# Hacked SDMB **URL:** \ **Category:** About This Message Board\ **Created:** [January 7, 2014, 9:47pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170 "2014-01-07T21:47:45Z")\ **Posts on this page:** 20\ **Page:** 5
**Author:** ![bystanding](https://avatars.discourse-cdn.com/v4/letter/b/90ced4/32.png) [@bystanding](https://boards.straightdope.com/u/bystanding)\ **Post date:** [January 8, 2014, 3:17am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/81 "2014-01-08T03:17:44Z")
I thought vBulletin’s username/passwords are encrypted by default? Did they get information elsewhere? ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 8, 2014, 3:32am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/82 "2014-01-08T03:32:09Z")
> [@Quartz](#): > > I’d just like to say thank you to Cecil’s crew for the prompt notification. Yes, thanks, Ed! ---
**Author:** ![mcremons](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@mcremons](https://boards.straightdope.com/u/mcremons)\ **Post date:** [January 8, 2014, 3:37am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/83 "2014-01-08T03:37:33Z")
27 minutes after the SDMB email, I got SPAM email from my own (listed) email. Passwords are now changed. I haven’t logged in here for years but made the beginner’s mistake. I say this as a warning to others who occasionally re-use passwords. Change those passwords. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [January 8, 2014, 3:51am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/84 "2014-01-08T03:51:32Z")
> [@](#): > > Quoth **TroutMan** : > > Well, yes, but obscurity should still be a component of security. It’s of little use in this particular case because everyone knows what vBulletin uses, but in general it is still good practice to say as little as possible about your specific security design. The only thing obscurity is good for in a security scheme is letting your users know that your security sucks and that they shouldn’t trust you with any sensitive information. If your security is actually good, then you want to let people know that it’s actually good. Security by obscurity is the equivalent of telling Indiana Jones that the Ark will be studied by “Top. Men.”: All it does is assure him that it _won’t_ actually be top men. What I want to know about this attack, is whether the security hole that allowed it to happen has been fixed. There’s no sense in changing passwords, etc., if they attackers can just steal the new passwords too. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [January 8, 2014, 5:00am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/85 "2014-01-08T05:00:46Z")
> [@Lobsang](#): > > I agree with you. It is bound to be better than storing your passwords in plain view, text files, notepads etc. I don’t do that. I just about succeed at storing them in my head, but When I’m asked to change a password because a site was hacked I feel like I have to make it completely different to what it was, which significantly lowers my chances of storing it in my head… So the idea of using a password manager comes into play… then I have to wonder if (not being as intelligent as I’d like to be) I do so without noticing a flaw in the plan. > > What if I forget the password that gives me access to all my passwords? What if the computer I’ve got the password file stored on… dies… what if, what if. > > In other words - not totally confident in password managers compared to what I’ve done for years. 1. I actually am somewhat dubious about proprietary encryption, as there’s no way to vet it. So I stick with open source. Though even that may not be perfect: while today’s encryption is mathematically strong, there is some evidence that the ~SNA has crippled certain implementations of it. 2a. I’ve puzzled over the 1 basket problem since the 1990s, when I created a password file using PGP. (I now use KeePass). You need to create a long and strong password and only use it locally on your computer. In other words, don’t use it for your email. You can consider creating a hint sheet which won’t reveal the password but will provide a puzzle that converts “Things only known to you and your close family,” into the real password. Of course if somebody with access to your computer starts asking suspicious questions, then… well you actually have gained useful intel about their character, right? Not to mention a signal to change your high security password. 2b. If a bad guy has a key logger installed on my machine, they can capture my password, though Keepass can defeat _some_ versions of such attempts, maybe. But they will need to download the KeePass file as well. Then they can commit all sorts of mayhem. 1. My approach is to keep myself appraised of popular bad-guy techniques. The go-to website for this is [Krebs on Security](https://krebsonsecurity.com/). Here’s a [chart](http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/) on what can be done on a hacked PC. Here as [tools for a safer PC](http://krebsonsecurity.com/tools-for-a-safer-pc/) which I haven’t read yet - only discovered just now. Small businesses should read [this page](http://krebsonsecurity.com/online-banking-best-practices-for-businesses/). 2. I use a low security password at the dope, one that is not a variant of the ones I use for ecommerce or email. ---
**Author:** ![Chefguy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chefguy/32/138_2.png) [@Chefguy](https://boards.straightdope.com/u/Chefguy)\ **Post date:** [January 8, 2014, 5:26am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/86 "2014-01-08T05:26:08Z")
> [@Measure\_for\_Measure](#): > > …or to grab a username/pswd combo and try it elsewhere. Unless they also want to read the Giraffe board, good luck with that. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [January 8, 2014, 5:31am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/87 "2014-01-08T05:31:56Z")
> [@Si\_Amigo](#): > > Still trying to figure out how and why the Straightdope sent the message to my **work email.** How about forcing the boards to send a routine email? Subscribe to a thread and have it email you, then see where it goes. ---
**Author:** ![hyjyljyj](https://avatars.discourse-cdn.com/v4/letter/h/0ea827/32.png) [@hyjyljyj](https://boards.straightdope.com/u/hyjyljyj)\ **Post date:** [January 8, 2014, 5:51am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/88 "2014-01-08T05:51:03Z")
FWIW I saw a really cool suggestion for creating a long password full of digits, upper and lower case letters that is nevertheless super easy to remember. It’s not original, absolutely perfectly hackproof, guaranteed 100% unique or ideal for everyone at all times, so if that’s a deal killer, please skip the rest of this. OK. Think of your address when you were a kid and simply memorize the sentence, e.g., “My childhood home was at 18509 Throatwarbler St. in Mangrove CA”. Your password is Mchwa18509TSiMC. If you want less length, leave off the “in Mangrove CA” part. If you need 5 more digits of security add the ZIP. Of course you could start instead with “I grew up at” or “We lived at” or “Our house was at”, etc. Whatever’s easiest to remember. (If they require a symbol you can always append an exclamation point!) Hope someone finds this helpful as I did ---
**Author:** ![Little\_Nemo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/little_nemo/32/3120_2.png) [@Little\_Nemo](https://boards.straightdope.com/u/Little_Nemo)\ **Post date:** [January 8, 2014, 7:08am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/89 "2014-01-08T07:08:31Z")
I use a different password for every site that requires one, including this one. So am I correct in thinking the worst case scenario for somebody like me is that someone might be able to sign on this board and impersonate me? Or is there some dire possibility I’m missing? ---
**Author:** ![Little\_Nemo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/little_nemo/32/3120_2.png) [@Little\_Nemo](https://boards.straightdope.com/u/Little_Nemo)\ **Post date:** [January 8, 2014, 7:10am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/90 "2014-01-08T07:10:35Z")
> [@hyjyljyj](#): > > FWIW I saw a really cool suggestion for creating a long password full of digits, upper and lower case letters that is nevertheless super easy to remember. It’s not original, absolutely perfectly hackproof, guaranteed 100% unique or ideal for everyone at all times, so if that’s a deal killer, please skip the rest of this. > > OK. Think of your address when you were a kid and simply memorize the sentence, e.g., “My childhood home was at 18509 Throatwarbler St. in Mangrove CA”. Your password is Mchwa18509TSiMC. If you want less length, leave off the “in Mangrove CA” part. If you need 5 more digits of security add the ZIP. Of course you could start instead with “I grew up at” or “We lived at” or “Our house was at”, etc. Whatever’s easiest to remember. (If they require a symbol you can always append an exclamation point!) > > Hope someone finds this helpful as I did The problem with such a password is it’s vulnerable to exactly what apparently happened here - somebody hacking into a website and stealing a list of passwords. And with a complicated password like you’ve described, you’re probably going to use it at multiple sites. ---
**Author:** ![j\_sum1](https://avatars.discourse-cdn.com/v4/letter/j/8baadc/32.png) [@j\_sum1](https://boards.straightdope.com/u/j_sum1)\ **Post date:** [January 8, 2014, 7:32am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/91 "2014-01-08T07:32:15Z")
> [@hyjyljyj](#): > > FWIW I saw a really cool suggestion for creating a long password full of digits, upper and lower case letters that is nevertheless super easy to remember. It’s not original, absolutely perfectly hackproof, guaranteed 100% unique or ideal for everyone at all times, so if that’s a deal killer, please skip the rest of this. > > OK. Think of your address when you were a kid and simply memorize the sentence, e.g., “My childhood home was at 18509 Throatwarbler St. in Mangrove CA”. Your password is Mchwa18509TSiMC. If you want less length, leave off the “in Mangrove CA” part. If you need 5 more digits of security add the ZIP. Of course you could start instead with “I grew up at” or “We lived at” or “Our house was at”, etc. Whatever’s easiest to remember. (If they require a symbol you can always append an exclamation point!) > > Hope someone finds this helpful as I did It’s not dreadful as far as password mnemonics go. The danger with doing anything formulaic like this is that it may be possible with several passwords to build up a pattern. If personal details are discovered (such as your address history) then you are vulnerable. The same can be said of using a derivative of the website as part of the password. My mnemonics refer to memorable events, personal gifts, plans and ambitions, elementary school friend’s middle names and things of that nature. Stuff stored only in my head that has not been written down before and cannot be derived from any history of me. I combine these with numbers that I have memorised in my distant past: things such as phone numbers, car registration numbers, entry number in a charity fun-run from two decades ago – stuff that is already locked in there for whatever obscure reason and so is not a memory burden. And it may not be ideal, but I store the mnemonics in plain sight in a word document so that I know what password applies to which location. Look at that document and you will find stuff like _school bus route, Bill’s middle name, Craig’s gift, 2002 travel destination_. Good luck trying to decode that one. My problem here is that the SD password was an old one that I had used in a number of non-critical sites and had never gotten around to changing. As a result of this hack, the website where I once bought some contact lenses now has a new and unique password. It took me a few minutes to change passwords at half a dozen sites and update my mnemonic file. If I am honest, the hackers probably did me a small favour. ---
**Author:** ![Nava](https://avatars.discourse-cdn.com/v4/letter/n/da6949/32.png) [@Nava](https://boards.straightdope.com/u/Nava)\ **Post date:** [January 8, 2014, 7:53am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/92 "2014-01-08T07:53:12Z")
> [@Jelymag](#): > > According to my little stats page, it has been almost two years since I logged in, but I have dutifully changed my password as instructed. I fear that even this brief visit will suck me back into SDMB quicksand and I shall waste way too much time here once again. (Sooo, how’s everyone doin’???) Welcome back, cookies are in the kitchen. I’m almost sorry to see my password go… had the same one for mumblemumble years… snifff… (I did follow the link from the email but also jumped a bit back and forth from where it took me, to verify that either it’s legit or someone has copied the whole board) ---
**Author:** ![Monster104](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@Monster104](https://boards.straightdope.com/u/Monster104)\ **Post date:** [January 8, 2014, 7:56am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/93 "2014-01-08T07:56:52Z")
Well. Since I got the e-mail about the issue and changed my password and all, I thought I would just post to let people who remember me know that I’m still around and lurking in the shadows. ---
**Author:** ![RoknRob001](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@RoknRob001](https://boards.straightdope.com/u/RoknRob001)\ **Post date:** [January 8, 2014, 8:00am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/94 "2014-01-08T08:00:22Z")
> [@Si\_Amigo](#): > > Nope, when I originally set up the account (12 years ago) I didn’t know how to do that. I basically stopped using the account about eight years ago for just about everything and let junk email go there. The the Straightdope rarely if ever contacts you so I just never got around to moving it to another email account; in fact I considered it as a security feature having a message board only contact me thru a junk account. Still I go there about every other week now and delete loads of crap; got a couple of old email accounts like that. . Can I ask why you bother deleting stuff from your junk e-mail account? I can’t even be bothered to tidy up my useful accounts, with all the storage on offer these days… let alone my junk one… What am I missing? Anyway, I, too, thought it was phishing… fortunately, my password wasn’t one I used for anything else, either. ---
**Author:** ![TBG](https://avatars.discourse-cdn.com/v4/letter/t/c89c15/32.png) [@TBG](https://boards.straightdope.com/u/TBG)\ **Post date:** [January 8, 2014, 8:05am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/95 "2014-01-08T08:05:57Z")
Meh, if someone gets into an account of mine, I might have to get a life. _I realize to some of you it could be a big deal, like if you foolishly used the same username/password here as on your banking site, or something like that, no need to point that out to me. If you are in that group, though, remember to change all your passwords not just the one here._ ---
**Author:** ![Siam\_Sam](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@Siam\_Sam](https://boards.straightdope.com/u/Siam_Sam)\ **Post date:** [January 8, 2014, 8:33am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/96 "2014-01-08T08:33:04Z")
I just use “password” for every password including this Board. Simple that way. ---
**Author:** ![Mops](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mops/32/16494_2.png) [@Mops](https://boards.straightdope.com/u/Mops)\ **Post date:** [January 8, 2014, 9:18am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/97 "2014-01-08T09:18:59Z")
BTW some years ago I could easily find a fellow Doper’s IRL identity (as he posted a question about his website) by Googling his e-mail address which was visible in his SDMB profile. It seems nowadays there is no option to directly display the e-mail address but there is an option to let other users download a vCard. When you change your password you might also want to check that option is disabled. ---
**Author:** ![Si\_Amigo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/si_amigo/32/2877_2.png) [@Si\_Amigo](https://boards.straightdope.com/u/Si_Amigo)\ **Post date:** [January 8, 2014, 10:02am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/98 "2014-01-08T10:02:55Z")
> [@RoknRob001](#): > > Can I ask why you bother deleting stuff from your junk e-mail account? I can’t even be bothered to tidy up my useful accounts, with all the storage on offer these days… let alone my junk one… > > What am I missing? > > Anyway, I, too, thought it was phishing… fortunately, my password wasn’t one I used for anything else, either. I still use the account for when I sign up for free stuff and want to actually try something out like a grocery store card or get a free towel at the ballpark. If I end up liking the service I move it to another email. Not sure why I never moved the SD over other than in my mind it was a zecurity feature. I do similar things for three otber accounts. That is I use a junk email address for one or two real site communications and the rest is junk. That way I don’t really build up too much junk in one account. BTW the worst spammers are the Democrats. I recieve about 5 trash emails from them everyday. Mortgage companies come in second. ---
**Author:** ![Mislav](https://avatars.discourse-cdn.com/v4/letter/m/77aa72/32.png) [@Mislav](https://boards.straightdope.com/u/Mislav)\ **Post date:** [January 8, 2014, 11:15am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/99 "2014-01-08T11:15:34Z")
I use my gmail account on IPhone so I am logged in all the time. Can it still be hacked? Also I changed my Straight Dope password. ---
**Author:** ![jfreakofkorn](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jfreakofkorn](https://boards.straightdope.com/u/jfreakofkorn)\ **Post date:** [January 8, 2014, 11:49am UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/100 "2014-01-08T11:49:29Z")
probably the N fkin SA [Previous page](https://boards.straightdope.com/t/hacked-sdmb/678170.md?page=4) [Next page](https://boards.straightdope.com/t/hacked-sdmb/678170.md?page=6)