SRL Archive - News and General

Due to recent events with some "so-called hackers", I've decided to give you guys a very small lecture on security.

First of all, I've enabled the vBulletin options that forces users to change their passwords every X days. For Registered users and SRL Members (and above), this has been set to 50 days, for now. (It has been set to a relatively low value to force you to change your current password.)

I noted that recent events caused quite a drama. Usually, "being hacked" is purely the users fault, but to guide you guys in security I enabled this password expiration option, which will force you to set a new password!

You should use different passwords for each site, and make sure they can't be linked to you in any way. EG: Your favorite toy, your last name, your best friends' name, etc. These are all very weak passwords.

The only reason you may be "hacked" is because you are using an extremely weak pass, or use the same password on multiple websites/forums.

Follow this advice and you should generally be safe. I strongly advise every user to use different passwords on each site. I'm sure they've heard of "hacker" stories before. People's bank account being hacked because they use extremely weak passwords, etc.

I would like to assure you that - as far as I am concerned - the SRL Forums are safe and secure. vBulletin is very secure, and quality software.

~Wizz

PS:
If more comes to my mind, I will edit my post and add more. Make sure you check this thread again in a few days. :)

Sounds like a good idea (the force password change)
Cheers again Wizzup?

T~M

It just said that I hadn't changed my password in like 200 something days. I typed in my current password, and then I typed in the same password as the new password, and vbulletin didn't stop me. So it really doesn't force you to change it, but it does remind you.

Maybe you should make it force people to change it every so often?

Already does so: it'll now force you to change it every 50 days :p

From: JAD
It just said that I hadn't changed my password in like 200 something days. I typed in my current password, and then I typed in the same password as the new password, and vbulletin didn't stop me. So it really doesn't force you to change it, but it does remind you.

Maybe you should make it force people to change it every so often?

I can also enable the option that doesn't allow you to use the same password, but I didn't touch this option for the users desperate to keep their old password. :)

I must of changed my password right before you put this into effect, I changed it today when I learned of people being hacked and someone said we should change password's in the thread, so Vbulletin never made me change my password.

From: Baked0420
I must of changed my password right before you put this into effect, I changed it today when I learned of people being hacked and someone said we should change password's in the thread, so Vbulletin never made me change my password.

If you changed it within the last 50 days, it won't bother you.

From: Wizzup?
I can also enable the option that doesn't allow you to use the same password, but I didn't touch this option for the users desperate to keep their old password. :)

Like if you wanted to keep your 29 character random words+symbols that you pushed yourself to remember. (thats what im going to do.)

aw i like my old 1 :( lol
btw yeah never put your password same on every forum and same on rs lol

This password force changer feature is used also in big corporations on their computers when they change their windows log-in passwords.

From: sapetto
This password force changer feature is used also in big corporations on their computers when they change their windows log-in passwords.

Except its generally on a 28 day cycle for them, as they usually store considerably more valuable data.

I havent changed my pass in 763 days :)

Your password is 509 days old, and has therefore expired.

Dame, I got beaten.

1115 days. I win.

Do not ever clear your cookies -> ??? -> PROFIT!

I have not changed my secure password in almost a year, yet I shall never be asked to enter it again.

hmmm i set my password 381 days ago -.-
edit: darn bullzeye wins

309 here…

~shut

Meh, only 275 for me.

Gimme a year or two and I'll beat all of you :D

From: final_result
Gimme a year or two and I'll beat all of you :D

doubt it

~shut

From: final_result
Gimme a year or two and I'll beat all of you :D

Mine's already over 3 years :rolleyes:

From: final_result
Gimme a year or two and I'll beat all of you :D

(Bullzeye)1000 > 365
(Bullzeye)1000> (365*2)

I just changed my password a few days ago.
I think its a good idea to force people to change their passwords every once and a while.
I hope people dont use their name in their password :P
I guessed this one habbo's pass once and I got into his account. I was only his name and a 1. It was a random guy. So dont be like him. Didnt do anything to his account though.

You guys are havent a contest over pass change count…. When am i getting my account back???

From: tehrealzasz
You guys are havent a contest over pass change count…. When am i getting my account back???

ban evade?

hmmmmmm

1151 days

I don't think I've ever changed mine, nor been hacked.

i got hacked here as well but i had a unique pw…

i was wondering why it told me i hadnt changed my pass in 912 days :P good idea wizz!

WOW. You have not changed your password in 880 days XD

Ejjman1 hasn't changed his in 1,151 days ;).

DAMN :o

From: Wizzup?
I've enabled the vBulletin options that forces users to change their passwords every X days. For Registered users and SRL Members (and above), this has been set to 50 days, for now. (It has been set to a relatively low value to force you to change your current password.)

Are junior members not included?… I have not changed my password in … well I think since I first set it…
Is everybody just counting the days in between or is there a faster way to find out how many days you have not changed your pass? … not that counting is too hard..

It should show a message if you haven't changed in the day limit.

And I though mine was big :P

Your password is 391 days old, and has therefore expired.

Please change your password using this page.

170 days here :(
and yes, i thought this might be a scam at first :S

Isn't the whole idea of changing your password actually changing it? As in, not leaving it the same?

Wizzup? i can just enter the same password i have currently when it asked me to reset my password xD

[QUOTE=Dan's The Man;598058]Wizzup? i can just enter the same password i have currently when it asked me to reset my password xD[/QUOTE]

[QUOTE]I can also enable the option that doesn't allow you to use the same password, but I didn't touch this option for the users desperate to keep their old password.

Quote from wizzup? 3rd post down.

00:58 < rulereric> Your password is 1225 days old, and has therefore expired.

Beat that. ;)

Thanks wiz, maybe this will cut back on the drama a little…

Suggestion: Instead of trying to remember or write down many passwords. Just have one really difficult password, example :jesussaveszombies

Now, to find out your password, you do the md5 of the website's name+your master password.

Example: md5("villavu.comjesussaveszombies")

Now, if anyone compromises your password, they only have access to one site. And any functioning system has a md5 command, so as long as you remember your master password, you can login to any website.


EDIT: And it is impervious to rainbow tables and such, so even if the database gets compromised, your password is secure, assuming only the hash of your password is stored (So actually md5(md5("villavu.comjesussaveszombies"))).

P.S. No, don't even try, my master password is not jesussaveszombies.

You should also make the password required to have at least two of these this:Upper and lower case, symbols or numbers. that shouls help the strength of passwords

Why does the page that forces you to reset the password keep on refreshing making you unable to change it?

I use the same password everywhere except for RuneScape and my hotmail. I think it's really strong. It doesn't have anything to do with me. Something radnom as "chair14mouse". And on top of that it's norwegian. :P

Something like 950 here yesterday :DD

From: mikuz
Something like 950 here yesterday :DD

Look at dates before you post

From: gratz
Look at dates before you post

This is a sticky so it shouldn't matter.