Shoutbox

quote:

---

Originally posted by WDZ
I am 95% sure that Patchou was using the same password. I just compared the password stolen from IRC with the one from the latest pre-hacking forum user backup, and they match.

---

wtf. He told DX that he uses different passwords everywhere... And how the hell did you get his IRC password?

Besides, other admin accounts were used as well... Are you saying that the hacker changed their passwords using Patchou's admin rights? Doesn't myBB log admin activity or something?

quote:

---

Originally posted by Wabz
Arent the irc passwords hashed now anyways

---

Mind you, if the hacker has access to the services database, he can cause great damage to the server even when the passwords are encrypted (for example, delete the databases and the configuration files, or corrupt them otherwise).

Also, a password's encryption can be cracked in a few days if the password is weak (ie. short and non-complex). Password encryption may help security, but it's far from being completely safe.

When I was running the IRC services, I used a version in which the password encryption was "experimental", so I thought it would be better to keep it disabled (which was the default). I was afraid of data loss bugs that DX warned me about. And since password encryption doesn't make things 100% safe anyway, it seemed okay to do so back then.