11 ms·

>While Reddit also suggests that updating passwords every couple of months is a good idea, as well as using a password manager, that's not advice most security

>While Reddit also suggests that updating passwords every couple of months is a good idea, as well as using a password manager, that's not advice most security professionals would currently condone. Changing passwords regularly, that is, not password manager usage. What inelegant phrasing. Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for your profile, there's no benefit to the user to have an old account with lots of karma. Just keep re-rolling with strong random passwords and you have nothing to lose.

MildlySerious 4y ago
The last time I tried to change the password of a reddit account I lost access to it. I attempted to change the password, got an error saying something went wrong. I figured I'd try again later. so I also didn't save the newly generated password. Got logged out, and couldn't log back in with the old password. And there's no way that I know of to contact anyone at reddit to try and get help.
- djbusby 4y ago
  Try the Forgot Password link?
  - MildlySerious 4y ago
    The email provider that account was tied to doesn't exist anymore, and the domain is taken. I didn't notice until after it happened, so I am not putting all the blame on reddit. It's more of a string of unlucky circumstances. Who knows if I could have even changed it without access to the email account, anyway. Fun fact: Reddit for the longest time didn't require an email address to create accounts.
    - ridgered4 4y ago
      Reddit still doesn't require an email to create accounts, even if it now heavily implies it does. Just click next without entering one.
ttctciyf 4y ago
Even if I don't want to throw my reddit account away as such, it's hard for me to imagine ever thinking I'd care more about its security than I would about not giving Reddit my phone contact!
- Verdex 4y ago
  Yeah, this was my first reaction. <Reddit hacked> "Huh, I guess I better change my password." <Recommends TFA> "Hmm, give reddit my phone number .... no."
  - pwildani 4y ago
    Reddit's TFA is not phone number based. You use a one time password generator.
  - sjagoe 4y ago
    No need for phone number, they just give you a TOTP private key you can use in Google Authenticator or something like that.
- webdoodle 4y ago
  Yep. Looking forward to buying /u/maxwellhill off the dark web, so we can read all those private messages, and finally put to rest all the speculation of it being Ghislaine Maxwell's account (which went dark the day she was arrested).
wycy 4y ago
> there's no benefit to the user to have an old account I used to think so until I decided to reroll my old account into a new one, and it was such a pain re-subscribing to all my subreddits again.
- flandish 4y ago
  That seems like a solvable thing with a 3rd party app/script. I reroll every time I am banned from a sub I like because that sub notices I play in other subs - that whole “thing” is horseshit to me. So I just reroll to get around that autoban bot.
  - wycy 4y ago
    Do you happen to have a script for this? If so, I’d love to have it as it’s about time I reroll too.
    - flandish 4y ago
      No, but I have thought about trying to make one. Hrm.
- codq 4y ago
  See, I don’t mind this process. It gives you a chance to re-evaluate what is actually giving you value. It’s like spring cleaning. It’s the same reason I enjoy setting up a new or freshly reformatted phone or laptop. Feels good to clean out the cobwebs.
- user764743 4y ago
  Just create a mutlireddit of your subscriptions by going on https://old.reddit.com/subreddits/ https://old.reddit.com/subreddits/ and clicking 'multireddit of your subscriptions' on the right. Bookmark that link and voila, you have a backup of your subreddits for your new account.
zulban 4y ago
Nothing to lose..? Old and popular reddit accounts are worth more when sold for a reason. If I'm sharing an idea or business update, it's useful to show mods and algorithms that I'm a decade old user and not a bot created this month.
- oauea 4y ago
  If you're a spammer then yeah, there's value to be had. But for moral people there really isn't any.
  - andybak 4y ago
    I'm mostly a "moral person" whatever that means and I disagree. My Reddit account has value to me for multiple reasons.
EVa5I7bHFq9mnYK 4y ago
>> to treat online accounts as throwaway wherever possible works for me everywhere except HN, because of the silly requirement of 500 karma to be able to downvote.
grapesurgeon 4y ago
[dead]
adolph 4y ago
many ephemeral identities, treated like cattle
throwA29B 4y ago
This. 2FA (implying a phone number which is most likely most important number in your life) for a link sharing web site? You must be joking.
- chimeracoder 4y ago
  > This. 2FA (implying a phone number which is most likely most important number in your life) for a link sharing web site? You must be joking. SMS is no longer recommended as a means of 2FA, as it's very vulnerable. Some sites still rely on it, unfortunately. However, it appears Reddit does support TOTP.
  - throwA29B 4y ago
    Somehow this reminds me of a wise saying: "Every problem in CS can be solved by adding level of indirection. Except for the problem of excessive number of indirections".
  - crest 4y ago
    They do, but TOTP is only as secure as the seed stored by reddit.
unshavedyak 4y ago
> Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for your profile, there's no benefit to the user to have an old account with lots of karma. Just keep re-rolling with strong random passwords and you have nothing to lose. I (used to, i guess) do the same. I must have 40 accounts in total over the years. Funny enough i didn't even make a strong password - a stupidly bad one, unique for each account, actually. I had almost hoped it was hacked because it would be interesting to be hacked and not care.
kahrl 4y ago
Reads like an 8th grader's report trying to meet the teacher's word count.
- dobbysfirstsock 4y ago
  I've actually noticed how _bad_ the writing of some articles can be. I'm not a good writer by any means... but the best I can say is it sounds like an essay cranked out by someone in high school. Just reminded me of my first "wtf." A journalist for our local university wrote a review for the movie "Hustlers" where they justified sexually assaulting and robbing men in New York because "men in New York were responsible for the 2008 financial crisis." All without missing a beat. Can't believe what passes these days.
  - sleepybrett 4y ago
    When you find out how little these writers are paid you can understand the amount of effort they can put into these articles and still make enough money to eat.
    - dobbysfirstsock 4y ago
      Well, seems there's more people wanting to write than demand.
jefftk 4y ago
> What inelegant phrasing. Reddit's own phrasing is much better: Since we’re talking about security and safety, this is a good time to remind you how to protect your Reddit account. The most important (and simple) measure you can take is to set up 2FA (two-factor authentication) which adds an extra layer of security when you access your Reddit account. Learn how to enable 2FA in Reddit Help. And if you want to take it a step further, it’s always a good idea to update your password every couple of months – just make sure it’s strong and unique for greater protection. Also: use a password manager! Besides providing great complicated passwords, they provide an extra layer of security by warning you before you use your password on a phishing site… because the domains won’t match! -- https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_security_incident_heres_what_we_know/ https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_se...
netule 4y ago
If you use the old/classic Reddit experience and you can't find the option to enable 2FA in your profile, use this URL directly instead: https://www.reddit.com/2fa/enable/ https://www.reddit.com/2fa/enable/
cragfar 4y ago
That's how most treat it. Just go to any thread even 3 months old and 1/4th of the users are deleted.
game_the0ry 4y ago
Personally, I start by not trusting platforms - pw manager and 2fa all the way, never re-using passwords. I also use bitwarded - open source ftw.
Tepix 4y ago
These days it seems you should change your password (and your 2FA token) every now and then not because you are the one getting hacked but the sites you sign up at.
dghughes 4y ago
That's a good idea and I've thought about it but I think many feel attached to their usernames and account history "15 yeas with.." site X. And sites often balk and say "username or email already has an account here". It's a bit funny since alias was meant to hide who you were or at least make ire less formal than a person's full name. Then I go and use my name for an alias!
- yreg 4y ago
  The "don't use your real name on the internet" advice wasn't great. When I set up a Google account as a kid I used a made up handle because all the adults told me to not use my name on the internet. Decades later and it's still my main account and I often need to either switch accounts to the one with my real name or embarassingly ask people to invite my nickname account to various shared documents, calendars, etc. No way to migrate my YouTube channel either…
  - adolph 4y ago
    In the time that has passed since that advice better name generators have been developed so you don't have to make something up. https://github.com/moby/moby/blob/master/pkg/namesgenerator/names-generator.go https://github.com/moby/moby/blob/master/pkg/namesgenerator/...
  - Dalewyn 4y ago
    What's embarrassing about a nickname? Having a disconnected online entity means less-than-pleasant jackasses can't pull something from years or even decades ago, put it out of context, and proceed to troll your life. Not putting your real life identity on public display for the world to see means you maintain tighter control over how, when, and where your information gets out. Do you really need your real name, face, place of employment, telephone number, email address (with your name in it), and maybe even your home address publicized? More than likely you don't. Having online identities disconnected from real life means you can use them to safeguard your actually really-fucking-important real life things. Your bank account? Use an email that uses a nickname instead of your real name so any would be hackers have to second guess your email too. Worst comes to shove and shit hits the fan, you can throw away an online identity and make another one. You can't throw away your real name and face. There are nothing but benefits by keeping your online and real life identities separate, and if you ask me it's one of the first steps to being truly internet literate.
yreg 4y ago
Just FYI while they suggest updating passwords they also claim that user accounts are safe at this time.
kingcobraninja 4y ago
>there's no benefit to the user to have an old account with lots of karma Some subs have a minimum amount age or karma requirement to post. This is ostensibly to combat bots.
- hgsgm 4y ago
  Those are very low thresholds.
  - onionisafruit 4y ago
    You are right, but it is still annoying when cycling accounts.
    - pixl97 4y ago
      Yea, you have to precycle effectively and create accounts before hand and let them build at least a small amount of karma. These days I don't even log into reddit. After wide spread banning from subreddits for random reasons it's not worthwhile. I'll keep browsing old.red as long as it exists but if it goes away I'll DNS block all reddit at the router.
jefftk 4y ago
> treat online accounts as throwaway wherever possible I don't need to know who you actually are, but over time interacting with other people here I've started to get a feel for several hundred accounts. This makes HN more pleasant because I have some sense of what sort of person they are to talk with, and what is likely to go well or poorly. When there have been subreddits I was really into, I would start to get a sense for the more prolific commenters there too. If I regularly attended some sort of social club and it was common for people to replace their faces I would find it frustrating as well.
- devnullbrain 4y ago
  If I attended a social club and my comments from 10 years ago were permanently engraved on the walls, I'd be much less honest and open.
  - hgsgm 4y ago
    You can use alts and delete old comments.
    - andybak 4y ago
      Yeah. Let's delete old blogs and shut down the internet archive as well. Personally I value the web as a knowledge store that persists. Use a non-logged chat service if you want a transient medium.
      - grapesurgeon 4y ago
        [dead]
    - devnullbrain 4y ago
      There's no deleting beyond a time limit on HN
      - tough 4y ago
willis936 4y ago
We're in a crisis of trust. "You have nothing to lose" is wrong. You and the community both have something to lose if identity is not valued. A throwaway is indistinct from a bot paid for by some rich mustache-twirling billionaire or state actor trying to control narrative.
- TEP_Kim_Il_Sung 4y ago
  The internet was always about judging the content and quality of user's posts/comments, while being unaware of their race, sex, origin, religion, and any other traits they didn't explicitly mention. Nowhere else can you have in-depth technical discussions about the implications of Humean Projectivism on p2p network architecture, with a cybernetic dragonfly, a flying squirrel, and with distracting interjections by a literal fantasy troll. A bit of personal QA/QC, and individual filtering options, are all you need. Anything else is just censorious control of the narrative.
  - s3p 4y ago
    Yes I agree. This just emphasizes OP's point about how we can't make these accounts throwaway as there would be no content to judge.
    - Buttons840 4y ago
      You judge each comment by its own merits. Online forums like HN are a source of ideas, not necessarily correct ideas.
      - pixl97 4y ago
        Eh in many ways that is not how humans work. We tend to build close in groups with higher trust level, because not trusting everything any anyone is physically and mentally exhausting. If you met a person that behaved in this manner in real life most people would conclude they had a mental illness or were an abuse victim.

MildlySerious 4y ago

The last time I tried to change the password of a reddit account I lost access to it. I attempted to change the password, got an error saying something went wrong. I figured I'd try again later. so I also didn't save the newly generated password. Got logged out, and couldn't log back in with the old password. And there's no way that I know of to contact anyone at reddit to try and get help.

djbusby 4y ago
Try the Forgot Password link?
- MildlySerious 4y ago
  The email provider that account was tied to doesn't exist anymore, and the domain is taken. I didn't notice until after it happened, so I am not putting all the blame on reddit. It's more of a string of unlucky circumstances. Who knows if I could have even changed it without access to the email account, anyway. Fun fact: Reddit for the longest time didn't require an email address to create accounts.
  - ridgered4 4y ago
    Reddit still doesn't require an email to create accounts, even if it now heavily implies it does. Just click next without entering one.

ttctciyf 4y ago

Even if I don't want to throw my reddit account away as such, it's hard for me to imagine ever thinking I'd care more about its security than I would about not giving Reddit my phone contact!

Verdex 4y ago
Yeah, this was my first reaction. <Reddit hacked> "Huh, I guess I better change my password." <Recommends TFA> "Hmm, give reddit my phone number .... no."
- pwildani 4y ago
  Reddit's TFA is not phone number based. You use a one time password generator.
- sjagoe 4y ago
  No need for phone number, they just give you a TOTP private key you can use in Google Authenticator or something like that.
webdoodle 4y ago
Yep. Looking forward to buying /u/maxwellhill off the dark web, so we can read all those private messages, and finally put to rest all the speculation of it being Ghislaine Maxwell's account (which went dark the day she was arrested).

wycy 4y ago

> there's no benefit to the user to have an old account I used to think so until I decided to reroll my old account into a new one, and it was such a pain re-subscribing to all my subreddits again.

flandish 4y ago
That seems like a solvable thing with a 3rd party app/script. I reroll every time I am banned from a sub I like because that sub notices I play in other subs - that whole “thing” is horseshit to me. So I just reroll to get around that autoban bot.
- wycy 4y ago
  Do you happen to have a script for this? If so, I’d love to have it as it’s about time I reroll too.
  - flandish 4y ago
    No, but I have thought about trying to make one. Hrm.
codq 4y ago
See, I don’t mind this process. It gives you a chance to re-evaluate what is actually giving you value. It’s like spring cleaning. It’s the same reason I enjoy setting up a new or freshly reformatted phone or laptop. Feels good to clean out the cobwebs.
user764743 4y ago
Just create a mutlireddit of your subscriptions by going on https://old.reddit.com/subreddits/ https://old.reddit.com/subreddits/ and clicking 'multireddit of your subscriptions' on the right. Bookmark that link and voila, you have a backup of your subreddits for your new account.

zulban 4y ago

Nothing to lose..? Old and popular reddit accounts are worth more when sold for a reason. If I'm sharing an idea or business update, it's useful to show mods and algorithms that I'm a decade old user and not a bot created this month.

oauea 4y ago
If you're a spammer then yeah, there's value to be had. But for moral people there really isn't any.
- andybak 4y ago
  I'm mostly a "moral person" whatever that means and I disagree. My Reddit account has value to me for multiple reasons.

EVa5I7bHFq9mnYK 4y ago

>> to treat online accounts as throwaway wherever possible works for me everywhere except HN, because of the silly requirement of 500 karma to be able to downvote.

grapesurgeon 4y ago

[dead]

adolph 4y ago

many ephemeral identities, treated like cattle

throwA29B 4y ago

This. 2FA (implying a phone number which is most likely most important number in your life) for a link sharing web site? You must be joking.

chimeracoder 4y ago
> This. 2FA (implying a phone number which is most likely most important number in your life) for a link sharing web site? You must be joking. SMS is no longer recommended as a means of 2FA, as it's very vulnerable. Some sites still rely on it, unfortunately. However, it appears Reddit does support TOTP.
- throwA29B 4y ago
  Somehow this reminds me of a wise saying: "Every problem in CS can be solved by adding level of indirection. Except for the problem of excessive number of indirections".
- crest 4y ago
  They do, but TOTP is only as secure as the seed stored by reddit.

unshavedyak 4y ago

> Another option is to treat online accounts as throwaway wherever possible. As much as Reddit would like to sell you gizmos for your profile, there's no benefit to the user to have an old account with lots of karma. Just keep re-rolling with strong random passwords and you have nothing to lose. I (used to, i guess) do the same. I must have 40 accounts in total over the years. Funny enough i didn't even make a strong password - a stupidly bad one, unique for each account, actually. I had almost hoped it was hacked because it would be interesting to be hacked and not care.

kahrl 4y ago

Reads like an 8th grader's report trying to meet the teacher's word count.

dobbysfirstsock 4y ago
I've actually noticed how _bad_ the writing of some articles can be. I'm not a good writer by any means... but the best I can say is it sounds like an essay cranked out by someone in high school. Just reminded me of my first "wtf." A journalist for our local university wrote a review for the movie "Hustlers" where they justified sexually assaulting and robbing men in New York because "men in New York were responsible for the 2008 financial crisis." All without missing a beat. Can't believe what passes these days.
- sleepybrett 4y ago
  When you find out how little these writers are paid you can understand the amount of effort they can put into these articles and still make enough money to eat.
  - dobbysfirstsock 4y ago
    Well, seems there's more people wanting to write than demand.

jefftk 4y ago

> What inelegant phrasing. Reddit's own phrasing is much better: Since we’re talking about security and safety, this is a good time to remind you how to protect your Reddit account. The most important (and simple) measure you can take is to set up 2FA (two-factor authentication) which adds an extra layer of security when you access your Reddit account. Learn how to enable 2FA in Reddit Help. And if you want to take it a step further, it’s always a good idea to update your password every couple of months – just make sure it’s strong and unique for greater protection. Also: use a password manager! Besides providing great complicated passwords, they provide an extra layer of security by warning you before you use your password on a phishing site… because the domains won’t match! -- https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_security_incident_heres_what_we_know/ https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_se...

netule 4y ago

If you use the old/classic Reddit experience and you can't find the option to enable 2FA in your profile, use this URL directly instead: https://www.reddit.com/2fa/enable/ https://www.reddit.com/2fa/enable/

cragfar 4y ago

That's how most treat it. Just go to any thread even 3 months old and 1/4th of the users are deleted.

game_the0ry 4y ago

Personally, I start by not trusting platforms - pw manager and 2fa all the way, never re-using passwords. I also use bitwarded - open source ftw.

Tepix 4y ago

These days it seems you should change your password (and your 2FA token) every now and then not because you are the one getting hacked but the sites you sign up at.

dghughes 4y ago

That's a good idea and I've thought about it but I think many feel attached to their usernames and account history "15 yeas with.." site X. And sites often balk and say "username or email already has an account here". It's a bit funny since alias was meant to hide who you were or at least make ire less formal than a person's full name. Then I go and use my name for an alias!

yreg 4y ago
The "don't use your real name on the internet" advice wasn't great. When I set up a Google account as a kid I used a made up handle because all the adults told me to not use my name on the internet. Decades later and it's still my main account and I often need to either switch accounts to the one with my real name or embarassingly ask people to invite my nickname account to various shared documents, calendars, etc. No way to migrate my YouTube channel either…
- adolph 4y ago
  In the time that has passed since that advice better name generators have been developed so you don't have to make something up. https://github.com/moby/moby/blob/master/pkg/namesgenerator/names-generator.go https://github.com/moby/moby/blob/master/pkg/namesgenerator/...
- Dalewyn 4y ago
  What's embarrassing about a nickname? Having a disconnected online entity means less-than-pleasant jackasses can't pull something from years or even decades ago, put it out of context, and proceed to troll your life. Not putting your real life identity on public display for the world to see means you maintain tighter control over how, when, and where your information gets out. Do you really need your real name, face, place of employment, telephone number, email address (with your name in it), and maybe even your home address publicized? More than likely you don't. Having online identities disconnected from real life means you can use them to safeguard your actually really-fucking-important real life things. Your bank account? Use an email that uses a nickname instead of your real name so any would be hackers have to second guess your email too. Worst comes to shove and shit hits the fan, you can throw away an online identity and make another one. You can't throw away your real name and face. There are nothing but benefits by keeping your online and real life identities separate, and if you ask me it's one of the first steps to being truly internet literate.

yreg 4y ago

Just FYI while they suggest updating passwords they also claim that user accounts are safe at this time.

kingcobraninja 4y ago

>there's no benefit to the user to have an old account with lots of karma Some subs have a minimum amount age or karma requirement to post. This is ostensibly to combat bots.

hgsgm 4y ago
Those are very low thresholds.
- onionisafruit 4y ago
  You are right, but it is still annoying when cycling accounts.
  - pixl97 4y ago
    Yea, you have to precycle effectively and create accounts before hand and let them build at least a small amount of karma. These days I don't even log into reddit. After wide spread banning from subreddits for random reasons it's not worthwhile. I'll keep browsing old.red as long as it exists but if it goes away I'll DNS block all reddit at the router.

jefftk 4y ago

> treat online accounts as throwaway wherever possible I don't need to know who you actually are, but over time interacting with other people here I've started to get a feel for several hundred accounts. This makes HN more pleasant because I have some sense of what sort of person they are to talk with, and what is likely to go well or poorly. When there have been subreddits I was really into, I would start to get a sense for the more prolific commenters there too. If I regularly attended some sort of social club and it was common for people to replace their faces I would find it frustrating as well.

devnullbrain 4y ago
If I attended a social club and my comments from 10 years ago were permanently engraved on the walls, I'd be much less honest and open.
- hgsgm 4y ago
  You can use alts and delete old comments.
  - andybak 4y ago
    Yeah. Let's delete old blogs and shut down the internet archive as well. Personally I value the web as a knowledge store that persists. Use a non-logged chat service if you want a transient medium.
    - grapesurgeon 4y ago
      [dead]
  - devnullbrain 4y ago
    There's no deleting beyond a time limit on HN
    - tough 4y ago

willis936 4y ago

We're in a crisis of trust. "You have nothing to lose" is wrong. You and the community both have something to lose if identity is not valued. A throwaway is indistinct from a bot paid for by some rich mustache-twirling billionaire or state actor trying to control narrative.

TEP_Kim_Il_Sung 4y ago
The internet was always about judging the content and quality of user's posts/comments, while being unaware of their race, sex, origin, religion, and any other traits they didn't explicitly mention. Nowhere else can you have in-depth technical discussions about the implications of Humean Projectivism on p2p network architecture, with a cybernetic dragonfly, a flying squirrel, and with distracting interjections by a literal fantasy troll. A bit of personal QA/QC, and individual filtering options, are all you need. Anything else is just censorious control of the narrative.
- s3p 4y ago
  Yes I agree. This just emphasizes OP's point about how we can't make these accounts throwaway as there would be no content to judge.
  - Buttons840 4y ago
    You judge each comment by its own merits. Online forums like HN are a source of ideas, not necessarily correct ideas.
    - pixl97 4y ago
      Eh in many ways that is not how humans work. We tend to build close in groups with higher trust level, because not trusting everything any anyone is physically and mentally exhausting. If you met a person that behaved in this manner in real life most people would conclude they had a mental illness or were an abuse victim.