Englishforum security breach?

[Clocker]

	Quote:	Belgianmum
	What is wrong with that? I understood it to mean that if you haven8217;t already changed you password (after January 13 2019) you need to do so otherwise your account will be locked. People who have already changed their password (after 13.01.2019) received the message that as their password had already been changed no other action was required.

I understood the opposite, hence me saying the date must be incorrect. I thought I had received the message because I hadn't changed my password by the 13th. As mentioned, I received the email yesterday and changed it immediately.

[Belgianmum]

	Quote:	Clocker
	I understood the opposite, hence me saying the date must be incorrect. I thought I had recweived the message because I hadn't changed my password by the 13th. As mentioned, I received the email yesterday and changed it immediately.

You did receive that email because you hadn’t changed your password after the 13th. Due to the fact that you hadn’t changed your password after that date they wrote to you offering you the possibility to change it now or your account would be locked. What the email didn’t specify was how much time would be given for the change to be made before they lock accounts.

The other option given was to make a request to have your account deleted.

	Quote:	Belgianmum
	What is wrong with that? I understood it to mean that if you have not already changed you password (after January 13 2019) you need to do so otherwise your account will be locked. What the email did not specify was how much time they were giving users to change their passwords before locking the accounts. People who have already changed their password (after 13.01.2019) received the message that as their password had already been changed no other action was required.

It reads (to me) that if you haven't changed your password by 13/1 your account would be locked. I didn't get the email until yesteray the 23rd. It seemed to contradict itself. But if read the way you outline, it makes more sense I suppose.


I hadn't received an email before then.

	Quote:	Belgianmum
	You did receive that email because you hadn’t changed your password by the 13th. Due to the fact that you hadn’t changed your password by that date they wrote to you offering you the possibility to change it now or your account would be locked. What the email didn’t specify was how much time would be given for the change to be made before they lock accounts.

They got me so curious that if they don't specify a date (which would be weird) that I can tell you what date it was the moment they unlock me.

[3Wishes]

	Quote:	Clocker
	No, apparently only 2 users reported having received the email. That's quite different.

Fair enough, but given how many active users we have, and how much people like to complain about any little thing I am surprised we only heard from two users.

[McTAVGE]

Have just received this security alert message from EF asking us to change our password. Just wanted to double check it was genuine before clicking on the link to do it:




DETAILS





On 13th and 15th January 2019 two members of English Forum reported receiving extortionist emails. These emails revealed their forum passwords written in clear text. The emails went on to threaten these users with blackmail and demanded payment via cryptocurrency.





In both cases the revealed passwords were old. This leads us to believe that a years-old copy of the membership database is circulating in the wild. Although passwords are stored in encrypted format (salted double-MD5 hash) it is possible that some weaker passwords from that leaked version of the database have recently been deciphered.





If you receive such an extortion email, DO NOT pay the ransom.





Instead, change your password. And if you used the same password on any other site, change it there too. It is best practice to use a unique password for each site.





All members are being emailed this security alert and urged to change their passwords. Accounts with unchanged passwords will be locked. Furthermore, all dormant accounts are being permanently deleted. A dormant account is defined as one which has not logged in for over a year and has never made a public post to the forum.





We have also submitted a "cross-border data breach notification" to the relevant GDPR authority, which in our case is "Datainspektion" in Sweden. We are currently working on upgrading our vBulletin forum software to the latest version. Although we do not know of any security hole in our server, the upgraded vBulletin version should close any unknown holes.





If you prefer to delete your account, please send a brief request by replying to this email. Your account and all personal data will be permanently deleted. Public posts of deleted accounts will remain online, but labelled as authored by "Guest". For other enquiries relating to data privacy and security on English Forum Switzerland, feel free to reply.





The timing of this incident suggests it might be related to the "breach of breaches" that was recently in the news. The headline from Wired was: "An astonishing 773 million records exposed in monster breach". From that article: "The breach claims to aggregate over 2,000 leaked databases that contain passwords whose protective hashing has been cracked. It looks like a completely random collection of sites purely to maximize the number of credentials available to hackers. There are no obvious patterns, just maximum exposure."





To our knowledge no other websites belonging to The Local have been affected.





For further information and commentary see the discussion forum: https://www.englishforum.ch/forum-support/289200-englishforum-security-breach.html

[Ace1]

Where have you been for the last week or so? Read the linked thread - in fact I'll merge this with it now.

[Carlos R]

	Quote:	Ace1
	Where have you been for the last week or so? Read the linked thread - in fact I'll merge this with it now.

Working, living life, doing orher stuff. Now that we’ve got that over, why do I need to change my password?!

Just got the email from EF. I don’t get why there‘s the need for an obligatory password change. Surely it‘s on me whether I change my EF password or not?!

What’s the worst that can happen if someone hacks my EF account and posts something obnoxious? A few red blobs?! Seems like overkill knee jerk reaction to me.

Edited to add: regarding haveibeenpwned - I am dubious about their service. I checked myself there and it came up with 3 potential breaches. 2 for sites I don’t have an account on and... drumroll... a generic Facebook one. Those folks who raised this concern may wish to look at their own computer security systems rather than point the finger at EF. Oh & stay away from those porn sites.

[Clocker]

	Quote:	Belgianmum
	You did receive that email because you hadn’t changed your password by the 13th.

I would not have changed my password by the 13th though as I had not received any notification telling me that I should do so.

[araqyl]

In response to the poster worried about clicking on a link in a password-change email warning, I never click on links in emails like that - I just open my browser, manually type the address of the site itself (which I know since I've been there previously) and then navigate to the point at which I can change my password.
There's no need to click on the link, since it doesn't go anywhere you can't get to on your own.

	Quote:	Clocker
	I would not have changed my password by the 13th though as I had not received any notification telling me that I should do so.

Some security-conscious people change their passwords regularly, at a minimum once each year. I have a couple of friends who are in that category.

[Belgianmum]

	Quote:	Clocker
	I would not have changed my password by the 13th though as I had not received any notification telling me that I should do so.

Even if you had changed it before the 13th it wouldn’t have made a difference since the email was asking people who hadn’t changed their passwords after the 13th to change them.

My original post should have said after the 13th not by the 13th.

[Savanna3]

I recently downloaded a free app called Cryptical. It’s a random password generator. You can set the parameters you need for the specific password, ie uppercase, Symbols, length. I’m never using my old stand by password again.

[McTAVGE]

	Quote:	Ace1
	Where have you been for the last week or so? Read the linked thread - in fact I'll merge this with it now.

Busy with work! Thanks, I'll get onto the case now.

[McTAVGE]

Having read the whole "novel" on this thread, I feel like I have just woken up from a 10 day coma and some world disaster has happened while I was "asleep" away from EF.

[TypeR]

	Quote:	Savanna3
	I recently downloaded a free app called Cryptical. It’s a random password generator. You can set the parameters you need for the specific password, ie uppercase, Symbols, length. I’m never using my old stand by password again.

I'm using keepass since few years now. It can not only generate pass, but the biggest advantage is that it works as a vault where you can store all your pass. So you can generate extremely complicated pass and you don't need to remember them. Only the master pass to open the vault.
Last but not least, you can take this app wherever you go in a usb stick.

Cheers

[gbn]

	Quote:	TypeR
	I'm using keepass since few years now. It can not only generate pass, but the biggest advantage is that it works as a vault where you can store all your pass. So you can generate extremely complicated pass and you don't need to remember them. Only the master pass to open the vault. Last but not least, you can take this app wherever you go in a usb stick. Cheers

I prefer LastPass but does the same job.

[TypeR]

	Quote:	gbn
	I prefer LastPass but does the same job.

Looks like a cloud version of keepass...

[Mica]

+1 for LastPass: with iOS 12 it integrates nicely with your iPhone/iPad device, which allows you to use complex passwords together with TouchID and 2FA.

[MPiolo]

Email received too (it was in the spam folder), password changed.

[Chuff]

	Quote:	Chuff
	The latest version of vbulletin has 2 factor authentication enabled. This is pretty much essential. If you are not regularly updating to newer and more stable major versions of vbulletin with modern security features then you are not being security conscious. Version 3.8.4 was released in 2009, 10 years ago. https://www.vbulletin.com/forum/foru...3-8-4-released Some would say you have possibly been a little negligent in that regard.

So when can we expect a forum software upgrade?