New password policy at the 'sphere

[neptronix]

Hi all.

We've been having problems with 'credential stuffing' on this site, where a spammer will do a brute force attack on the login page with known, previously breached usernames and passwords to try to get access to accounts to spam us with.

This kind of attack has a high success rate and relies on users neglecting their security ( and a lot of people do that, so.. )

Many members ( 100% so far who don't use the site much and have just a few posts ) set a weak password on this site, or never changed theirs after a breach and have been re-using that username/password on other sites/ours. This makes the spammers' job really easy because anyone can buy or download list of compromised passwords from all kinds of sites these days.



To temporarily stem the tide of these accounts from being unlocked and used for spammage, i've added the have i been pwned service to our system which checks hashed partial password input against databases of known hacked passwords. It's similar to how the hacked password protection works in google chrome, and in this instance, because irreversible hashes of partial passwords are being sent, and compared, we don't accidentally end up compromising our user's security in order to gain security.

If you have a username/password combination known to be hacked on another website, the system will eventually require that you reset your password.

In addition, we now set a minimum password length and complexity for all new passwords going forward. And also added much stricter server-level protection against brute force attacks.


If this doesn't clear out spammers' use of long inactive accounts, i will escalate our security while doing my best to not reduce the convenience level we currently have.

If you wish to increase your account's security level, i recommend turning on the email-based 2FA. We have tried that feature at the moderator team level and found it to work pretty well. You can change those settings here: https://endless-sphere.com/sphere/account/security

 

[DogDipstick]

How do we know this is the REAL NEPTRONIX... posting this.. and not some kind of savvy spammy rAi computer robot posing as Nep?


Huh? Huh?

Lol.

 

[neptronix]

I'm going to be honest, that's going to be a problem someday

 

[chuyskywalker]

It's ok, my password is HUNTER2 which is automatically censored, so no hacker can find it.

 

[nicobie]

I have had the same 4 character long password here since this forum was started. Do I need a new one now?

 

[neptronix]

I have had the same 4 character long password here since this forum was started. Do I need a new one now?

Yes, that's way too weak.

 

[nicobie]

I'm curious what will happen if I leave it alone. I'm not too sure if I still remember what it is. It's been awhile...

 

[neptronix]

I really hope you're pulling my chain dude

 

[lifepo4ever43]

have been hacked yesterday and my email also i asked help but you didn't reply to me

 

[neptronix]

Hi, i can't seem to find any help requests from you, not sure where you sent them.

Will respond via pm.

 

[afzal]

I'm going to be honest, that's going to be a problem someday

Though might not be feasible here, thought to share: Linux Kernel developers use PGP keys cross-signed by other members creating a web of trust to verify the identity

Dunno how to prove I am I

 

[marty]

It's ok, my password is HUNTER2 which is automatically censored, so no hacker can find it.

OK chuyskywalker? Now you've done it. Thought I would test your password that you shared with every human and computer with a internet connection. I signed out as marty. tried to sign in again using:

chuyskywalker + HUNTER2 it did not work?

Then I had to sign in again.

Your account is currently security locked and you need to reset your password to login. A password reset request has been emailed to you. Please follow the instructions in that email.

I had the easiest to remember password of every website on planet earth. It was one digit! Yep Nep. 1 digit as in one number. Sorry I can share this password. Top secret! If I told anyone I would have to kill them.

Now for the adventure of creating a new password. I need another password like I need more information to forget.

Lets try a new one digit password?

Oops! We ran into some problems.
Password must be at least 10 characters long.

OK lets try 0000000000

Oops! We ran into some problems.
Your password is too weak.

I can count 10 letters. Try espassword

This password is similar to a commonly used password.

Marty uses a big old computer here. Lets try the top row of letters on my keyboard? qwertyuiop

This password appears in the Top 100 most common passwords list.

Wow! I should win a prize for guessing every one else's password. Just to let it be known the very best password is password all lower case letters. Yep - password. If you can't guess that? You probably should not word for the FBI.

Done! I now have a all new hard to remember password.

Serious Question? If I used the same password that I use to access my bank account. Could someone deep into the inner workings of Endless-Sphere software see all the members passwords and try to hack into their bank accounts and steal all the money?

 

[neptronix]

Though might not be feasible here, thought to share: Linux Kernel developers use PGP keys cross-signed by other members creating a web of trust to verify the identity

Adapting this to work on a website instead of a git repo or email client would be very difficult.

Dunno how to prove I am I

Yes, huge problem that the entire internet is going to have to figure out soon.

Wow! I should win a prize for guessing every one else's password. Just to let it be known the very best password is password all lower case letters. Yep - password. If you can't guess that? You probably should not word for the FBI.

FYI, the '100 most used passwords' comes from not our own password database but from the haveibeenpwned service's ~13 billion leaked username/password combinations.

There is a reference for the top 100 used passwords:
SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt at master · danielmiessler/SecLists

Serious Question? If I used the same password that I use to access my bank account. Could someone deep into the inner workings of Endless-Sphere software see all the members passwords and try to hack into their bank accounts and steal all the money?

It's technically possible for any website operator to do this. But the more likely thing is that the website operator didn't keep the security of the platform up to date, the site got hacked, the hacker decrypted the passwords, attempted to blackmail the website operator, and posted them online if the ransom wasn't paid.

We have above average security for an internet forum, a low value to hackers, we keep things up to date, and the people who run this site are good people, But you should never trust any website with your bank password other than your bank.

 

[afzal]

Adapting this to work on a website instead of a git repo or email client would be very difficult.

What I had in mind was email associated with ES to verify the identity in case of a necessity, though personal signed email exchange would be required - an inelegant solution.

I don't know whether it would be possible for the forum posting to leverage signed email capability, even if that is possible, it would be very difficult.

 

[afzal]

have i been pwned

Thanks for that!

I now know that one of my personal email (of which I knowingly neglected security) has been pwned including password. But it was surprising to know that my erstwhile official email of a prominent semiconductor company too has been pwned, almost everything except the password.

 

[neptronix]

Oh, i see.
Yeah, i would expect most users to lose their PGP key, even if we could get them to somehow make one.

Yeah, your results are no surprise. Many of my emails got in a data breach at some point in time. Few systems are safe in the current cyberwar. Microsoft's email systems got blown open 3 times in the last 12 months.

Any internet user is advised to take security pretty seriously these days.

 

[nicobie]

I have a seperate email for each of my banks that I use only for them. I could give a shit about everybody else as I can really do nothing about them anyway.

 

[neptronix]

I have a seperate email for each of my banks that I use only for them.

That's a very good practice.