SRL Archive - Senior News and General

As has been recently found out, some of the staff at ZaszMedia decided to try and decrypt the MD5s of their forum users' passwords. If you have an account at ZaszMedia AND you use that password anywhere else (email, msn, SRL, etc) be sure to change it wherever else you mgiht have it.

DO NOT change your password at ZaszMedia and believe to be safe, because very likely there are backups of the database and therefore they could always retrieve your old pw. Change them at the other websites.

Also, as a guideline for a safe password: Capitals + lowercase + numbers.
this is the second time in the past 6 months that ssrl has been breached, so please, take the guideline seriously and for your own sakes use a different password in every website you register.

~RM

classy.

Wow, idiots, they could just modify the forum software to save the passwords to the database both as md5 and without hashing…

My password here looks like 28dsdgd967b and I don't use it anywhere else :p

By staff, does that include zasz and is there any evidence for any one doing it? Based on the other thread, Da 0wner is a possibility, but what he has done hasn't pointed towards that from what I read.

From: Freddy1990
Wow, idiots, they could just modify the forum software to save the passwords to the database both as md5 and without hashing…

They probably don't know how to do that ^_^

This is my reason I don't go to sites with powerabusing non-trustable admins <3

Also, I'm a stupid moron with an ugly face and big butt and my butt smells and I like to kiss my own butt.

It was not zasz that we know of, it was Da 0wner and yes we have proof

Normally with these forum stuff, client-side javascript makes an md5sum of your password and sends it.
To make it send as cleartext, you need to modify the javascript. If someone had enough time, they could look in the html source of the forum and see if theres md5 javascript or not.

…Or, have a firefox plugin that does it and says "Warning, password is not md5 hashed!"

edit: google suggests that such a plugin does not exist

If he was smart, then he'd just do like: send the md5sum to VB and fuck the plaintext.

From: Hobbit
It was not zasz that we know of, it was Da 0wner and yes we have proof

If there is enough evidence to be conclusive, then shouldn't disciplinary action be taken? Hacking forum accounts is worse than hacking Runescape accounts IMO, and people who hack Runescape accounts get a permanent ban no matter what rank…

From: Markus
If he was smart, then he'd just do like: send the md5sum to VB and fuck the plaintext.

but then you have to somehow unhash the md5sum, or bruteforce it.

Ban all staff from the site until they can prove they're not guilty? Admittedly the shotgun approach misses, but with full coverage you're bound to hit your mark…