Shoutbox

quote:

---

Originally posted by sock
You think wrong, apparently: All the forum admins who registered their nicknames on IRC said they were using two different passwords...

---

I am 95% sure that Patchou was using the same password. I just compared the password stolen from IRC with the one from the latest pre-hacking forum user backup, and they match.

quote:

---

Originally posted by WDZ
I am 95% sure that Patchou was using the same password. I just compared the password stolen from IRC with the one from the latest pre-hacking forum user backup, and they match.

---

  We need some more security here then   Arent the irc passwords hashed now anyways

Patchou.com was probally hacked because of the same reason then? Do we know who did it? Do we have prove?

quote:

---

Originally posted by MenthiX
Patchou.com was probally hacked because of the same reason then? Do we know who did it? Do we have prove?

---

Last thing i knew is they'd recovered the logs and Patchou was going to take Legal action dunno if it's been confirmed though

quote:

---

Originally posted by WDZ
I am 95% sure that Patchou was using the same password. I just compared the password stolen from IRC with the one from the latest pre-hacking forum user backup, and they match.

---

wtf. He told DX that he uses different passwords everywhere... And how the hell did you get his IRC password?

Besides, other admin accounts were used as well... Are you saying that the hacker changed their passwords using Patchou's admin rights? Doesn't myBB log admin activity or something?

quote:

---

Originally posted by Wabz
Arent the irc passwords hashed now anyways

---

Mind you, if the hacker has access to the services database, he can cause great damage to the server even when the passwords are encrypted (for example, delete the databases and the configuration files, or corrupt them otherwise).

Also, a password's encryption can be cracked in a few days if the password is weak (ie. short and non-complex). Password encryption may help security, but it's far from being completely safe.

When I was running the IRC services, I used a version in which the password encryption was "experimental", so I thought it would be better to keep it disabled (which was the default). I was afraid of data loss bugs that DX warned me about. And since password encryption doesn't make things 100% safe anyway, it seemed okay to do so back then.

I dont think patchou would be too happy with you getting his IRC password. I defo wouldnt

quote:

---

Originally posted by sock
Doesn't myBB log admin activity or something?

---

Yes but the logs were cleared.

quote:

---

Originally posted by sock
I was afraid of data loss bugs that DX warned me about. And since password encryption doesn't make things 100% safe anyway, it seemed okay to do so back then.

---

Hashing makes things alot more secure though, because hashes cannot be reversed back to plain text, only really bruteforced.

quote:

---

Originally posted by Chris Boulton
Hashing makes things alot more secure though, because hashes cannot be reversed back to plain text, only really bruteforced.

---

Yeah hashing only takes a few days though to be broken !!By brute force