Planet Descent
Planet Descent => PD Feedback => Topic started by: The Chief on January 07, 2011, 04:52:44 PM
-
Please change either your display name or username. Spammers are attempting logins using a display name which they found on the forum, and an algorithm to guess the password. By using a different username and display name, even in the unlikely event they guessed your password, they would not be able to login without also guessing your username. Sorry for the inconvenience!
-
Just a note that if you change your username, you will have to login with that new name, but the name displayed on the forum will not change. Make sure your e-mail address is correct, as you will need to verify via email. I believe it sends you a new password.
If you change your display name, you will still login with your old name. There is no e-mail verification for changing display name.
-
Regular users can't change usernames as far as I can tell. They can only change display name.
Also please keep your changed usernames short. I don't really like broken tables :/
-
That seems to be the case... I changed my password instead (to a random string of letters numbers and symbols). But I see how changing either could work. If I knew what the algorithm was I could probably attempt to foil it...
Edit: And now I'm changing my avatar to The N.I.P (a mysterious creature that no one knows anything about, not even its gender -- except me because I made it up... but I'm not telling... and from that you can probably guess what gender it is) and going into full-blown undercover disguise mode to make this fun. (Ya, everything can be fun). I'll tell Xaihyv. He hasn't made any posts but he could still theoretically be found by someone who has already logged in as someone else.
-
You are correct, no one can change their username. There is not even an option to enable it, there is in SMF2 which is why I thought you could.
The algorithm seems to be more a pseudo-random guess based on likely character combination, with a new guess every 8 minites, from a different IP each time. It was directed at one particular display name and while I won't mention who, I see he has changed his display name. They were not successful. The attack lasted three hours and twenty some odd miniatures this early morning.
Willy and Sapphire, please shorten your username.
-
done and done.
-
Well, this should be fun. ;D
-
3hrs and 20min, divided by 8 minutes... that's only 25 guesses. Not likely to guess a good password, but better safe than sorry!
-
Hmph
-
Yay?
-
Gee...this is...hard. I haven't ever registered on a forum and not used the username "Scyphi." I can't...I can't part with it! *sniff* :'(
Hence...my end solution. Meh, it'll do I guess. Meets the requirements at the very least and it keeps me somewhat happy.
'Cuz happy's good. :)
@ wazzazzle-previously-known-as-Alter-Fox: You're NIP looks kind of like an Ocelot (http://"http://en.wikipedia.org/wiki/Ocelot") but I'm guessing it isn't.
-
You should rename yourself to Revolver Ocelot if it is an Ocelot.
-
@ScyphiProductions it's not. I do have an ocelot pilot though.
It's not even a cat.
The precise reason I chose it for The N.I.P is because it's so obscure.
-
Why do I feel like we are all in the basement preparing for some tornado?
-
Maybe because of your signature? :P
I enjoy a chance to make a new character. It's like playing a mission for Descent that I haven't played yet.
-
Changed it all.... :o.
-
I'm afraid I'd lose my avatar forever if I changed it, or removed it.
-
So I come back after a four month hiatus to find that everyone's name is changed. If that's not confusing, I dunno what is. :D
Changed, and just dropping in to see if anything new is going on here. Filtering through four months of posts, here I come... :P
-
Welcome back. Hopefully we'll get this sorted and be able to change our names back soon. Though I'm kind of enjoying going into a full blown disguise.
-
Yeah it is fun. Remember, you don't know me :)
-
Changed it a little. I'm suprised no one guessed my password since it was a bunch of numbers.
-
I'm afraid I'd lose my avatar forever if I changed it, or removed it.
Can't you right-click - download it from here? Or does linux not allow that?
-
Please change either your display name or username. Spammers are attempting logins using a display name which they found on the forum, and an algorithm to guess the password.
No. No point in kowtowing to fear.
My "password" is now a randomly generated sha1sum, however, with extra characters tacked on. (44 characters).
-
I'm afraid I'd lose my avatar forever if I changed it, or removed it.
Can't you right-click - download it from here? Or does linux not allow that?
Its not a linux thing, its a me thing. Im sure I can get it back.
-
Please change either your display name or username. Spammers are attempting logins using a display name which they found on the forum, and an algorithm to guess the password.
No. No point in kowtowing to fear.
My "password" is now a randomly generated sha1sum, however, with extra characters tacked on. (44 characters).
This wisdom means much from an unknown with 5 posts.
-
This wisdom means much from an unknown with 5 posts.
I know it doesn't... -_- I'm just tired of being told or manipulated directly or indirectly for something (in life)... I know this problem is not the fault of anyone in this forum at all; I'm just being defiant of having to do or change something I have / had no intention of doing so. :-\
-
Perhaps we should set up a CAPTCHA (like many other forums I know). If a password is wrong, say, three times, it requests that the user also fills out a CAPTCHA of some sort. Wrongs would be global, not per session, allowing this to work no matter how many IP addresses the attacks are coming from.
EDIT: wait one second...
If you change your display name, you will still login with your old name.
So... this entire thing is actually pointless? Provided that person x involved didn't use a different display name from the get-go, changing the display name now would have no effect, since they still have the all important original username.
-
I thought the same thing today myself. If this is true, I'm going back to my old name.
@ wazzazzle: I swear I've seen a picture of that creature somewhere before...it's going to irk me until I figure it out...
-
Well, on second thought, it does have one benefit: in case they come back and get more names. But we don't know for sure how the thing works.
Really though, I'd say the captcha would be a much better solution than inducing what basically feels like a mass panic.
-
I wasn't ever panicked, I just did what they told me to do.
I don't particularly like captcha, but I know it works, so I suppose I could live with it. :)
-
if it's only displayed after three failed logins you'll probably won't be seeing much of it.
-
The problem with captcha is that it is not very effective anymore. More and more spammers are getting methods to break through it.
There is a mod over at SMF to login with an e-mail address. What do you guys think of that? So, instead of logging in with an arbitrary name, use your e-mail address, then use whatever you want for a display name.
-
What about an image captcha like the one I use on my forum?
With that captcha system that appears before registering you will be asked to select the pictures of a specific theme, e.g. select just the pictures of cars, that are mixed with a lot of other pictures of any other random theme.
Using that system I get rid of spammers on my forum (and they were a huge lot!!).
And the e-mail login option is not a bad extra either.
-
The problem with captcha is that it is not very effective anymore. More and more spammers are getting methods to break through it.
There is a mod over at SMF to login with an e-mail address. What do you guys think of that? So, instead of logging in with an arbitrary name, use your e-mail address, then use whatever you want for a display name.
(being a smart guy all along) hmm... something doesn't seem quite right. I can't quite put my finger on it, hmm.. oh yeah, our email address is in our profiles. :P (end being a smart guy)
now can it be hidden though, but still be able to receive such emails we received the night before? and here's my question. some of you raised some interesting question about profile ID names, and how they probably still have our ID names.
My question is this, why hack into our accounts? What benefit could they possibly have that would enable them to do that? All of our information on here could be private if we choose it to be, or public. there certainly isn't any checking account numbers or debit card numbers, social security or anything.
I can think of one, but I don't want them to get a tip, but really, what is the harm, except for this one thing I am thinking.
If they screw up my ID, ban him, and have me open a new. it'd be annoying though.
going back to what WillyP suggests, I am all for it, if the email is private and we can receive emails like this, why not? I am all fine with it. and if one doesn't mind, if he/she feels they want to, set up a poll and see if others are fine with it or not.
What about an image captcha like the one I use on my forum?
With that captcha system that appears before registering you will be asked to select the pictures of a specific theme, e.g. select just the pictures of cars, that are mixed with a lot of other pictures of any other random theme.
Using that system I get rid of spammers on my forum (and they were a huge lot!!).
I've seen that in some places, banks, or other places like that. I suppose it works. I have no idea. But I am for that too. I have a lot stored in my head, passwords and such, and may get something on paper, not file, that shows a list of emails, usernames, etc.
emails logins are nice, granted they aren't used to hack into a system, less to remember.
"now was that, Vanguard-643 to get into that site, or was it vanguard-phonenix-675?"
-
(being a smart guy all along) hmm... something doesn't seem quite right. I can't quite put my finger on it, hmm.. oh yeah, our email address is in our profiles. :P (end being a smart guy)
You can't see anyone's profiles or even the memberlist unless you're logged in. So the spammer would need to have already stolen someone's ID and logged in as them to find your email.
@Scyphi -- http://www.google.ca/images?q=crested+genet&hl=en&client=firefox-a&hs=waf&rls=org.mozilla:en-GB:official&prmd=ivns&source=lnms&tbs=isch:1&ei=1r8oTarwF9XZngfsxfWvAQ&sa=X&oi=mode_link&ct=mode&ved=0CAoQ_AU&biw=1366&bih=586 (http://www.google.ca/images?q=crested+genet&hl=en&client=firefox-a&hs=waf&rls=org.mozilla:en-GB:official&prmd=ivns&source=lnms&tbs=isch:1&ei=1r8oTarwF9XZngfsxfWvAQ&sa=X&oi=mode_link&ct=mode&ved=0CAoQ_AU&biw=1366&bih=586)
And now I've ruined N.I.P's alien-ness.
In the Maximum Vertigo (very ambitious Operation Otter sequel) story N.I.P's species actually is an alien (the N.I.P itself doesn't appear but there will be two others who are very important secondary characters -- named Six-Times-Four [female] and Umwaar [male, named as an onomatepia of a sound in the d3 mercenary level 5 music]).
You can probably figure out N.I.P's gender just from the fact that I don't want to divulge it too... It makes it very awkward when I'm playing online and someone wants to know the genders of the players on the server -- it's happened a few times.
Please change either your display name or username. Spammers are attempting logins using a display name which they found on the forum, and an algorithm to guess the password.
No. No point in kowtowing to fear.
My "password" is now a randomly generated sha1sum, however, with extra characters tacked on. (44 characters).
This wisdom means much from an unknown with 5 posts.
He's not unknown, he just didn't come back to Descent until recently. If you've played the Lunar Outpost MN0019 mission for Descent 3 you've seen his work. (MN0012 was D1 btw)
-
You can't see anyone's profiles or even the memberlist unless you're logged in. So the spammer would need to have already stolen someone's ID and logged in as them to find your email.
Couldn't they just register and then find out?
-
I think all registrations have to be admin-approved.
Pumi Pashuli Omuyi
Vertex9's full name?
-
Please change either your display name or username. Spammers are attempting logins using a display name which they found on the forum, and an algorithm to guess the password.
No. No point in kowtowing to fear.
My "password" is now a randomly generated sha1sum, however, with extra characters tacked on. (44 characters).
This wisdom means much from an unknown with 5 posts.
Sky may not have a large post count but he is hardly an unknown in this community. And he is right, to the extent that a strong password is as good a defense as any, but not every member has a good password, so having a hidden login name is equivalent to having two passwords. In that two character sequences would have to be guessed.
And as far as what they would have access to, no, they would not have had access to member e-mails or any sensitive data, but they would have been able to do anything a regular member would do, including uploading files, sending pm's etc... It is also possible someone found some vulnerability with a script that could be exploited, who knows? The fact that they were attempting every 8 minutes with a different ip, tells me it was a purely automated script, and there are numerous reports from others on the SMF site. We have also been flooded with a massive increase in the number of spam registration attempts, many are blocked automatically, many more are flagged as known spammers, which means an admin must reject it.
-
Well this is one of the most successfully spam-free forums I've ever seen, I have no doubt we can keep it up.
-
Pumi Pashuli Omuyi
Vertex9's full name?
Exactly. ;)
-
@ wazzazzle: Ah! Yes! That's it! That's what animal it was, I thought I knew it! :D
I'm getting very curious about this storyplot for Operation Otter...how close is it to being released so I can learn all the details?
There is a mod over at SMF to login with an e-mail address. What do you guys think of that? So, instead of logging in with an arbitrary name, use your e-mail address, then use whatever you want for a display name.
I'm a-okay with this. :)
-
Operation Otter is not very close, but the prequel is very close.
It's really just like a normal Descent mission with a twist in the middle and near the end.
I have a few bugs to iron out of the prequel though, some of the matcens are corrupted and spawning boss robots. If I can't fix it, I'll just add hxms that turn all the bosses into class 1 drones :P.
-
There is a mod over at SMF to login with an e-mail address. What do you guys think of that? So, instead of logging in with an arbitrary name, use your e-mail address, then use whatever you want for a display name.
More and more of the online resources I use as part of my job (computer tech with extra specialty in printers and MFP copiers) ... have been switching to using the email address to login. While it seems to be working/helping the spam issues (at least for some) ... it's sometimes a pain for people like me. I have over 15 different email addresses (for me, myself, and I) and over 8 of them are actively used frequently. Sometimes I have to stop and think a minute about what email address I use with which site.
But I suppose most users of this forum won't have to deal with that. In all honesty, the email address I use with this site is not a problem to remember, ever.
-
I have three. One for friends, one for companies like amazon, planetdescent, bank etc and one in case I don't trust the sites
-
I have...one.
No, I take that back, I have two!
But I hardly ever use the other one.
So...really just one. :P
-
I have one for trusted sites like this, and another for sites I don't trust (named for the CED general in D3 Mercenary). I want to get an email for "professional stuff" as well but my family has been changing service providers a lot recently (and since it's traditionally the service provider who gives you your professional email adress it would be very confusing for someone trying to contact you). What happened was we recently switched from Shaw to MTS, and now Shaw wants to get us back and is offering us better deals (and we're seriously considering switching back the last I heard).
-
i tend to prefer the providers domain or whatever you call it (@whatever it is.net or .com, or other, like mediacom, comcast, qwest, etc), which I think is what you're talking about wazzazzle, but sorry if I am wrong.
But I am sick of changing email addresses if I move and some provider says I can't keep my email because of the person I am moving into has it already (like my sister), or "we don't have service there".
I just have a gmail account to take care of planetdescent, amazon, best buy, bank, etc. and then my other one for friends. this way, if I move and I get this "we don't have service out there". I just inform my tiny small network of friends the new address and not have to worry about going into planetdescent, best buy, etc etc..., updating the profiles, etc with the new email address.
hey, we're still sort of on topic. sort of.
-
Did some of you really need to go and change everything (display name, avatar, sig)?
It's taking me a while to re-establish who some of you are.
-
most should know me. I think I know most others, partially by the name that hasn't changed much and an avatar that hasn't at all.
It's amazing how one little thing like this can make others not know you. and welcome to PD phoil! nice to have you on board :)
-
No, you're fine, Van. Recognized you from the avatar. :)
-
cool 8)
In all honesty, I don't quite understand why we are going undercover. if they break into our account, what can they do? hijack it? write nasty posts? and with all due respect, this isn't exactly a large fast pace forum. and we don't use credit cards to use the forums, or social security numbers.
Do we even know if this person or group of people are even trying?
-
They have not been back, and honestly I think it was just a bit of panic in the first place. If it had been able to change the login name, that would make more sense, but now they have a login name. Since that did not change, they still have it. And that person does not have a high level of access, so the most they could have done is upload malicious files, as attachments, in the gallery and in the files section. Also sent spam pm's, posted spam in the forum, etc...
I don't think they could have run code in a file uploaded on the server, if that was true it would be a major security risk, and it has happened sometime ago that someone uploaded an avatar on the Descent Guides forum and ran embedded code in it. That code injected into every .php file on the whole site, and I noticed because the DescentiaPedia was broken. This happened at a lot of SMF forums, and the next step was that they would upload thousands of files, and turn the server into a virus distribution center. SMF quickly issued a patch and closed the vulnerability.
-
it's been a slow long day, and I feel my brain is on idle. Did you say they have not come back, but have some login name? or is all this past tense?
edit: they have a login name, I see it now I think. they may have written down ours.
-
I'm assuming you contacted the person they tried to log in as. Then they know and the rest of us can rest assured it wasn't us.
Did some of you really need to go and change everything (display name, avatar, sig)?
It's taking me a while to re-establish who some of you are.
It took me a few hours to figure out who Matthew was (my brain was in slow motion).
-
Yes, as soon as I saw the logs I sent a pm, thinking they could change their login name. Now, the login name is probably on some spammers database somewhere. I asked everyone else to choose a different display name so if they scanned the forum again, they would not get another valid login name. They will only get a display names which should now be different from the login name. Except of course for the fact that most members did not change. But as Sky pointed out a good password should be hard to guess, so it very unlikely that anyone's account would get compromised.
If your account gets hacked, unless you are an admin or moderator, the only real damage that could be done is spamming and access to your e-mail account. And your account will get banned or deleted. Oh, and don't use a common password for your e-mail they will probably try your password at your e-mail provider.
-
but I like Darkflamewolf, I've never been anything else! O_o
-
Just to let y'alls know that my current display name is just a temporary disguise name to prevent me from being hacked.
-
I was in a convenient position because anyone here who knows me at all knows that I also go by Wazzazzle... but the spammers don't :D.
I was afraid my old avatar might give part of it away if they brought in an actual human though.
-
I doubt they would spend much time trying to figure anything out.... It's a numbers game, they hit as many as they can and if they get in, fine, if not, they are on to the next...
-
lol I only changed my name. I just never had a sig or avatar in the first place :P
What gave it away?
-
Well for me, I don't know, I just kind of figured you were Matt. Maybe it was your style of posting, or maybe it was mere process of elimination after I figured out everyone else's.
-
I'm not sure if I should be flattered or ashamed.
-
So when are you guys switching your names back? I joined just a few days ago RIGHT AFTER this whole name changing happened. I guess, keep your avatars the same for me, eh?
-
I've already changed my avatar back so you're out of luck there.
I can keep my name the same for a while though, wazzazzle is just as legit for me as AlterFox if not more (it feels like a second real name, and one that's not totally overused by Czechs like my real real name).
-
Hmm, perhaps we should change our profile information around more. See how much we can confuse everyone
:P
-
I know im not the only one, but this has really been my only avatar. I think I remember trying a black backround with red word that said VANGUARD.
im thinking though on changing my avatar. I may get a mac soon, and lately I haven't had the best luck with linux
-
If you have 1000$ to spend on a 500$ computer, go right ahead and get a mac.
Insanity had me stumped... I had to check his profile D:
-
I never even noticed his name change until I read your post just now. I only see his avatars.
-
Mine was JB-COM for a tad while, only because of the email.
edited by me:
I understand, macs aren't cheap, but I need a good OS that is hopefully compatible with most things. Linux is nice, but isn't has compatible with things like I want it to be.
Windows, eh..not the best. XP Pro was my favorite, for what you get out of it. That was a nice OS.
I just want something nice to work on or play, and know it will take care of the job, and yes, my tax refund is a nice $1200 or so, usually. We'll see this year.
-
All I did with my username was tack on an extra word to it.
And I hate it to all heck, too, it's just doesn't work for me as a username. The moment it's made clear it's okay to go back to the old names, I will in a heartbeat.
Avatar is unchanged, but when I changed the name, I did consider it.
-
I wonder if it's related to all the "guests" that appear online in the middle of the night. There's a lot of guest traffic at, say 2-4am, Central Standard Time.... I'm a night owl, so I'd be checking out who's online and at one point there were like 4 or 5 guests. I was like, what are y'all DOING?
-
All I did with my username was tack on an extra word to it.
And I hate it to all heck, too, it's just doesn't work for me as a username. The moment it's made clear it's okay to go back to the old names, I will in a heartbeat.
That's one of the reasons I like what I chose to set for my Display name. ;)
-
I think I may just keep mine :P
-
didn't mean to nag or be impatient but... are the hackers removed yet?
I would LOVE to revert back to normal.
-
My new look will probably be permanent for a while. Though the hackers didn't have anything to do with the new look/name.
And it's just the rules, each community must have at least one furry. :P
-
What about Kyouryuu?... oh wait, he's a "Scaly" :P.
-
didn't mean to nag or be impatient but... are the hackers removed yet?
I would LOVE to revert back to normal.
Yes go ahead, no evidence of them since. If it does happen again, we'll got to login with e-mail address, that way everybody will be covered, and not have to change names.
-
Phew, glad to know that. Switching to my normal username now! :D
-
I personally thought we had a lot of furries on the site already... :-\
Glad to know this, changing back immediately... :D
-
I don't know if I would consider myself a furry, I just thought the name sounded cool, and it has stuck. :D
-
I actually was thinking more about Darcshadow and Alter-Fox, then myself, which leans a little in the direction of furries on occasion (but I dunno where exactly I stand on that).
And I'm sure there have been others, just not as readily apparent.