I've recieved an e-mail from ubuntuforums.org a couple of hours ago:

[...] the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum database.

If you have used this password and email address to authenticate at any other website, you are urged to reset the password on those accounts immediately as the attacker may be able to use the compromised personal information to access these other accounts. It is important to have a distinct password for different accounts [...]

For me that piece of text sounds like:

We do not use salts, and we use MD5 to hash passwords, so you should change your password everywhere on the net because a lot of services do the same "hashing method".

So, the question (compared to "We use strong password encryption methods with salts and such, so here's your one-time login, you will be asked to change your password upon signin, no need to change your passwords everywhere") is: do that kind of reaction from a compromised service tells you about how bad their security is?

  • It means if you used that password with any other accounts on other sites you should change those passwords so they cant attack you accout from another site your on
    – h4ck3r
    Jul 24, 2013 at 6:05
  • @Redstone I understand what password hash compromising may lead to, the question is whether emails filled with panic (urged, immediately) are signs of badly implemented security (i.e. password hashes may be reversed very quickly). Jul 24, 2013 at 6:25
  • 1
    Damn, I also got this email, I had to change 37 site's passwords, just in case ...
    – q9f
    Jul 24, 2013 at 6:55

2 Answers 2


No, this is standard practice and a liability limitation attempt by lawyers. It is entirely possible for someone to reverse a weak password even from properly hashed and salted values if they feel like spending the time. Salts make it slower, but they don't prevent it from breaking on weak passwords.

If your password gets compromised, they don't want to be liable when the hacker logs in to your bank account and clears out your life savings, so they suggest changing any accounts that shared the username and password.

Personally, I generally don't worry too much about this notification as long as you have a secure password that can't be easily brute forced, but the message verbiage is par for the course.

  • That "lawyers" side is quite interesting, never thought of this mails in such a way, thanks. Jul 24, 2013 at 6:16
  • From what I read today, the passwords are stored as MD5(MD5('password')+salt) That will take a little longer than some ways of storing passwords, could be better, could be worse. Take what precautions you think are best given the situation. I would start changing passwords if I had an account there and accounts elsewhere with the same password, but I think it can wait till the evening, no need to drop everything to change passwords. Jul 24, 2013 at 19:18

I think it is the duty of the owners of any compromised application to alert its users about the compromise. The email is not directly telling you that their security is bad or not. But instead it warns you about changing passwords if in case of the worst scenario.

As long as your password it safe , you don't have a need for panic. But for others with a weak password, a panic is good. They can take care of remaining accounts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .