Password comprimised

Jock · 26 Jun 2012 at 15:06

In the last month I've 3 emails from different companies telling me that their secure information that they store has been comprimised and the top and bottom of it, is that those who hacked into the system now have peoples security information. First it was league of legends which I never did play but signed up to once, and most recently is CGTuts.

So is this the sign of things to come since I've never had one before I dont think then 3 all in the same months?

Looks like i'll need to change all passwords yet again.

anything I don't mind · 26 Jun 2012 at 15:11

I keep all my passwords in keepass and use the built in password generator. This way all the passwords are different and of a high strength. I think we will see more and more of these sorts of compromises as the exploits that are being used become more commonly known and companies continue to not keep their systems up to date.

RoyMi6 · 26 Jun 2012 at 15:12

Sounds like you need to improve your own security processes yourself:
http://lifehacker.com/5529133/five-best-password-managers

Makes hacks like this a non event as your password is only used for that one site.

Was crazy first time I added all my accounts to KeePass by going through all the emails I had coming to my junk mail and changing the account passwords. Currently sitting at 385 accounts...

J.B · 26 Jun 2012 at 15:13

Well if clever people at eHarmony will store passwords with MD5 hashing and make them character insensitive...

It's basically the result of lazy/misinformed programmers who do not securely code their applications.

ci_newman · 26 Jun 2012 at 15:13

These "hackers" are just using known exploits in code running these systems. It has been happening for years, and will continue to happen for the foreseeable future. IIRC, OcUK had a hack (attempt?) a few years ago too?

Dj_Jestar · 26 Jun 2012 at 15:13

groen said:
I keep all my passwords in keepass and use the built in password generator. This way all the passwords are different and of a high strength. I think we will see more and more of these sorts of compromises as the exploits that are being used become more commonly known and companies continue to not keep their systems up to date.

And then keepass gets hacked and you're screwed \o/

FabienO · 26 Jun 2012 at 15:14

Is this in regards to Nettuts? I just had an email from them about compromised passwords.

RomanNose · 26 Jun 2012 at 15:15

I use lastpass, as far as I remember all passwords on their server are encrypted and your client decrypts it.

Jock · 26 Jun 2012 at 15:15

Yeah i think so, they have a lot of different sections though they are all under the Envato unbrella I beleive. Just so happens the one I use is CGTuts.

Skillmister · 26 Jun 2012 at 15:24

Jock said:
In the last month I've 3 emails from different companies telling me that their secure information that they store has been comprimised and the top and bottom of it, is that those who hacked into the system now have peoples security information. First it was league of legends which I never did play but signed up to once, and most recently is CGTuts.

So is this the sign of things to come since I've never had one before I dont think then 3 all in the same months?

Looks like i'll need to change all passwords yet again.

last.fm, LoL and linkedin all within a couple of weeks. Made me switch to randomly generated passwords and a password manager rather than using all the same passwords but afaik that wouldn't stop them gaining access to the things they did anyway

Jock · 26 Jun 2012 at 15:26

The random generated solution sounds goods although what do you do if youre out and about and want to access something on someone elses computer or your phone.

Skillmister · 26 Jun 2012 at 15:29

lastPass has an android app as do some of the others. Just sign in using your 1 secure memorable password (mine is 3 words, 17 characters) and all usernames/passwords can be copied using notifications. You can also access it online i think (edit: yes you can)

RoyMi6 · 26 Jun 2012 at 15:37

Same with KeePass, use the KyPass app for my iPhone and it's all synced with DropBox making it accessible anywhere.

anything I don't mind · 26 Jun 2012 at 15:50

If someone can hack my keepass then they are sufficiently leet enough and Id say well done.

Zogger · 26 Jun 2012 at 15:59

J.B said:
Well if clever people at eHarmony will store passwords with MD5 hashing and make them character insensitive...

It's basically the result of lazy/misinformed programmers who do not securely code their applications.

hopefully an informed programmer will use more than md5 hashing being totally insecure and all - did that happen at eharmony?
(yes somebody managed to hack all the md5 hashed passwords on my own website about 7 years ago.. then I switched to an obscure combination of sha-1 and mixing up different bits of information into the hash)

Destination · 26 Jun 2012 at 17:54

If a site like techradar informed people yesterday they had been compromised, are they all still being comproised using the same exploits the lulsec and chums used last year and anon used the year prior to that?
Are these server system that much out of date? Or is it due to new exploitation?