42 replies to this topic

[Rogue]

let me guess, they stored the pw as plain texts?

 

Probably like this:

 

"user1:pw1:birthday (wow, this one has uc draik)"

[GetJinxed]

I'd find it hard to believe they stored it as plain text O.o It isn't that hard to hash it. But well coming from them we never know

[Junjie]

If it's like, the Russian professionals I doubt they'd care about UC draiks xD

[Nano]

Neopets has always stored data in plaintext. Breach has been public since it happened. But the timeframe is wrong. Last known breach was 2014. My account isnt on this list. And it was made in 2008-2009. 

[Junjie]

Many people on the other forums, the one which quite condones hacking old accounts and all, are talking about their shells being hit by a password reset or soos.

 

Apparently for accounts on that list / affected by the breach (?), TNT is resetting passwords and sending a link to their emails to retrieve the new passwords. And apparently sometimes they are reverting email changes too. Huh. Interesting.

[Nano]

Many people on the other forums, the one which quite condones hacking old accounts and all, are talking about their shells being hit by a password reset or soos.

 

Apparently for accounts on that list / affected by the breach (?), TNT is resetting passwords and sending a link to their emails to retrieve the new passwords. And apparently sometimes they are reverting email changes too. Huh. Interesting.

 

TNT said they would reset accounts that hadn't had a password change since 2012.

[Junjie]

TNT said they would reset accounts that hadn't had a password change since 2012.

 

Ah, that makes sense! So, I guess it is working if they are targeting hackers or somethin. xPPP

[Bendida]

Hm. I got an email several days ago saying I wanted a password change. I just don't remember which of my accounts is assosiated with the said email. I clicked the option "I didn't request email change".

[fatecero]

Gmail accounts are being compromised right now? Accounts with 2-step verification shouldn't be affected, right?

[Junjie]

Gmail accounts are being compromised right now? Accounts with 2-step verification shouldn't be affected, right?

Yup should be ok. As mentioned previously Gmail has great security and even without two step auth will often stop logins from really unfamiliar IPs anyways.

Though of course do change your password anyways, I did.
(Though I did so a bit before hearing about this, but ehhh)

[GetJinxed]

Holy fuck. Neopets did infact use plain texts as passwords 

 

Stumbled upon this thread when googling for "research" purposes   http://www.neocodex....eopets-sent-me/

 

Daaaaaaaamn 

[Y33z3y]

Not surprised. TNT is always lacking.

[jinq]

can i claim my old accounts were hacked and get unfrozen+pw reset?

[Junjie]

can i claim my old accounts were hacked and get unfrozen+pw reset?

You can I suppoose! But, given that some people really really got hacked and it hasn't been resolved yet, I'm not sure how much success you would have really..

[Bones]

Had been waiting for this to happen *goes to change everything*

[jinq]

anyone remember when they changed the forgotten password email so that you get a single-use link to reset your pw rather than have all ur usernames/pw emailed in plain text

[transparos]

I still prefer the old times where you can know why u are frozen when u attempted to log in, nowadays still have to submit ticket to know why

[jinq]

I still prefer the old times where you can know why u are frozen when u attempted to log in, nowadays still have to submit ticket to know why

yeah, even have to login to view stupid pets/users along with the show_user page to see age of frozen accounts