forum hacked

[metulburr]

Wow! Bookmarked buy/sell guns ?  [Image: biggrin.png]

oh yeah, that is due to facebook's recent anti gun sell/buying rules in groups. Now everyone just sells a gun via "i want to discuss this gun". 


nevermind the torrents 

[wavic]

I was unable to open the forum. It opens 'change password' all the time. So I did it finally. I am asking for removing the 30 characters restrictions for the pass length.

[metulburr]

I am asking for removing the 30 characters restrictions for the pass length

there is no length restriction that long

[Kebap]

I was unable to open the forum. It opens 'change password' all the time. So I did it finally.

Indeed we chose to force all users to update their passwords. This is because the hackers crackers may have a copy of your old passwords. You should also change all other places where you may use the same passwords (better never use the same password in multiple places)

the 30 characters restrictions for the pass length.

metulburr, there is this message:

Please correct the following errors before continuing:

• The password you entered is of invalid length. Please enter a password between 6 and 30 characters.
  

[metulburr]

The password you entered is of invalid length. Please enter a password between 6 and 30 characters.

oh i thought you guys meant it was requiring at least 30 characters.

[wavic]

Indeed we chose to force all users to update their passwords. This is because the hackers crackers may have a copy of your old passwords. You should also change all other places where you may use the same passwords (better never use the same password in multiple places)

Are you saying that the passwords were kept in plain text but not as hashes?

[Skaperen]

http://imgur.com/a/ZtbOn

and mybb admin login was inaccessible as well as server access.

Wow! Bookmarked buy/sell guns ? 

they may get our bits, but not our guns

---

The password you entered is of invalid length. Please enter a password between 6 and 30 characters.

oh i thought you guys meant it was requiring at least 30 characters.

the first one i tried was len(pw) == 54.  i tried again with pw[:30].

[Kebap]

Indeed we chose to force all users to update their passwords. This is because the hackers crackers may have a copy of your old passwords. You should also change all other places where you may use the same passwords (better never use the same password in multiple places)

Are you saying that the passwords were kept in plain text but not as hashes?

No, this is just extra safety measure

[verstapp]

*salted* hashes!

---

...and when requesting a password change it is so much better if you put all your conditions up front, eg

''please enter your new password. it must have
<condition1>, eg minimum length,
<condition2>, eg max[why?] length,
<condition3>, eg must-be-used characters,
<condition4>, eg disallowed characters[why?]
etc,
etc,''
rather than have the user find out by trial-and-error [and many ''invalid pwd''s] what the parameters of a valid pwd are.

[Skaperen]

pick a maximum password length of 255 and people might speculate it runs on MS Windows. i once told people that the maximum password length on a site was 65535. someone said he tested it and called me a liar. ok so i did lie. i'll say 4294967295 next time.