Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Drupal.org compromised

drupal.org

Post reply on HN
Print view View original

11–20 of 86 posts

Re: Drupal.org compromised

#11

Post by geerlingguy »

danielhunt wrote: post #9

I don't know if they've invalidated my password, or if the attacker has already accessed my account, but I can't login with my details. I can't help but think that they would be better off just doing an UPDATE users SET password=''; , and relying on the forgot-password functionality to let users get access again edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of…

I think they already reset all passwords, because I'm in the same boat. I put in a reset request, which was accepted, but didn't yet get the email with the reset link.

I'm guessing whatever mailing queue they have set up is completely back logged right now until it finishes sending out the general account compromise email (displayed elsewhere in this thread). At least, that's my best guess. I haven't gotten that email yet.

Re: Drupal.org compromised

#12

Post by specto »

danielhunt wrote: post #9

I don't know if they've invalidated my password, or if the attacker has already accessed my account, but I can't login with my details. I can't help but think that they would be better off just doing an UPDATE users SET password=''; , and relying on the forgot-password functionality to let users get access again edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of…

Same here, I know I used one of three passwords, and I'd like to know which one I stupidly used.

Re: Drupal.org compromised

#13

Post by danielhunt »

pstinnett wrote: post #10
danielhunt wrote: post #9

I don't know if they've invalidated my password, or if the attacker has already accessed my account, but I can't login with my details. I can't help but think that they would be better off just doing an UPDATE users SET password=''; , and relying on the forgot-password functionality to let users get access again edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of…

Also not able to login. I ran the forgot password functionality but their FAQ says it could take up to 15 min. to receive the email.

It took me about 4 minutes to receive the email - once I got it, the servers were quite responsive. Just give it a few minutes ... it'll get to you eventually

Re: Drupal.org compromised

#14

Post by _jmar777 »

Moderately miffed that the email they sent out notifying how THEY allowed my password to be compromised included a lecture telling ME how to construct a strong password. Not the time, or place.

Besides, they claim it was salted, so it shouldn't really matter at this point whether my password was "Password123" or "@DJDF*$@!(DGEWGIRGHdfhEWROighMMMM...PIZZA".

Re: Drupal.org compromised

#15

Post by jtolj »

danielhunt wrote: post #9

I don't know if they've invalidated my password, or if the attacker has already accessed my account, but I can't login with my details. I can't help but think that they would be better off just doing an UPDATE users SET password=''; , and relying on the forgot-password functionality to let users get access again edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of…

Ditto. I'm unable to login with my credentials, and have yet to receive the password reset I requested (although I assume they are getting a lot of those right now, so it may be queued). All these compromises sure are getting tiring. I've already been hit with Evernote, LivingSocial and Linode so far this year (that I'm aware of).

Re: Drupal.org compromised

#17

Post by [deleted] »

danielhunt wrote: post #9

I don't know if they've invalidated my password, or if the attacker has already accessed my account, but I can't login with my details. I can't help but think that they would be better off just doing an UPDATE users SET password=''; , and relying on the forgot-password functionality to let users get access again edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of…

[deleted]

Re: Drupal.org compromised

#18

Post by itafroma »

_jmar777 wrote: post #14

Moderately miffed that the email they sent out notifying how THEY allowed my password to be compromised included a lecture telling ME how to construct a strong password. Not the time, or place. Besides, they claim it was salted, so it shouldn't really matter at this point whether my password was "Password123" or "@DJDF*$@!(DGEWGIRGHdfhEWROighMMMM...PIZZA".

> Besides, they claim it was salted, so it shouldn't really matter at this point whether my password was "Password123" or "@DJDF*$@!(DGEWGIRGHdfhEWROighMMMM...PIZZA".

Salting a hash isn't a license to use incredibly weak dictionary passwords like "Password123". All it does is prevent against rainbow table attacks, where an attacker uses a pre-computed list of password-to-hash combinations to determine if you used one of them, and slightly slowing down a brute force attack. Due to the speed of brute force attacks these days, rainbow tables aren't really in vogue anymore anyway, so it winds up only buying a bit of time.

Ars Technica had a recent story about this: http://arstechnica.com/security/2013/05/how-crackers-make-mi...

Re: Drupal.org compromised

#19

Post by danielhunt »

specto wrote: post #12
danielhunt wrote: post #9

I don't know if they've invalidated my password, or if the attacker has already accessed my account, but I can't login with my details. I can't help but think that they would be better off just doing an UPDATE users SET password=''; , and relying on the forgot-password functionality to let users get access again edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of…

Same here, I know I used one of three passwords, and I'd like to know which one I stupidly used.

I linked to this in my edit, but it's worth re-linking here: https://agilebits.com/onepassword

Use it. And never look back :)

Re: Drupal.org compromised

#20

Post by specto »

specto wrote: post #12
danielhunt wrote: post #9

I don't know if they've invalidated my password, or if the attacker has already accessed my account, but I can't login with my details. I can't help but think that they would be better off just doing an UPDATE users SET password=''; , and relying on the forgot-password functionality to let users get access again edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of…

Same here, I know I used one of three passwords, and I'd like to know which one I stupidly used.

I much prefer lastpass, and keepass for everything else.
Post reply on HN