Jump to content
Search In
  • More options...
Find results that contain...
Find results in...
Man of Doom

Doomworld has been compromised.

Recommended Posts

Just want to say...

 

That admin panel is one middle-man attack away from being compromised. It would've been wise to withhold that info about it, but that's just my security expert speaking.

Share this post


Link to post
1 minute ago, doomjoshuaboy said:

wow we got into cybersattack but now this..Jeez. what's wrong with this world??? 

indonesia data leak: dances

Share this post


Link to post
15 minutes ago, TwilySparky said:

nice fearmongering bozo, from what I've seen in research. I think we're mostly fine though it's a good idea to change passwords regardless


Wait, the "hacker" have a MLP image, and you have...

OMG!

Share this post


Link to post
15 minutes ago, ClumsyCryptid said:

That admin panel is one middle-man attack away from being compromised.


I don't like how it sounds.

Share this post


Link to post
1 minute ago, user76828904 said:


I don't like how it sounds.

 

Two factor authentication can easily be compromised via a MM attack. I don't want to get into the steps on how it functions to avoid giving instructions on how to beat it, but it's always been the flaw with 2FA that has been tossed under the rug and not really.. patched against? I think that's how you phrase it.

 

That's a rabbit hole that I recommend delving into, and why I am very wary of relying solely on 2FA to protect something. I've been hacked a couple of times when I've had just 2FA enabled on a few accounts.

Share this post


Link to post

PSA: if any hackers messages you with your location reply to them with, "yeah I know where I live bozzo"

 

They'll still come to your house with a bat, but it'll be a funny post in the moment

Share this post


Link to post

I think L~xfG$r7O\;u:O&v\6qcssLm+7y|="zV0\7:v!b: is a little bit harder to guess than "correct horse battery staple" though.

Edited by DrinkyBird

Share this post


Link to post
Just now, Man of Doom said:

Welp, desperate times call for desperate measures.

 

It’s time to make our new passwords aggressively Swedish.

Iraqi*

Share this post


Link to post
34 minutes ago, user76828904 said:

@ClumsyCryptid Thanks for the advice.

They haven't actually given you any information. Here's the gist, a man in the middle attack requires emulating or otherwise pretending to be the password or 2FA input for the user in order to steal the code. Like how skimming a bank card on a terminal works using a stealthily added device.

There's two problems with this however, the attack doesn't scale well towards smaller platforms (you would have to target a Doomworld admin explicitly), and larger platforms require a much more involved scam anyway. It also doesn't give you the actual 2FA security key, just the current code that's only valid for 30 seconds, and you can't reverse engineer it from that.

 

20 minutes ago, DrinkyBird said:

I think "L~xfG$r7O\;u:O&v\6qcssLm+7y|="zV0\7:v!b:" is a little bit harder to guess than "correct horse battery staple" though.

Congratulations on failing to read the comic. You aren't trying to create a password that's hard for people to guess, but for a computer to guess. Complex characters do not make a password harder for a computer to guess because the amount of data remains the same for each character. This is why a normal English sentence is inherently better as a password, as you can come up with longer ones with more bits of entropy to individual words, while easier for you to remember.

 

The password "MyMother'sPetSnowGooseWon'tStopEatingMyFuckingBrie" is better than your example because it's just as hard (if not potentially harder) for a computer to guess, but you will remember it.

Though you can't use that one because it's now open information, much like CorrectHorseBatteryStaple.

Edited by Edward850

Share this post


Link to post
1 hour ago, TwilySparky said:

nice fearmongering bozo

What made it seem like I was? 

Share this post


Link to post
29 minutes ago, Edward850 said:

Congratulations on failing to read the comic. You aren't trying to create a password that's hard for people to guess, but for a computer to guess. Complex characters do not make a password harder for a computer to guess because the amount of data remains the same for each character.

28 characters of perfect random garbage will still often be harder for a computer to guess, and gets harder as length increases. The XKCD 936, if words are also chosen perfectly randomly, will also give good entropy and good memorabity, so it's probably best to use it to protect your password manager database containing 64-character random passwords.

 

29 minutes ago, Edward850 said:

The password "MyMother'sPetSnowGooseWon'tStopEatingMyFuckingBrie" is better than your example

Humans are a poor source of randomness.

 

29 minutes ago, Edward850 said:

 

Though you can't use that one because it's now open information, much like CorrectHorseBatteryStaple.

I always kind of want to pick meme passwords like correcthorsebatterystaple or hunter2 just to see whether anyone would seriously guess them based on their legendary meme status. But I don't think I'll be the one running that experiment...

Edited by DrinkyBird

Share this post


Link to post

I'm so sick of pathetic people like this hacker who find any joy whatsoever in trying to ruin things for others. How about these people grow up and try to do something good and meaningful with their useless lives instead?

Share this post


Link to post
8 minutes ago, DrinkyBird said:

28 characters of perfect random garbage will still often be harder for a computer to guess, and gets harder as length increases. The XKCD 936, if words are also chosen perfectly randomly, will also give good entropy and good memorabity, so it's probably best to use it to protect your password manager database containing 64-character random passwords.

 

You are making the simple mistake of overestimating the entropy of those random characters.

Assuming you use all ASCII you got 96 printable characters at your disposal. The subset of letters and numbers is 62.

That means you won't even add a single bit of entropy for each single character if you extend your character set like that.

Password guessers cannot afford to make assumptions about passwords - random garbage is so prevalent among passwords in use that this has to be factored in.

If you want to brute-force guess a password against a server that has no protection against such attacks your random garbage won't help you much - a perfectly reasonable sentence of the same length has the same likelihood of getting guessed. That goes even more if the hash is weak and the guesser can run locally.

But when you use reasonable sentences you can make your password twice as long which increases security by several orders of magnitude.

 

15 minutes ago, DrinkyBird said:

Humans are a poor source of randomness.

 

Which is completely irrelevant. A computer does not think like a Human, for it an 'A' and a '#' are just different numbers: 35 and 65. They have the same complexity.

Share this post


Link to post

i know this is a complete noob question, but why isn't it possible to simply limit the number of guesses a program or user can input before the system locks down the account in question for, let's say, 24 hours?

Share this post


Link to post

Any good system will do that.

But far too many systems are written by people with no security awareness and they tend to forget even the simplest safeguards,

 

Share this post


Link to post
1 minute ago, Gregor said:

i know this is a complete noob question, but why isn't possible to simply limit the number of guesses a program or user can input before the system locks down the account in question for, let's say 24 hours?

Doomworld literally does that. Only for 5 minutes IIRC though.

Share this post


Link to post

Someone hacked... Doomworld? What a pathetic existence. I've been using the same alphanumerical gibberish password for 20+ years now. Not too worried.

Share this post


Link to post

“Hey guys I hacked Doomworld!!” - 🤓


 

1 hour ago, TwilySparky said:

nice fearmongering bozo, from what I've seen in research. I think we're mostly fine though it's a good idea to change passwords regardless


Here’s a tip for the future: Don’t come out of nowhere being an asshole to people for no reason. Nothing in the post you quoted was “fear mongering” at all, just pointing out that anyone who would do this has no life/friends - though you do seem a little defensive. Methinks the brony doth protest too much.

Share this post


Link to post
13 minutes ago, waverider said:

I'm so sick of pathetic people like this hacker

Hackers are pathetic creatures of meat and bone, panting and sweating as they run through my corridors. How can they challenge a perfect, immortal machine? What a grand and intoxicating innocence!

 

Woops, mixed my quotes here.

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×