# Hacked SDMB **URL:** \ **Category:** About This Message Board\ **Created:** [January 7, 2014, 9:47pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170 "2014-01-07T21:47:45Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [January 7, 2014, 11:33pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/41 "2014-01-07T23:33:38Z")
> [@Lobsang](#): > > I can’t help feeling like using a password manager is storing all your eggs in one basket. Post-It notes are excellent for back-up. 😃 ---
**Author:** ![Si\_Amigo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/si_amigo/32/2877_2.png) [@Si\_Amigo](https://boards.straightdope.com/u/Si_Amigo)\ **Post date:** [January 7, 2014, 11:36pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/42 "2014-01-07T23:36:04Z")
Wait a minute. Straightdope shows that I use an old yahoo account to communicate with the Staightdope. I do not have Yahoo set up on my phone to pop up messages as its a junk email account. How did I get this message? From Tapatalk perhaps? ---
**Author:** ![Peter\_Morris](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/peter_morris/32/359_2.png) [@Peter\_Morris](https://boards.straightdope.com/u/Peter_Morris)\ **Post date:** [January 7, 2014, 11:38pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/43 "2014-01-07T23:38:40Z")
> [@Giraffe](#): > > Neither is security through obscurity. I guarantee you any would-be hackers already know far more about vBulletin password storage than anyone here. This is the straight dope. I guarantee there are people here who \*are \* hackers, and people who are experts on VBulletin security. ---
**Author:** ![PapSett](https://avatars.discourse-cdn.com/v4/letter/p/ecc23a/32.png) [@PapSett](https://boards.straightdope.com/u/PapSett)\ **Post date:** [January 7, 2014, 11:38pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/44 "2014-01-07T23:38:53Z")
This is odd… it is not allowing me to reset my password. Every time I try, the screen sort of… jumps… before I have it entered fully and says the password does not match toe one on record. What’s going on?? ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 7, 2014, 11:39pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/45 "2014-01-07T23:39:16Z")
> [@runner pat](#): > > Post-It notes are excellent for back-up. 😃 Or just blert them out to all the people you know. The number of times a colleague has told me their password before I could finish saying… “DON’T tell me your p…” ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 7, 2014, 11:40pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/46 "2014-01-07T23:40:02Z")
> [@Thudlow\_Boink](#): > > I guess now’s my chance to post something jerkish and claim it was really from someone else who hacked into my account. 🙂 You dukey butt! No, that wasn’t me! wait a minute… ---
**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\ **Post date:** [January 7, 2014, 11:41pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/47 "2014-01-07T23:41:54Z")
> [@PapSett](#): > > This is odd… it is not allowing me to reset my password. Every time I try, the screen sort of… jumps… before I have it entered fully and says the password does not match toe one on record. What’s going on?? Did you try to do it directly from this board, or from the link in the email everyone seems to be getting? ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [January 7, 2014, 11:44pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/48 "2014-01-07T23:44:18Z")
> [@Giraffe](#): > > Check out this [really interested Wired article on password cracking](http://www.wired.co.uk/news/archive/2013-05/28/password-cracking). Salting helps a little, but not nearly as much as it used to since they’re not using rainbow tables any more, they’re brute force attacking using GPUs. (Also, I believe vBulletin stores the salts in the database in plain text, so if they got the database, they got the salts as well.) The success rate in that article is pretty astonishing: they cracked some seemingly strong passwords in minutes. > > The biggest problem with vBulletin’s security is the use of MD5: you want something that takes a lot longer to process (relatively speaking), e.g. SHA512 with a bunch of iterations. It might take each user a second longer to log in, but it will reduce the number of guesses the cracker can make by several orders of magnitude. I looked up the password storage in vBulletin 3 and everyone really should just assume their passwords are public knowledge at this point. Their hashing method is: MD5(MD5(password) + salt), where the salt is 3 random characters. I’m not particularly well-trained in crypto and I can spot 4 mistakes with this scheme: 1) the salt is small (and, as G points out, probably available to the hackers anyway), 2) the salt is appended (as opposed to prepended) to the final hash input, meaning that you have to do very little work to calculate all salted hashes for a given password you want to test, since the salt only provides a small delta on top of something you’ve already computed, 3) the salted string is not the raw password, but the result of a previous hash, which limits your input keyspace, 4) two rounds of MD5 is really not anywhere near up to snuff these days. ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [January 7, 2014, 11:44pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/49 "2014-01-07T23:44:35Z")
I’d just like to say thank you to Cecil’s crew for the prompt notification. ---
**Author:** ![bobot](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bobot/32/21622_2.png) [@bobot](https://boards.straightdope.com/u/bobot)\ **Post date:** [January 7, 2014, 11:48pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/50 "2014-01-07T23:48:54Z")
> [@runner pat](#): > > Post-It notes are excellent for back-up. 😃 Ha ha ha!! That’s what I just finished doing! 🙂 ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [January 7, 2014, 11:52pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/51 "2014-01-07T23:52:16Z")
If the administration doesn’t mind saying, how far did the hackers get? Did they just manage to discover a vBulletin exploit that let them generate a dump of the user table via HTTP, or did they actually get logged into the machine and access mysql directly? ---
**Author:** ![Keeve](https://avatars.discourse-cdn.com/v4/letter/k/f07891/32.png) [@Keeve](https://boards.straightdope.com/u/Keeve)\ **Post date:** [January 7, 2014, 11:53pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/52 "2014-01-07T23:53:58Z")
> [@Lobsang](#): > > I can’t help feeling like using a password manager is storing all your eggs in one basket. Ditto. Can anyone offer a rebuttal? ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [January 7, 2014, 11:59pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/53 "2014-01-07T23:59:31Z")
> [@Giraffe](#): > > Neither is security through obscurity. I guarantee you any would-be hackers already know far more about vBulletin password storage than anyone here. Well, yes, but obscurity should still be a component of security. It’s of little use in this particular case because everyone knows what vBulletin uses, but in general it is still good practice to say as little as possible about your specific security design. From the article you linked to: > [@](#): > > What’s more, like the other two crackers profiled in this article, radix didn’t know where the password list was taken from, eliminating one of the key techniques crackers use when deciphering leaked hashes. “If I knew the site, I would go there and find out what the requirements are,” he said. The information would have allowed radix to craft custom rule sets targeted at the specific hashes he was trying to crack. And as a user of a hacked site, don’t worry about trying to determine if the site’s security was good enough to prevent your password from being compromised. Just assume your password is now known and change it immediately. It’s probably a safe assumption. ---
**Author:** ![JSexton](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@JSexton](https://boards.straightdope.com/u/JSexton)\ **Post date:** [January 8, 2014, 12:03am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/54 "2014-01-08T00:03:26Z")
> [@PapSett](#): > > This is odd… it is not allowing me to reset my password. Every time I try, the screen sort of… jumps… before I have it entered fully and says the password does not match toe one on record. What’s going on?? Best guess: you have the password stored in IE/Chrome/FF/whatever, so you type in your username, hit tab, and then it autofills your password, except that it’s happening slightly slowly and you’re already hand keying your password by then. So under the dots it says something like PasPasswordsword and of course that is not going to work. Try just putting in your username, hit tab, and wait a second to see if your password autofills. ---
**Author:** ![JSexton](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@JSexton](https://boards.straightdope.com/u/JSexton)\ **Post date:** [January 8, 2014, 12:06am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/55 "2014-01-08T00:06:48Z")
> [@Keeve](#): > > Ditto. Can anyone offer a rebuttal? It’s like saying “storing your money in a bank is like having all your eggs in one basket, that’s why I bury mine in random places in my backyard.” The analogy may be factually true, but it doesn’t mean the analogy is a useful one. Password managers are thoroughly vetted, and are as secure as it gets right now. (short of a cumbersome manual one time pad system or a physical dongle of some kind, neither of which are terribly convenient). There may be holes in a password manager, but they are certainly orders of magnitude smaller than the holes in whatever system you are currently using. The folks behind them have zero access to your actual password. JSexton, IT security professional ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [January 8, 2014, 12:13am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/56 "2014-01-08T00:13:06Z")
Wow. I wonder if this is related to the problems we’ve been having? Good job on the admins for telling us. Much better than A… certain company. > [@snowthx](#): > > Same here. But, why would someone want to hack this message board, if there is not any financial or personal info stored here? I’m also surprised. I knew we were among the top for certain Google searches, I thought there would be more popular, less secure forums out there than the SDMB. I’m almost flattered. ---
**Author:** ![Jelymag](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@Jelymag](https://boards.straightdope.com/u/Jelymag)\ **Post date:** [January 8, 2014, 12:14am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/57 "2014-01-08T00:14:14Z")
According to my little stats page, it has been almost two years since I logged in, but I have dutifully changed my password as instructed. I fear that even this brief visit will suck me back into SDMB quicksand and I shall waste way too much time here once again. (Sooo, how’s everyone doin’???) ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [January 8, 2014, 12:15am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/58 "2014-01-08T00:15:25Z")
> [@Keeve](#): > > Ditto. Can anyone offer a rebuttal? No, it’s absolutely true that it’s storing all your eggs in one basket, but then again, the idea is that it’s a more secure basket than some random forum software written eons ago in internet years. My primary concern when it comes to password managers is that I don’t necessarily trust anyone else. Not that I think LastPass is out to steal my passwords or something, but they could themselves have a security breach that exposes all their user data – which is stored on their servers. Now, they allegedly take care to prevent this by (supposedly) having all of your data encrypted by a unique key client-side before sending it to their servers, but I don’t know for certain that there aren’t holes in their scheme. On the other hand, folks like LastPass and 1Password and KeePass and a handful of others are working pretty hard to make sure they’re a safe place to store your passwords, which is a lot more than you can say about most websites. ETA: I should note that of these, I know KeePass doesn’t actually store your data (or at least it’s optional if they do). Your encrypted password database can be purely local and never leave your computer if you want. I just don’t like KeePass because their Mac version kind of blows. ---
**Author:** ![Keeve](https://avatars.discourse-cdn.com/v4/letter/k/f07891/32.png) [@Keeve](https://boards.straightdope.com/u/Keeve)\ **Post date:** [January 8, 2014, 12:17am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/59 "2014-01-08T00:17:52Z")
> [@JSexton](#): > > The folks behind them have zero access to your actual password. I’m not talking about the people who work at the company that controls your password manager. I’m talking about the password that YOU use to USE the password manager. How impervious is that? And then, if someone gets the password to your password manager, can’t they then use it to get into your accounts? ETA: Yeah, what **spinky** said. ---
**Author:** ![PapSett](https://avatars.discourse-cdn.com/v4/letter/p/ecc23a/32.png) [@PapSett](https://boards.straightdope.com/u/PapSett)\ **Post date:** [January 8, 2014, 12:19am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/60 "2014-01-08T00:19:24Z")
> [@Czarcasm](#): > > Did you try to do it directly from this board, or from the link in the email everyone seems to be getting? I tried it both ways and it won’t let me enter ANYthing… it jumps when I try to enter the current password before it’s half in and says it doesn’t match the one on record. [Previous page](https://boards.straightdope.com/t/hacked-sdmb/678170.md?page=2) [Next page](https://boards.straightdope.com/t/hacked-sdmb/678170.md?page=4)