• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Sha256

The common practice (i.e. accepted industry standard/best practice) is to store the hash and salt, send the submitted credential to the back end over TLS, hash it there and compare the values.
 
vbulletin uses md5 the last I looked, laff, but who knows in our unsupported ALPHA version of the software 😉

more alarming is that a technology forum still refuses to implement any form of TLS transport security. jokes^jokes
 
Not worried. I use a password on here that I only use for discussion forums. I have a much more secure one for real stuff.
 
The articles I've read on it make it sound like any password a human can reasonably memorize is going to have patterns that a computer can recognize and use in order to generate a password library. (Or that a human can type in a reasonable amount of time. Sure, a 512-character password might - might - be secure, but it's slightly inconvenient.)

Wouldn't the only real solution to that problem be to always use a strong, salted hash?
 
Jeff7 said:
Wouldn't the only real solution to that problem be to always use a strong, salted hash?
Click to expand...
Naw, they need to go to public/private keys, kinda like PGP.
That would pretty much eliminate password guessing, and instead would require the key (& the passphrase).
 
I would also like to apologize for all the errant dick pics and bull penis topics. Because hackers.
 
Your passwords are stored in a shared text file on DropBox. That's how you can access the forums from many internets.
 
Hoober said:
There was a thread on this briefly yesterday morning in OT.
Click to expand...

Yeah that was my post, which included a screen cap of my own password in clear text. The new forum owners pulled it until they could "figure out what happened."

Now this morning I see a forum announcement claiming that "Our passwords in the database are encrypted and we currently do not have any reason to believe the incident resulted in those being revealed." It then goes on to suggest users change their password. Nothing like a big plate of corporate double speak for breakfast.

The passwords in the database are not encrypted. They are hashed with a very weak md5 hash algorithm, and at least some of them were most definitely revealed. Most of the mods received screen caps of their own email addresses and passwords in email yesterday morning from an interested party who was trying to warn everyone. Several mods/former mods, myself included, verified that the hashes and salts were correct for the passwords.

Message of the day: ignore the forum announcement, change your passwords.
 
Last edited:
Markbnj said:
Most of the mods received screen caps of their own email addresses and passwords in email yesterday morning from an interested party who was trying to warn everyone. Several mods, myself included, verified that the hashes and salts were correct for the passwords.

Message of the day: ignore the forum announcement, change your passwords.
Click to expand...

daaaaaaaaaaaaaaaaaaaaaaaaaaaaaaamn
 
goddamnit slapped my email into leakedsource.com

https://www.leakedsource.com/

Search completed in: 0.7102 seconds.

Linkedin.com has: 1 result(s) found. This data was hacked on approximately 2012-06-05 00:00:00 What is in this database?
VerticalScope Network (Vbulletin) (939 Websites) has: 1 result(s) found. This data was hacked on approximately 2016-02-01 00:00:00 What is in this database?
Dodonew.com (Chinese) has: 1 result(s) found. This data was hacked on approximately 2012-01-01 00:00:00 What is in this database?
Gawker has: 1 result(s) found. This data was hacked on approximately 2010-12-01 00:00:00 What is in this database?
Anandtech.com has: 1 result(s) found. This data was hacked on approximately 2016-03-15 00:00:00 What is in this database?
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top