What does “Change your password everywhere else” e-mail from compromised service mean?

Question

I've recieved an e-mail from ubuntuforums.org a couple of hours ago:

[...] the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum database.

If you have used this password and email address to authenticate at any other website, you are urged to reset the password on those accounts immediately as the attacker may be able to use the compromised personal information to access these other accounts. It is important to have a distinct password for different accounts [...]

For me that piece of text sounds like:

We do not use salts, and we use MD5 to hash passwords, so you should change your password everywhere on the net because a lot of services do the same "hashing method".

So, the question (compared to "We use strong password encryption methods with salts and such, so here's your one-time login, you will be asked to change your password upon signin, no need to change your passwords everywhere") is: do that kind of reaction from a compromised service tells you about how bad their security is?

Answer 1

No, this is standard practice and a liability limitation attempt by lawyers. It is entirely possible for someone to reverse a weak password even from properly hashed and salted values if they feel like spending the time. Salts make it slower, but they don't prevent it from breaking on weak passwords.

If your password gets compromised, they don't want to be liable when the hacker logs in to your bank account and clears out your life savings, so they suggest changing any accounts that shared the username and password.

Personally, I generally don't worry too much about this notification as long as you have a secure password that can't be easily brute forced, but the message verbiage is par for the course.

Answer 2

I think it is the duty of the owners of any compromised application to alert its users about the compromise. The email is not directly telling you that their security is bad or not. But instead it warns you about changing passwords if in case of the worst scenario.

As long as your password it safe , you don't have a need for panic. But for others with a weak password, a panic is good. They can take care of remaining accounts.