Notice: AnandTech Forums User Data Compromised

[Carson Dyle]

Purch bought a forum. Nobody told them they'd have to maintain it.

Morons.

 

[Ryan Smith]

Edit: 5) and just now received my first official email notification of issues.

6) <double sigh>

The reset and the mass mailing were done in conjunction, so yeah, you may log in/be logged into the forums before you get the email.

 

[sao123]

1) just happen to notice the message at the top of forum several days after the stuff hits the fan.

2) immediately change password.

3) several days later am told at login that my password is over 900 days old and it *has* to be changed.

4) <sigh>

Edit: 5) and just now received my first official email notification of issues.

6) <double sigh>

I also share in this frustration, just changed my PW 2 days ago, now its 905 days old???

 

[Victorian Gray]

The reset and the mass mailing were done in conjunction, so yeah, you may log in/be logged into the forums before you get the email.

And why did I have to change a brand new password that the system claimed was 905 days old?

And seriously, to be notified this long after the suspected breach *really* isn't good practice.

 

[GoodRevrnd]

Did some major VBB hack pop up or something? I've been forcibly reset on two other major forums I visit.

 

[Towermax]

I also share in this frustration, just changed my PW 2 days ago, now its 905 days old???

Same here. Really makes you wonder if anyone at AnandTech really understands the software they're using.

 

[Adul]

Any chance of adding two factor auth to this site?

https://support.google.com/a/answer/175197?hl=en

 

[SparkyJJO]

I also share in this frustration, just changed my PW 2 days ago, now its 905 days old???

Yeah that just happened to me too

Oh well, changed again. I had already changed it twice before, first when I found out this had happened, and again because I didn't like the first password I set. Now that one's blown, so 3rd time's a charm maybe?

 

[Red Squirrel]

Happened to me too, and then I changed it, it worked for a while (Was logged in) then I was logged out, and it stopped working, and had to use forget password feature.

 

[sao123]

Did some major VBB hack pop up or something? I've been forcibly reset on two other major forums I visit.

VB 3.x has been considered EOL for years, although 3.8.9 was released in 2014, there have been no updates since, its hard to know how many unpatched security holes there are.

 

[fshagan]

I actually wanted to take a moment and thank the mods here for the way they are handling this event. Stuff happens, even to the most secure of sites.

The email I received struck the absolute right tone. I want to thank those responsible for:

1) Admitting there was a breech
2) Giving common-sense advice about the use of passwords (unique for each site, etc.)
3) Not requiring long, complex passwords on this site

A very popular, large A/V forum had a similar breech and hid the fact they were compromised, but required password changes. The password they required was at least 10 digits long, with capital and lower case letters, numbers and a special character. It's a ridiculous standard for non-critical information, and many of us have simply left.

I won't visit them again because they demonstrated they don't understand security at all. They weren't hacked because their USERS had weak passwords.

The fact is that there is no information stored here that compromises any private information about me. It does not require the kind of security standard required by financial sites.

 

[Eug]

When was it compromised? I just changed my password last week, and then had to change it again today.

 

[Brainonska511]

When was it compromised? I just changed my password last week, and then had to change it again today.

I had just changed mine 3 days ago, after someone posted a link to "leakedsource" in an OT thread, and then finding AT on a list dated to March of 2016. But I changed it again today, just in case. Thank god for Keepass.

 

[sao123]

I actually wanted to take a moment and thank the mods here for the way they are handling this event. Stuff happens, even to the most secure of sites.

The email I received struck the absolute right tone. I want to thank those responsible for:

1) Admitting there was a breech
2) Giving common-sense advice about the use of passwords (unique for each site, etc.)
3) Not requiring long, complex passwords on this site

A very popular, large A/V forum had a similar breech and hid the fact they were compromised, but required password changes. The password they required was at least 10 digits long, with capital and lower case letters, numbers and a special character. It's a ridiculous standard for non-critical information, and many of us have simply left.

I won't visit them again because they demonstrated they don't understand security at all. They weren't hacked because their USERS had weak passwords.

The fact is that there is no information stored here that compromises any private information about me. It does not require the kind of security standard required by financial sites.

U do realize that this announcement could have been made 4 days ago when the breach was discovered, right?

 

[Platypus]

Go ahead and change your password over http so we can store the new one in the same broken way as before?

 

[norseamd]

VB 3.x has been considered EOL for years, although 3.8.9 was released in 2014, there have been no updates since, its hard to know how many unpatched security holes there are.

How good is XenForo?

 

[Ryan Smith]

I also share in this frustration, just changed my PW 2 days ago, now its 905 days old???

As a security precaution we expired all passwords, as that was the safest thing to do. "905 days" is just an artifact of how we went about it.

 

[ultimatebob]

I hope that they fixed the security hole, or this password reset is just a waste of time. The hackers will have the new passwords cracked within days if they're still using weak encryption.

 

[ViviTheMage]

Purch bought a forum. Nobody told them they'd have to maintain it.

Morons.

what's wrong with 3.8.8 Alpha 1?? DDDDDDDD

 

[Red Squirrel]

Go ahead and change your password over http so we can store the new one in the same broken way as before?

:biggrin:

Yeah I probably would not log on to here on an untrusted network like a public wifi or something. I'm not sure why they don't go to https.

But right now the priority should probably be to figure out how the db was leaked. Unless it's someone crooked at the data centre that sniffed traffic, but that would only really get a handful of passwords. I think this was an actual db leak. I guess if you happen to get an admin password... then you have the keys to everything.

 

[Torn Mind]

Purch bought a forum. Nobody told them they'd have to maintain it.

Morons.

IIRC, they got rid of the more frequent scheduled maintenance as well. Knowing Anand and co were techies, whatever that maintenence was could have been for very good reason, i.e data backups or something, given that they did it every week.

 

[RossMAN]

We are investigating a data incident with respect to the AnandTech Forums database. We believe that some of our user names and other information may have been accessed. Although our passwords in the database are encrypted, we believe that it is advisable to expire all the passwords in use prior to June 24th, 2016. Consequently, the first time that you go to log in to the AnandTech forums after June 24th, 2016, you will be asked to set a new password.

So that's why I was prompted to change my password.

Can anyone recommend a random password generator?

 

[Crono]

So that's why I was prompted to change my password.

Can anyone recommend a random password generator?

https://www.grc.com/passwords.htm

 

[RossMAN]

https://www.grc.com/passwords.htm

Thanks, while waiting I decided to go with random.org and a less secure 24 character string password. But it's still better than the default vBulletin password I was using for years, it was maybe 12 digits?

 

[Phynaz]

So we all reset our passwords. Unless the hole has been plugged the new ones will just get out again.

Someone at Purch should by a copy of InfoSec for Dummies.