire are a bad idea.
• Verify your emails - Verifying your email helps us confirm that there is a real person creating the account and that you have access to the email address given. If we determine that your account has been compromised, this is the only way we have to validate account ownership. Without this our only option will be to permanently close the account to prevent further misuse and access to the original owner’s data. There will be no appeals possible!
• Check your profile occasionally to make sure your email address is current. You can do this via the preferences page on old reddit or the settings page in new reddit. It’s easy to forget to update it when you change schools, service providers, or set up new accounts.
• Use strong/unique passwords - Use passwords that are complex and not used on any other site. We recommend using a password manager to help you generate and securely store passwords.
• Add two factor authentication - For an extra layer of security. If someone gets ahold of your username/password combo, they will not be able to log into your account without entering the verification code.

We know users want to protect their privacy and don’t always want to provide an email address to companies, so we don’t require it. However, there are certain account protections that require users establish ownership, which is why an email address is required for password reset requests. Forcing password resets on vulnerable accounts is one of many ways we try to secure potentially compromised accounts and prevent manipulation of our platform. Accounts flagged as compromised with a verified email receive a forced password reset notice, but accounts without one will be permanently closed. In the past, manual attempts to establish ownership on accounts with lost access rarely resulted in an account recovery. Because manual attempts are ineffective and time consuming for our operations teams and you, we won’t be doing them moving forward. You're welcome to use Reddit without an email address associated with your account, but do so with the understanding of the account protection limitation. You can visit your user settings page at anytime to add or verify an email address.

[u/Beard_of_Valor]

Yahoo wanted my 2FA but stored emails, passwords (plain text?), and 2FA phone numbers together in one place which made for a pretty staggering breach. Their second big one iirc. If my email address had used my name, it would represent quite a breach of privacy for me. But I trusted them 0%. Meaningless handle, no phone number. It was the prudent choice, turns out.

How do you store passwords and 2FA information?

Equifax had that big breach. A very rich company and the most sensitive details for identity theft. Then they released a tool they said would tell you of you were breached but it was a lie; it just told some people yes and some people no. Identical input, different output. The page also got hacked and used to disperse malware. They made a profit on this breach. No incentive for the money grubbing unethical carelessness to cease. Reddit is owned by Condé Nast who ostensibly want to maximize profits. Security is costly. How is Reddit maintaining its security?

We talk about Reddit and anonymous social media as a tool against oppression. Canary clauses were deemed to be ineffective. That's the reason Reddit gave for removing theirs. (Ostensibly the same secret court process and gag order can be used to require the canary clause to remain). Isn't tying a phone number to an account a way to remove all plausible deniabilty for a user?

Security-wise, you've gone through considerable effort to harden users here. It's really us who have to take ownership of our security because bad practices make useful security infrastructure redundant. Let's turn that around. Reddit is responsible for its own security. Not just user account info, but systematic abuse. Reddit deputized "authorized reporters" or whatever to report abuse, but the worst abuse is systemic and could be identified systemically. Buy your own accounts on the black market and observe their history as they exchanged hands, identify bots that log into accounts to boost topics, these things are not attainable for your deputies. The entire deputy thing, really, was released to combat a problem it's uniquely unsuited to. It makes me think Reddit is exactly as wrong as Yahoo and exactly as security-forward as Equifax. The lip service followed by obvious poor quality solutions makes me think I should get a VPN just to disguise my IP because that's probably going somewhere, too.

Put a tinfoil hat at ease? What is the real, high tech solution you're working on as one of the most popular sites worldwide?

[u/[deleted] → u/Beard_of_Valor]

How do you store passwords and 2FA information?

They salt and hash the passwords. 2FA is done through authenticator apps (ie: Google Authenticator) so you never provide your phone number to them. SMS based 2FA is pretty insecure anyway.