Privacy concerns?

[FlightlessDuck]

So did this hacker who took over the boards over the weekend of Easter get emails, passwords, etc? Are passwords encrypted?

I think regardless, everyone should make sure to change their password both on this site and anywhere else they use that same password (which you shouldn't do).

 

[WebmasterAlex]

There is no danger. The hacker obtained the password of one specific user, who we have identified. They had no access to the server or database. Never hurts to change your password

 

[MrWonderful]

There is no danger. The hacker obtained the password of one specific user, who we have identified. They had no access to the server or database. Never hurts to change your password

Thank you for the update in that regard.... Transparency and candor are much appreciated.

 

[Delaney14]

Thanks for that update!

 

[AnnaS]

This must be why dis was down. Thank you all. Not sure I know how to change password but will go and try.

 

[mousefan73]

This must be why dis was down. Thank you all. Not sure I know how to change password but will go and try.

click your profile icon and there is a "password and security link".. worse case sign- out and say you forgot password to reset

 

[robinb]

I changed my password. I also changed a couple of websites that had the same email/password combinaion . It was something that had been on my "to-do list" since I installed 1Password on all my devices a couple of months ago. Now, 1Password and I are both happy. I appreciate that passwords were not compromised, but I feel safer changing everything.

 

[EpcotPhoenician]

I had suspicion that it was a compromised user account, based on the activity that was taking place (gradual deletion of threads, which eventually led to the entire board getting wiped). If it were a true data breach (where password compromise was in question), then the entire server would have likely gone offline. Calling this a "breach" or a "hack" would be false, since it was just a single user account that was compromised, probably due to a weak or re-used password.

XenForo encrypts all passwords by default, and I highly doubt the user who gained unauthorized access was smart enough (or had the resources) to decrypt the database(s) XenForo runs off of.

Always a good idea to change your passwords every 30 days, though. LastPass is a great service for reminding you to do so.

Disclaimer: I do not work for the Dis, but have 10+ years experience as an IT system administrator.

 

[WebmasterAlex]

I had suspicion that it was a compromised user account, based on the activity that was taking place (gradual deletion of threads, which eventually led to the entire board getting wiped). If it were a true data breach (where password compromise was in question), then the entire server would have likely gone offline. Calling this a "breach" or a "hack" would be false, since it was just a single user account that was compromised, probably due to a weak or re-used password.

XenForo encrypts all passwords by default, and I highly doubt the user who gained unauthorized access was smart enough (or had the resources) to decrypt the database(s) XenForo runs off of.

Always a good idea to change your passwords every 30 days, though. LastPass is a great service for reminding you to do so.

Disclaimer: I do not work for the Dis, but have 10+ years experience as an IT system administrator.

Correct

 

[doconeill]

Thanks Alex! These things are panic inducing...I'm usually on the receiving side of it as well

 

[FlightlessDuck]

ICalling this a "breach" or a "hack" would be false, since it was just a single user account that was compromised, probably due to a weak or re-used password.

I'm glad the attacker didn't have access to the database, and that passwords are not in clear text . But, getting access to an account that doesn't belong to you is still a security breach, regardless of how pedantic you want to get over use of the word "hack".

 

[heapmaster]

I'm glad the attacker didn't have access to the database, and that passwords are not in clear text . But, getting access to an account that doesn't belong to you is still a security breach, regardless of how pedantic you want to get over use of the word "hack".

I agree to this as well

 

[FlightlessDuck]

I'm glad the attacker didn't have access to the database, and that passwords are not in clear text . But, getting access to an account that doesn't belong to you is still a security breach, regardless of how pedantic you want to get over use of the word "hack".

I should note that this isn't a coding issue or anything. The webmasters weren't responsible for this. It's just one of those things. Like when somebody else gets a hold of your credit card or whatever.

 

[Wiltony]

Sooo...they just got one user's password? Or one of the admin accounts password? If the former, I guess that raises the question of why can someone getting one user's password somehow bring the entire site down for 2 days? What kind of power do our accounts secretly have!!??

 

[SmartyBacon]

Perhaps it is a good time to revisit allowing people to actually delete their accounts.

 

[Zimwicket]

Sooo...they just got one user's password? Or one of the admin accounts password? If the former, I guess that raises the question of why can someone getting one user's password somehow bring the entire site down for 2 days? What kind of power do our accounts secretly have!!??

They must have gotten an administrator's password, meaning they either responded to a phishing scam, or use the same id/password in another service that was compromised. I would hope all administrators have multifactor enabled.

 

[Bianca and Bernard]

They must have gotten an administrator's password, meaning they either responded to a phishing scam, or use the same id/password in another service that was compromised. I would hope all administrators have multifactor enabled.

One would think that would be a requirement, especially for a business. Apparently they do not.

Let this be a reminder: MICKEY is not a safe password. Nor is Goofy, Walt, Donald, WDW, WaltDisneyWorld, Disneyworld, Disneyland, 123456, 12345678, password, abc123, qwerty, princess, letmein, baseball, football, monkey, computer, OR any of the previous with a '1' on the end....

 

[FlightlessDuck]

One would think that would be a requirement, especially for a business. Apparently they do not.

Let this be a reminder: MICKEY is not a safe password. Nor is Goofy, Walt, Donald, WDW, WaltDisneyWorld, Disneyworld, Disneyland, 123456, 12345678, password, abc123, qwerty, princess, letmein, baseball, football, monkey, computer, OR any of the previous with a '1' on the end....

And your password should be at least 8 characters. So MickeMinnieGoofyDonaldPlutoHeweyDeweyLouie works

 

[jbrinkm]

And your password should be at least 8 characters. So MickeMinnieGoofyDonaldPlutoHeweyDeweyLouie works

Shoot! Now I have to change my password since you've given it out.