7

I've recieved an e-mail from ubuntuforums.org a couple of hours ago:

[...] the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum database.

If you have used this password and email address to authenticate at any other website, you are urged to reset the password on those accounts immediately as the attacker may be able to use the compromised personal information to access these other accounts. It is important to have a distinct password for different accounts [...]

For me that piece of text sounds like:

We do not use salts, and we use MD5 to hash passwords, so you should change your password everywhere on the net because a lot of services do the same "hashing method".

So, the question (compared to "We use strong password encryption methods with salts and such, so here's your one-time login, you will be asked to change your password upon signin, no need to change your passwords everywhere") is: do that kind of reaction from a compromised service tells you about how bad their security is?

|improve this question
  • It means if you used that password with any other accounts on other sites you should change those passwords so they cant attack you accout from another site your on – h4ck3r Jul 24 '13 at 6:05
  • @Redstone I understand what password hash compromising may lead to, the question is whether emails filled with panic (urged, immediately) are signs of badly implemented security (i.e. password hashes may be reversed very quickly). – НЛО Jul 24 '13 at 6:25
  • 1
    Damn, I also got this email, I had to change 37 site's passwords, just in case ... – Afr Jul 24 '13 at 6:55
10

No, this is standard practice and a liability limitation attempt by lawyers. It is entirely possible for someone to reverse a weak password even from properly hashed and salted values if they feel like spending the time. Salts make it slower, but they don't prevent it from breaking on weak passwords.

If your password gets compromised, they don't want to be liable when the hacker logs in to your bank account and clears out your life savings, so they suggest changing any accounts that shared the username and password.

Personally, I generally don't worry too much about this notification as long as you have a secure password that can't be easily brute forced, but the message verbiage is par for the course.

|improve this answer
  • That "lawyers" side is quite interesting, never thought of this mails in such a way, thanks. – НЛО Jul 24 '13 at 6:16
  • From what I read today, the passwords are stored as MD5(MD5('password')+salt) That will take a little longer than some ways of storing passwords, could be better, could be worse. Take what precautions you think are best given the situation. I would start changing passwords if I had an account there and accounts elsewhere with the same password, but I think it can wait till the evening, no need to drop everything to change passwords. – Rod MacPherson Jul 24 '13 at 19:18
2

I think it is the duty of the owners of any compromised application to alert its users about the compromise. The email is not directly telling you that their security is bad or not. But instead it warns you about changing passwords if in case of the worst scenario.

As long as your password it safe , you don't have a need for panic. But for others with a weak password, a panic is good. They can take care of remaining accounts.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.