Notice: AnandTech Forums User Data Compromised

[John Connor]

This site will more than likely just move to phpBB or XenForo. Using any one of those forum software installs will use bcrypt which is 10x better in terms of guarding against cracking weak MD5 hashed passwords that this forum currently uses. Also, Xenforo has a two-factor option using either Google Authenticator or Authy I guess. I'm a member of a site that uses Xenforo and I never really tried it. It's not something I care about for a dumb forum. Especially when my long, complicated password is hashed with bcrypt.

Now I gotta wonder. Is your cell phone number stored in the database as plain text using the two factor option? I should install Xenforo in Xampp and have a peak.

I use phpBB myself, and I like its interface a lot better. I especially like the notifications. In Xenforo it's all messed up.

I would hope that the IT people of Purch would run phpBB and Xenforo in a local Xampp install and see what each do in terms of options.

 

[John Connor]

^This

I'm providing false e-mail (in violation of the TOS) and a weak password until we are updated. Even then I may never trust them with my personal information again.

Would actually prefer my account here to be deleted, but they're too hardcore to allow that to happen...

What "personal information?" It's not like this site is a bank or some other escrow. They have an E-mail and that's it! Frankly I use several E-mail addresses. And one of those is for forums and other online crap I don't care about.

 

[Phynaz]

Any update? Has the vulnerability been patched?

The silence is deafening.

 

[Tim]

What "personal information?" It's not like this site is a bank or some other escrow. They have an E-mail and that's it! Frankly I use several E-mail addresses. And one of those is for forums and other online crap I don't care about.

A password is personal information.

/mic drop

 

[John Connor]

LOL! No, it's not.


Mic drop not found.

 

[John Connor]

Also, if you use Chrome (which many do) your data is mined. Especially with an asine Chromebook. A crummy forum password would be the worst of your troubles when it can just be changed and doesn't link to anything unless you're dumb enough to reuse the same password everywhere. http://lifehacker.com/5763452/what-data-does-chrome-send-to-google-about-me

/Megaphone drop

sudo apt-get install fail2ban

 

[Titillating]

While I can't give precise details at this moment, I can tell you that we (Purch) are working to bring the AT forums to a more modern era with many of the securities and features that can and should be commonplace on an internet forum. There are limitations to the improvements we can make to this version of vB, so we are looking elsewhere for our needs, which will hopefully align with all of yours as well.

We hope to have something to show for it before the end of summer and you will all be given notice well in advance of any releases. Until then, sit tight and rest easy knowing that this issue is not being overlooked

 

[Platypus]

well at least something is happening?

The same bugs are still out there for this site, so hopefully no one is using the same email/pass combo anywhere else. You are asking for problems if you do.

Happy to help with anything if you guys are interested, I do security consulting for a living (and would hand you a really nasty report for this site )

 

[John Connor]

It's not a bank website. It's a stupid place to argue with strangers you never met.

My bank, needs a good security IT team though. I E-mailed them numerous times to tell them to get rid of RC-4 and it fell of deaf ears. Then when they finally did upgrade the website it was a masterful redacted. I couldn't access my account, etc. And to top it off they don't even offer Two-factor Auth! I guess such is the case for a small town bank, but seriously. I implemented Authy in my own crappy Wordpress blog FFS! The API is there, freaking use it!




You continue to use profanities in areas where it is not allowed.



esquared
Anandtech Forum Director

 

[MongGrel]

It's not a bank website. It's a stupid place to argue with strangers you never met.

My bank, needs a good security IT team though. I E-mailed them numerous times to tell them to get rid of RC-4 and it fell of deaf ears. Then when they finally did upgrade the website it was a masterful cluster fuck. I couldn't access my account, etc. And to top it off they don't even offer Two-factor Auth! I guess such is the case for a small town bank, but seriously. I implemented Authy in my own crappy Wordpress blog FFS! The API is there, freaking use it!

You were still using dial up in 2010 and you seem to have problems fixing a laptop a lately.

Stop trying to sound like an expert and post somewhere else if you do not like it.

You would make many people happy.

Again? No.
admin allisolm

 

[JimKiler]

While I can't give precise details at this moment, I can tell you that we (Purch) are working to bring the AT forums to a more modern era with many of the securities and features that can and should be commonplace on an internet forum. There are limitations to the improvements we can make to this version of vB, so we are looking elsewhere for our needs, which will hopefully align with all of yours as well.

We hope to have something to show for it before the end of summer and you will all be given notice well in advance of any releases. Until then, sit tight and rest easy knowing that this issue is not being overlooked

thank you for the update.

 

[John Connor]

My laptop works perfectly well. Using it right now! HAHAHA

And I wasn't using Dial-up in 2010.

Edit- Not sure what dial-up has anything to do with forum software and the security that surrounds it. I've been running phpBB for over a year now. Have two phpBB driven forums and two WordPress websites. I have read a lot on hardening those CMS platforms and web application firewalls, etc. Which is more than you can say.

 

[Tim]

LOL! No, it's not.


Mic drop not found.

So a password, which nobody else on earth is supposed to know, isn't personal information?

I'm pretty sure you don't understand the meaning of personal information.

 

[Phynaz]

While I can't give precise details at this moment, I can tell you that we (Purch) are working to bring the AT forums to a more modern era with many of the securities and features that can and should be commonplace on an internet forum. There are limitations to the improvements we can make to this version of vB, so we are looking elsewhere for our needs, which will hopefully align with all of yours as well.

We hope to have something to show for it before the end of summer and you will all be given notice well in advance of any releases. Until then, sit tight and rest easy knowing that this issue is not being overlooked

"We know we've got a huge security hole, we aren't going to address it for MONTHS".

Nice going Purch.

 

[Elixer]

While I can't give precise details at this moment, I can tell you that we (Purch) are working to bring the AT forums to a more modern era with many of the securities and features that can and should be commonplace on an internet forum. There are limitations to the improvements we can make to this version of vB, so we are looking elsewhere for our needs, which will hopefully align with all of yours as well.

We hope to have something to show for it before the end of summer and you will all be given notice well in advance of any releases. Until then, sit tight and rest easy knowing that this issue is not being overlooked

At least we got a nugget of information, thanks.

It is just puzzling to know why this forum is still using vBulletin version 3.8.8 Alpha 1(from 2013?), and hasn't been updated to something like vBulletin version 5.2.3 RC1 or whatever.

 

[Carson Dyle]

At least we got a nugget of information, thanks.

It is just puzzling to know why this forum is still using vBulletin version 3.8.8 Alpha 1(from 2013?), and hasn't been updated to something like vBulletin version 5.2.3 RC1 or whatever.

What's puzzling about it?

A close parallel: An out of town investor group bought a large older house down the street from me a couple years ago to rent out rooms to college students. The house has since fallen into disrepair, with pieces of it literally falling off, the paint peeling, the lawn gone to dirt and weeds. It's a total dump.

Same thing here. Absentee landlords maximizing their investment by supplying the absolute minimum amount of maintenance and capital reinvestment. And the place has become a dump.


.

 

[Elixer]

What's puzzling about it?
Same thing here. Absentee landlords maximizing their investment by supplying the absolute minimum amount of maintenance and capital reinvestment. And the place has become a dump.

Purch did work on the forum software though, and upgrading from alpha to beta to release isn't that complicated, yeah, it will take awhile to redo the database, but, other than that, not willing to update because of time/$$$ vs losing time/$$$ because of trying to plug the security holes seems silly.

 

[Carson Dyle]

Purch lost nothing to the security breach. If they had, you can be sure they wouldn't be taking months to address it, and might have even invested a few dollars into an upgrade well before it could happen. So someone got hold of the forum users' email and perhaps their passwords? That costs them nothing. Heck, they've probably already sold the email list many times over.