As part of my personal information security I have darknet scanners and this morning I have a notification that Amigaworld.net logins have been leak. I recommend you all change your passwords

Last edited by Ratta on 23-Jan-2021 at 11:17 AM.
Last edited by Ratta on 23-Jan-2021 at 11:16 AM.

@Ratta

Around that time there was a thread how people started to get those blackmail emails with unique passwords from amigaworld.

Like usually, it was handled in same professional way than things in wonderful world of amiga in general.

@Thread

And we were told security was improved a couple of years ago! We pay a price for keeping AmigaWorld compatible with iBrowse

_________________
"Art challenges technology. Technology inspires the art."
John Lasseter, Co-Founder of Pixar Animation Studios

Password changed

_________________
A1200 ACA1232 128MB Indivison MkIICr
Elbox empty Power Tower
RPi3 Emulating C64 ZX Atari PS BBC
Wii with Amiga emulation
Vampire v4 SA

@Ratta

If someone hacked me and I started talking sh1te, I doubt you lot would notice
Last time I got a mail it was with an older password, but there’s no harm in being paranoid. Password changed anyway.

_________________
"Knowledge is power. Power corrupts. Study hard, be evil."

Great news, maybe now I can login with my original account instead of this new account, since the site admins never ever reply to anything.

_________________

@mobileconnect2

Hmm

I don't remember seeing any messages from you...

@thread

The passwords are stored in a one-way hash and should be fairly hard if not near impossible to decrypt even if the user had access to a dump of the database tables, assuming you have logged in since that breach occurred, since a login is required to store the password again. If you have not logged in, the password is still stored in the old manner since it's not easily decryptable, so we have no way of updating it, unless you log in, and essentially give us the password to crypt it again in a more secure way. That happens automatically when you login if you haven't logged in since the previous breach about 2 years ago and is a one time thing.

At the time of these "blackmail" e-mails we were fairly certain that the passwords being sent around were from an older breach, the password I've been using since then, is not available that I've seen anywhere on the web, if you have evidence to the contrary please point me to it.

_________________
---
Sibbi

Disclaimer:
The opinions stated do not neccesarily represent those of my employer.

I was one of the "victims" of this today I guess, but sibbi fixed it quickly!
Thanks sibbi !

Edit: And yeah my passw. was long before, but try me now! ;)

Last edited by khayoz on 24-Jan-2021 at 02:57 AM.

_________________

@sibbi

How many characters are significant in a password, or is that classified information?

_________________
"Unix is supposed to fix that." -- Jay Miner

@bison

the longeeeeeeeeeeeeeeeeeeeeeeeeeer the better of course.

Edit: It's back to paper and pencil I guess, analog as F*CK!

Edit2: Everything that can be protected can be hacked, are we not of that culture? ;)

Last edited by khayoz on 24-Jan-2021 at 03:52 AM.
Last edited by khayoz on 24-Jan-2021 at 03:50 AM.
Last edited by khayoz on 24-Jan-2021 at 03:49 AM.
Last edited by khayoz on 24-Jan-2021 at 03:47 AM.

_________________

DARKNET.

_________________
I HAVE ABS OF STEEL
--
CAN YOU SEE ME? CAN YOU HEAR ME? OK FOR WORK

@MEGA_RJ_MICAL

PURPLEHAZENET!

_________________

User passwords are not really relevant in the context of collecting email addresses of the users. The email address I have registered here is unique for this site, and it is receiving tons of spam and scam attempts, me changing the password or not is irrelevant.

_________________
B5D6A1D019D5D45BCC56F4782AC220D8B3E2A6CC

@Ratta

Quote:

Ratta wrote: As part of my personal information security I have darknet scanners ...

I don't know what your darknet scanner does or doesn't. It sound like snake oil to me.

People should check from time to time if there password where stolen:

https://haveibeenpwned.com/
https://haveibeenpwned.com/Passwords
https://haveibeenpwned.com/PwnedWebsites

Last edited by OneTimer1 on 24-Jan-2021 at 01:00 PM.

@OneTimer1
Avast also offer this sort of service - I just checked with them & my account appeared there and also my password was clearly visisble.

The details of the leak from from Avast are:

"Details of attack amigaworld.net 8,092 accounts affected

In November 2020, a collection of over 23,000 breached sites was leaked on several hacking forums and Telegram channels. These breached sites originated from Cit0Day, a now-defunct private subscription service marketed towards criminals. The leaked data primarily includes email addresses and passwords that Cit0Day offered for a daily or monthly subscription fee."

Last edited by fatbob_gb on 24-Jan-2021 at 01:40 PM.
Last edited by fatbob_gb on 24-Jan-2021 at 01:34 PM.

@khayoz

Quote:

the longeeeeeeeeeeeeeeeeeeeeeeeeeer the better of course.

Yes, but... It doesn't do any good to have a long password if only the first `n' characters are significant.

I use Theodore Ts'o's pwgen, which generates 8-character passwords, and if longer passwords are significant, then I paste a few of them together.

_________________
"Unix is supposed to fix that." -- Jay Miner

@OneTimer1

I am using Dashlane its a paid reputable service but others show this as well.

@fatbob_gb

yes this sounds like the same one that was flagged on mine

@Ratta

I mentioned this back in November when it occurred, but it disappeared quickly off the front page because nobody commented on it.
https://amigaworld.net/modules/newbb/viewtopic.php?topic_id=43980&forum=7&0

_________________
"Miracles we do at once, the impossible takes a little longer" - AJS on Hyperion
Avatar is Tabitha by Eric W Schwartz

@Ratta

I never dare to change my passwords due to yet another leak unveiled yet another day.

Otherwise, I would be sitting full-time and changing my passwords all over.

Bollocks!

_________________
Amiga 1200 + WARP 1260 + AmigaOS 3.2