+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: Account Security Roadmap (/showthread.php?tid=5259437)
Account Security Roadmap - Omniscient - May 4, 2016
Here are the important steps I will be taking over the next week to enhance account security on HF.
1. Offer a $1k BTC bounty for the working exploit. (DONE)
2. Create logging of all PW changes with both date and IP (pw's never stored in plain text). (DONE)
3. Force a full password reset on the entire community.
4. Add to Trust Scan the last PW change date. (DONE)
5. Force password changes if PW is older than X months/days.
6. Require Gauth on all upgraded accounts for ability to PM or post in Marketplace.
* - Vitani - May 4, 2016
These are some great improvements on the current security.
I especially like setp 6 since that will reduce scams with stolen/compromised accounts close to if not actually zero.
Step 5 will be a pain in the ass but it's a good idea since alot of people use the same password for multiple sites.
* - sʜᴀʏ - May 4, 2016
Thank you for keeping the forum safe!
I really like the exploit hunt.
* - Fish - May 4, 2016
wow thanks omni! looks like a good todo list :D
* - Rikka - May 4, 2016
Thanks a bunch for trying making the community a safe place.
* - Cryptic™ - May 4, 2016
Good changes. Step 6 is awesome.
* - DeadCode - May 4, 2016
Not bad. Thanks for keeping us safe from dem hackers and SE'ers.
* - F16™ - May 4, 2016
6. Require Gauth on all upgraded accounts for ability to PM or post in Marketplace.
Awesome Change 😉
* - ๖ۣۜFazzer - May 4, 2016
Damn it. This should have been done a long time ago. But whatever rule 6 gonna be awesome.
Looking forward for this.
* - Sevn Alias - May 4, 2016
(May 4, 2016 02:06 PM)๖ۣۜFazzer Wrote: Damn it. This should have been done a long time ago. But whatever rule 6 gonna be awesome.
Looking forward for this.
Yes, indeed. +1.
* - Gt403cyl - May 4, 2016
This should really lockdown members accounts against theft!
While I am happy to see you taking more steps to secure the site and accounts of the members, I still hate to see so many people didn't take the precautions that were already there in front of them such as 2FA ect.....
* - minimalist - May 4, 2016
#5: What was your mentality behind it? Just curious to hear if changing an uncompromised password with 2FA enabled would bring security improvements or if it'd just inconvenience the user.
* - Rikka - May 4, 2016
(May 4, 2016 02:01 PM)Omniscient Wrote: 6. Require Gauth on all upgraded accounts for ability to PM or post in Marketplace.Are you going to make "Last Gauth/2FA Validation" Play a role in this? Such as you cannot post in the marketplace unless you Validate your 2FA. When it has not been Validated in awhile.
* - Granny Bacon - May 4, 2016
(May 4, 2016 02:06 PM)๖ۣۜFazzer Wrote: Damn it. This should have been done a long time ago. But whatever rule 6 gonna be awesome.
Looking forward for this.
It shouldn't be done long time ago, it is called "improvement". Updates are there to be released. You can't expect every site to have all the features in the beginning.
Great roadmap btw.
* - 7even - May 4, 2016
Everything seems good other than #5. Seems like some good improvements, thanks Omni 🤝