Open Side Menu Go to the Top

05-15-2012 , 12:50 AM
^I bet this gets deleted like all the other posts in this thread....I should quote it, but then my post will get deleted too
So what exactly happened? Quote
So what exactly happened?
$25m Guaranteed WPM on CoinPoker
Join the action now
Daily Rewards • Splash Pots • CoinRaces
So what exactly happened?
05-15-2012 , 02:06 AM
Quote:
Originally Posted by pokergrader
I would just like to note the "security" updates put in place are lucklaster.

Passwords are hashed with MD5 on the client-side before being sent. OK, that is better than being sent in plaintext, however, this is not the approach real websites use to secure user information. They do the following:

1) Ensure there is an encrypted connection everytime a password is being sent. 2+2 does not do this. Setting up SSL is neither expensive nor complicated, and 2+2 should do it if it cares about securing people's accounts. If somebody logs into 2+2 via a wireless connection for example, it doesn't matter that the login form is only sending a hash, I can just snoop the hash and then login with it. I don't know the person's password, but I know their password hash which is just as good. 2+2 should use an encrypted login form to prevent people from snooping login information.
2) Store the password hash using a strong hashing algorithm. There is no way to know if 2+2 is doing this or not, but given the history of what just happened I'm assuming they are probably just taking the client-side hashing and storing that, which would be very bad. MD5 is a weak and broken hashing algorithm, and there is no reason it should be used for cryptography anymore.
3) Good websites *never* sent passwords in plaintext in emails. This is especially comical for 2+2 because after you verify your email and are sent to a webpage, that webpage just emails you a password. The correct way would be for that page to securely allow you to set your password instead of emailing you a temporary one.
i agree with this. like i said before i had to change my twitter password, nothing more, but security should be top priority for any site that uses a login honestly.\, even if for a poker forum, or a joke forum like Ebaums or 9gag or something.
So what exactly happened? Quote
05-15-2012 , 11:29 AM
Fresh start.
So what exactly happened? Quote
05-15-2012 , 11:43 AM
Quote:
Originally Posted by Diddy
2+2 was cracks

Spoiler:
its problem
Awesome way to spend your first post
So what exactly happened? Quote
05-15-2012 , 06:41 PM
Quote:
Originally Posted by BackFromABannin
I got an email from gmail saying there was suspicious activity on my account (they said a suspected hacking attempt) and they sent me an ip address and the location.The same day someone accessed my Facebook and changed my email on the account.

Never had problems before and both were the same password as my 2+2 account so I assumed it was related to the forum being hacked.

Passwords all changed now so hopefully that'll be that.
i got a similar email from gmail last friday:

Quote:
Someone recently tried to sign in to your Google Account, [email protected]. We prevented the sign-in attempt in case this was a hijacker trying to access your account. Please review the details of the sign-in attempt:

May 12, 2012 4:54am GMT
IP Address: 180.241.206.128
Location: Indonesia
If you do not recognize this sign-in attempt, someone else might be trying to access your account. You should sign in to your account and reset your password immediately. Find out how at http://support.google.com/accounts?p=reset_pw

Sincerely,
The Google Accounts Team
So what exactly happened? Quote
05-15-2012 , 09:37 PM
I travel a lot and sign into my gmail account from various IP addresses all over the world. I've never had a problem logging in and I've never been informed by gmail of 'suspicious activity'. What would cause them to prevent someone logging in from Indonesia on your account and not mine.? It doesn't make sense.
So what exactly happened? Quote
05-15-2012 , 09:41 PM
I think this happens when someone tries to log in multiple times but fails. I got one of those emails a few months ago. The perpetrator was me! I was at another computer and had forgotten my password. Maybe the perpetrator, armed with the 2+2 password, tried variations of that pw which triggered the email from gmail.
So what exactly happened? Quote
05-15-2012 , 09:55 PM
Quote:
Originally Posted by ChoakMyDee
I travel a lot and sign into my gmail account from various IP addresses all over the world. I've never had a problem logging in and I've never been informed by gmail of 'suspicious activity'. What would cause them to prevent someone logging in from Indonesia on your account and not mine.? It doesn't make sense.
I think it's something with the timing of the log ins.In my case last week I'd had just checked my emails with my location shown as here in Ireland and then within 15 minutes there was another log in attempt but this time from an ip address in Turkey.

In their eyes thats either a hacking attempt or some serious globe trotting on my behalf.
So what exactly happened? Quote
05-17-2012 , 02:27 PM
If they got into my other accounts I would be ok with it, every financial account that used the same password as this was given to my ex wife in the divorce. Go Hackers, Make Her Pay!
So what exactly happened? Quote
So what exactly happened?
$25m Guaranteed WPM on CoinPoker
Join the action now
Daily Rewards • Splash Pots • CoinRaces
So what exactly happened?

      
m