# Hacked SDMB **URL:** \ **Category:** About This Message Board\ **Created:** [January 7, 2014, 9:47pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170 "2014-01-07T21:47:45Z")\ **Posts on this page:** 20\ **Page:** 4
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 8, 2014, 12:21am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/61 "2014-01-08T00:21:03Z")
> [@JSexton](#): > > It’s like saying “storing your money in a bank is like having all your eggs in one basket, that’s why I bury mine in random places in my backyard.” > > The analogy may be factually true, but it doesn’t mean the analogy is a useful one. Password managers are thoroughly vetted, and are as secure as it gets right now. (short of a cumbersome manual one time pad system or a physical dongle of some kind, neither of which are terribly convenient). There may be holes in a password manager, but they are certainly orders of magnitude smaller than the holes in whatever system you are currently using. The folks behind them have zero access to your actual password. > > JSexton, IT security professional I agree with you. It is bound to be better than storing your passwords in plain view, text files, notepads etc. I don’t do that. I just about succeed at storing them in my head, but When I’m asked to change a password because a site was hacked I feel like I have to make it completely different to what it was, which significantly lowers my chances of storing it in my head… So the idea of using a password manager comes into play… then I have to wonder if (not being as intelligent as I’d like to be) I do so without noticing a flaw in the plan. What if I forget the password that gives me access to all my passwords? What if the computer I’ve got the password file stored on… dies… what if, what if. In other words - not totally confident in password managers compared to what I’ve done for years. ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 8, 2014, 12:23am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/62 "2014-01-08T00:23:35Z")
> [@PapSett](#): > > I tried it both ways and it won’t let me enter ANYthing… it jumps when I try to enter the current password before it’s half in and says it doesn’t match the one on record. PapSett, sorry if this is obvious, or has already been suggested, but have you tried using a different web browser? ---
**Author:** ![Giraffe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/giraffe/32/129_2.png) [@Giraffe](https://boards.straightdope.com/u/Giraffe)\ **Post date:** [January 8, 2014, 12:28am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/63 "2014-01-08T00:28:42Z")
> [@Keeve](#): > > I’m not talking about the people who work at the company that controls your password manager. I’m talking about the password that YOU use to USE the password manager. How impervious is that? And then, if someone gets the password to your password manager, can’t they then use it to get into your accounts? Yes, they can. Although there are some pretty big hurdles: DashLane, for example, doesn’t store your master password anywhere, so they’d have to get it off of one of your physical devices. (Where it’s stored with a much harder to crack encryption than MD5: AES-256 encryption with 10,000+ rounds of PBKDF2 salt.) And any time you try to access your DashLane passwords from a device where you haven’t accessed them previously, they have to first validate the device by clicking a link sent to your email. So without physical access to your computer, getting your passwords out is going to be a challenge. As JSexton said, password managers aren’t perfect but good ones are far more secure than what most websites use. Especially for most people, who tend to reuse weak passwords rather than memorizing a different cryptographically-strong password for every site they visit. ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [January 8, 2014, 12:29am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/64 "2014-01-08T00:29:17Z")
> [@Lobsang](#): > > What if I forget the password that gives me access to all my passwords? What if the computer I’ve got the password file stored on… dies… what if, what if. I worried about these problems for a while when I started using a password manager, and I eventually realized that they’re not such huge problems. I mean, it would be a hassle, but it’s still not insurmountable. You lose your password manager and you start fresh, and every time you go to log into a site that’s not yet in your new password manager, you have to do the old “reset password” song and dance, and enter the new password. It works out. Just don’t ever lose the password for the email account where all those “reset password” notices are going to go. 🙂 ---
**Author:** ![Bosda\_Di\_Chi\_of\_Tricor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bosda_di_chi_of_tricor/32/16845_2.png) [@Bosda\_Di\_Chi\_of\_Tricor](https://boards.straightdope.com/u/Bosda_Di_Chi_of_Tricor)\ **Post date:** [January 8, 2014, 12:34am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/65 "2014-01-08T00:34:43Z")
What about the credit card numbers of paid members? **Like me!** Were our CCs taken? Yes or no? ---
**Author:** ![Baron\_Greenback](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/baron_greenback/32/48_2.png) [@Baron\_Greenback](https://boards.straightdope.com/u/Baron_Greenback)\ **Post date:** [January 8, 2014, 12:38am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/66 "2014-01-08T00:38:33Z")
> [@Bosda\_Di\_Chi\_of\_Tricor](#): > > What about the credit card numbers of paid members? > **Like me!** > > Were our CCs taken? > Yes or no? Try reading Ed’s announcement at the top of every forum. (It’s “No”). ---
**Author:** ![WolfpackJeep](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolfpackjeep/32/2921_2.png) [@WolfpackJeep](https://boards.straightdope.com/u/WolfpackJeep)\ **Post date:** [January 8, 2014, 12:55am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/67 "2014-01-08T00:55:29Z")
> [@Czarcasm](#): > > Did you try to do it directly from this board, or from the link in the email everyone seems to be getting? Was an email actually sent out? I followed the link and changed my password…I just tried the new password on a different computer, and I was able to log in. > [@PapSett](#): > > This is odd… it is not allowing me to reset my password. Every time I try, the screen sort of… jumps… before I have it entered fully and says the password does not match toe one on record. What’s going on?? That happened to me when I forgot to enter my old password in the box at the top. :o ---
**Author:** ![Loach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/loach/32/350_2.png) [@Loach](https://boards.straightdope.com/u/Loach)\ **Post date:** [January 8, 2014, 12:56am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/68 "2014-01-08T00:56:40Z")
Jeez, leave the board for a day and look what happens. ---
**Author:** ![Terry\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/t/c57346/32.png) [@Terry\_Kennedy](https://boards.straightdope.com/u/Terry_Kennedy)\ **Post date:** [January 8, 2014, 12:57am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/69 "2014-01-08T00:57:32Z")
> [@Yaxche](#): > > So when exactly did this take place? I literally changed my password last night, is it at risk? The widespread disclosure of the vBulletin vulnerability? Since the middle of November. Many sites migrated away from vBulletin or completely shut down their forums by Thanksgiving. I’m bemused (but not surprised, given the less than enthusiastic response to reports of prior things like malicious ads being served) that it took 6 weeks for the SDMB management to alert users to this. [Cite 1](http://www.vbulletin.org/forum/showpost.php?p=2461189&postcount=1) [Cite 2](http://forums.freebsd.org/viewtopic.php?f=17&t=43537#p242047) [Cite 3](https://www.propellerheads.se/forum-info/) ---
**Author:** ![blondebear](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/blondebear/32/1022_2.png) [@blondebear](https://boards.straightdope.com/u/blondebear)\ **Post date:** [January 8, 2014, 1:12am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/70 "2014-01-08T01:12:13Z")
I wonder how Dopers will react to this. I’ve seen a couple of forums where a lot of people left after a security breach like this. This is life in the digital age I guess. There’s always a hack waiting for you just around the corner. ---
**Author:** ![Si\_Amigo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/si_amigo/32/2877_2.png) [@Si\_Amigo](https://boards.straightdope.com/u/Si_Amigo)\ **Post date:** [January 8, 2014, 1:16am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/71 "2014-01-08T01:16:06Z")
Still trying to figure out how and why the Straightdope sent the message to my **work email.** 😕 The only communication I have ever had with them is through my junk Yahoo account and I have never seen a message sent to my Yahoo account pop up in my work email. I have a couple of times privately sent emails from my work account to one of the adminstrators a couple of years ago when there was a local Dopefest and to discuss a private matter, so perhaps my account got mingled in with the users accounts thanks to big brother Google. Not really going to sweat it since I most likely would not have found out about the hack so soon; I just kind of feel like I’ve been felt up in a friendly but creepy sort of way. :eek: ---
**Author:** ![GrandWino](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/grandwino/32/67_2.png) [@GrandWino](https://boards.straightdope.com/u/GrandWino)\ **Post date:** [January 8, 2014, 1:21am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/72 "2014-01-08T01:21:30Z")
> [@Si\_Amigo](#): > > Still trying to figure out how and why the Straightdope sent the message to my **work email.** 😕 The only communication I have ever had with them is through my junk Yahoo account and I have never seen a message sent to my Yahoo account pop up in my work email. > > I have a couple of times privately sent emails from my work account to one of the adminstrators a couple of years ago when there was a local Dopefest and to discuss a private matter, so perhaps my account got mingled in with the users accounts thanks to big brother Google. Not really going to sweat it since I most likely would not have found out about the hack so soon; I just kind of feel like I’ve been felt up in a friendly but creepy sort of way. :eek: Which email is listed in your User CP? ---
**Author:** ![Si\_Amigo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/si_amigo/32/2877_2.png) [@Si\_Amigo](https://boards.straightdope.com/u/Si_Amigo)\ **Post date:** [January 8, 2014, 1:28am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/73 "2014-01-08T01:28:23Z")
> [@Bob Ducca](#): > > Which email is listed in your User CP? My Yahoo account. I just looked at it when I changed my password. That and I have been very careful not to give out any specific work information on the board, let alone my work email address. ---
**Author:** ![GrandWino](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/grandwino/32/67_2.png) [@GrandWino](https://boards.straightdope.com/u/GrandWino)\ **Post date:** [January 8, 2014, 2:17am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/74 "2014-01-08T02:17:47Z")
> [@Si\_Amigo](#): > > My Yahoo account. I just looked at it when I changed my password. That and I have been very careful not to give out any specific work information on the board, let alone my work email address. Very strange. Could you have set up email forwarding on Yahoo at some point? That’s all I got. ---
**Author:** ![Siam\_Sam](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@Siam\_Sam](https://boards.straightdope.com/u/Siam_Sam)\ **Post date:** [January 8, 2014, 2:22am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/75 "2014-01-08T02:22:13Z")
I thought the hamsters were trained to bite hackers? 😕 ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 2:27am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/76 "2014-01-08T02:27:39Z")
> [@Keeve](#): > > Ditto. Can anyone offer a rebuttal? GQ’d. I changed my sub username for security. ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 2:32am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/77 "2014-01-08T02:32:01Z")
> [@Si\_Amigo](#): > > …I just kind of feel like I’ve been felt up in a friendly but creepy sort of way. :eek: We didn’t meet in high school, did we? ---
**Author:** ![Si\_Amigo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/si_amigo/32/2877_2.png) [@Si\_Amigo](https://boards.straightdope.com/u/Si_Amigo)\ **Post date:** [January 8, 2014, 2:32am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/78 "2014-01-08T02:32:31Z")
> [@Bob Ducca](#): > > Very strange. Could you have set up email forwarding on Yahoo at some point? That’s all I got. Nope, when I originally set up the account (12 years ago) I didn’t know how to do that. I basically stopped using the account about eight years ago for just about everything and let junk email go there. The the Straightdope rarely if ever contacts you so I just never got around to moving it to another email account; in fact I considered it as a security feature having a message board only contact me thru a junk account. Still I go there about every other week now and delete loads of crap; got a couple of old email accounts like that. Been very careful not to link any of my email accounts and have been overly careful not to use my work email except for work and a chosen few people that I know and trust not to spam me. Also, my work is pretty good about preventing spam. I’m pretty certain that it either may have my private contact with an admin that somehow got my work email mixed in with the users email list (not that i blame them as most social websites now aggressively try and raid your contacts list) or now that I think about it my work email may actually be in my Yahoo contacts and it got mined somehow. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 8, 2014, 2:56am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/79 "2014-01-08T02:56:07Z")
> [@Lobsang](#): > > Or just blert them out to all the people you know. > > The number of times a colleague has told me their password before I could finish saying… > > “DON’T tell me your p…” I downloaded a password generator and assigned them to my users. They put them on post-its and affixed them to their monitors. I gave up. ---
**Author:** ![Doug\_K](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Doug\_K](https://boards.straightdope.com/u/Doug_K)\ **Post date:** [January 8, 2014, 3:04am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/80 "2014-01-08T03:04:26Z")
> [@Mops](#): > > I first thought the e-mail announcement was a phishing e-mail because it contains two links purporting to point at URLs at [boards.straightdope.com](http://boards.straightdope.com) and [www.straightdope.com](http://www.straightdope.com), respectively, but really pointing at URLs under [click.suntimesmail.com](http://click.suntimesmail.com) - this kind of thing usually is a hallmark of phishing. No kidding. When I got the email I logged in to find out where I could report a phishing attempt. That’s when I saw the sticky. I still didn’t use the links, I went directly to my CP to change my password. [Previous page](https://boards.straightdope.com/t/hacked-sdmb/678170.md?page=3) [Next page](https://boards.straightdope.com/t/hacked-sdmb/678170.md?page=5)