[DerJager]

I was wondering why I had to resign in on everything.

---

On a side note, you know the password that gets generated when you do a password reset?
Would you recommend that over a custom password?

It seems more complex to me than normal custom passwords so I was curious.

a password is a password. It all depends on the kind of breach a site faces. If you are trying to not get Bruteforced go for a 25 char pass.
If you dont want to get credential stuffed use a different password on every site.

if you dont want exploits like this one to work on you use Lastpass and dont save any passwords or cookies on your pC

---

Nobody PMd me regarding any of this - check my posts from the last 24 hours or whenever the 0day was found.
I don't care what the discord messages say, I don't know if someone contacted Omni or he found out on his own - if someone did contact him, you have a leak in your chat which i'm thankful for - not a leak to me, but to Omni or someone else who then contacted Omni.
As far as the user Ahri accusing me of posting about the 0day - that's 100% a lie. And as such, it looks as though they are pointing the blame away from themselves.

Im personally not fussed its a lesson learnt dont trust anyone from HF

---

Anyway my suggestion is wait 1-3 weeks for the patch then reset cookies again

[Mr. Robot]

I was wondering why I had to resign in on everything.

---

On a side note, you know the password that gets generated when you do a password reset?
Would you recommend that over a custom password?

It seems more complex to me than normal custom passwords so I was curious.

It's a decent pattern structure but I wouldn't recommend it. I don't know the exact protocols it uses when being sent out.

Think something like
I am xadamxk and I am the best user on the entire forum.

That would turn into
IaxaIatbuotef

Then throw in some numbers and symbols..

1.4x.414.tbu0.t3f

So that's a period going from every character, to then every second to every third - with l33t speak.

[BTC]

I was wondering why I had to resign in on everything.

---

On a side note, you know the password that gets generated when you do a password reset?
Would you recommend that over a custom password?

It seems more complex to me than normal custom passwords so I was curious.

Using a really long password is important. For any service I use, for instance if the max limit is 100 characters for the password I will use somewhere random between 90-100 characters. Generate new passwords for each service, and keep them somewhere secure. I prefer to use open source, reliable software for storing my passwords in a database. Such as KeePass or others.

Aswell if you want to learn about hashing passwords, and the security I would suggest to research Argon2 😉

[SIM-1729678]

I was wondering why I had to resign in on everything.

---

On a side note, you know the password that gets generated when you do a password reset?
Would you recommend that over a custom password?

It seems more complex to me than normal custom passwords so I was curious.

I always use that. Also makes sure you only use that password on HF.

Don't forget to store it safely and then delete the email of course.

[Leroy Jethro Gibbs]

Well since HF limits passwords to 64 characters thats what I put lmao. So good luck guessing or cracking that shit.

[ama]

Well since HF limits passwords to 64 characters thats what I put lmao. So good luck guessing or cracking that shit.

I bet it's a bitch to sign in on mobile lmao

[Leroy Jethro Gibbs]

I bet it's a bitch to sign in on mobile lmao

Nah. Lastpass for the win.

---

My lastpass password is a bitch though.

[Omniscient]

The forumpass cookie is for the groups private forums and is not the sites login password.

Both are 0 post members. Knowing their passwords is bullshit and proves nothing because they could be shill accounts for the hoax.

But let's go on the belief for a moment there is an exploit. HF DB has been dumped before. Not a big deal to reset passwords imho. I'm not going to panic and neither should anyone else.

Anyway there is no real reason for concern clearing the cookies was a good idea, should be done again once this exploit gets patched so it cant be repeated

I'll offer a $250 bounty for the 0day and patch if this is legit.

I'mma guess the 0day doesn't affect us at all?

Hard to say. Apparently DerJager is high and paranoid and not making great sense. From the rumors I'm hearing this is about another site and a MyBB vulnerability.

You contradict yourself.

The leak isnt public and wont be, as far as im aware im the only one with contact with the 0day discoverer

2. I know the dump is going to be leaked

So which is it? Is HF the target or not? Then you say HF wasn't the target. But will it BE a target? Still don't understand what you're saying.

On a side note, you know the password that gets generated when you do a password reset?
Would you recommend that over a custom password?

I do not recommend a password change. I suggest you logout when not on HF for now and to have 2FA enabled. Even if they gain your password they can't login and a logout will close all sessions.

if you dont want exploits like this one to work on you use Lastpass and dont save any passwords or cookies on your pC

I suspect based on that statement this is an autofill vulnerability in Chome which was patched today in an update.

[Fish]

Thanks for the update boss! I was really confused why I was logged off!

Haha I was wondering the same thing

[DerJager]

The forumpass cookie is for the groups private forums and is not the sites login password.  

Both are 0 post members.   Knowing their passwords is bullshit and proves nothing because they could be shill accounts for the hoax.

But let's go on the belief for a moment there is an exploit.  HF DB has been dumped before. Not a big deal to reset passwords imho.  I'm not going to panic and neither should anyone else.  


I'll offer a $250 bounty for the 0day and patch if this is legit.


Hard to say. Apparently DerJager is high and paranoid and not making great sense. From the rumors I'm hearing this is about another site and a MyBB vulnerability.  

You contradict yourself.



So which is it?  Is HF the target or not?  Then you say HF wasn't the target.  But will it BE a target?  Still don't understand what you're saying.


I do not recommend a password change. I suggest you logout when not on HF for now and to have 2FA enabled.  Even if they gain your password they can't login and a logout will close all sessions.


I suspect based on that statement this is an autofill vulnerability in Chome which was patched today in an update.

HF is not a target nor will it be, the 0day was tested on Nulled purely for research. Nulled is always behind on updates etc so it is a good place to start. Once the exploit was found which lead to a small dump of around 9k credentials etc, the credentials where shortly destoyed, those accounts i sent above where sent to eagle the second the exploit was discovered to be banned to stop it going further. From there it was reported to zerodium and i have sent you enough details about what to do to patch, you may also want to stop sites using the Canvas API on their image hosts.

[Nuworld]

HF is not a target nor will it be, the 0day was tested on Nulled purely for research. Nulled is always behind on updates etc so it is a good place to start. Once the exploit was found which lead to a small dump of around 9k credentials etc, the credentials where shortly destoyed, those accounts i sent above where sent to eagle the second the exploit was discovered to be banned to stop it going further. From there it was reported to zerodium and i have sent you enough details about what to do to patch, you may also want to stop sites using the Canvas API on their image hosts.

The better question is, How do YOU? know all this about this 0day and it's exploit
You seam to know more than your tell us.

[DerJager]

The better question is, How do YOU? know all this about this 0day and it's exploit
You seam to know more than your tell us.

Why is this any of your business? Also why where you talking with Ahri about it before even i knew someone on HF new. ???????? Got a leak from someone in a group im aware.

---

i have given omni enough info that he could be able to patch it. How about you just go back to your discord group and chat shit?

---

The better question is, How do YOU? know all this about this 0day and it's exploit
You seam to know more than your tell us.

The real question is why does everyone judge non popular members?
Its weird right how i know about exploits.
Its weird how i reversed the exploit used in 2014 and wiped the server data from the exploit that lasted around a week?
Weird right? Weird how some random person might actually know a thing or to? weird how a random person also ensured that HF didnt get directly effected by it because a random person likes to read the lounge?

Maybe instead of bringing your bullshit you be greatful that i convinced someone to claim the bounty rather than go blackhat?

People with your attitude are why others dont have nice things, if you just accepted things rather than sticking your nose in i think more people would like you and not remember you for the whole stolen valour incident?

[Nuworld]

Why is this any of your business? Also why where you talking with Ahri about it before even i knew someone on HF new. ???????? Got a leak from someone in a group im aware.

---

i have given omni enough info that he could be able to patch it. How about you just go back to your discord group and chat shit?

Excuse me? how would you know anything about who i talked to about anything.
BTW: Ahri is dead!!

[SIM-3257834]

Why is this any of your business? Also why where you talking with Ahri about it before even i knew someone on HF new. ???????? Got a leak from someone in a group im aware.

---

i have given omni enough info that he could be able to patch it. How about you just go back to your discord group and chat shit?

---

The real question is why does everyone judge non popular members?
Its weird right how i know about exploits.
Its weird how i reversed the exploit used in 2014 and wiped the server data from the exploit that lasted around a week?
Weird right? Weird how some random person might actually know a thing or to? weird how a random person also ensured that HF didnt get directly effected by it because a random person likes to read the lounge?

Maybe instead of bringing your bullshit you be greatful that i convinced someone to claim the bounty rather than go blackhat?

A better question would be how did I get involved in this.

[DerJager]

A better question would be how did I get involved in this.

You tell me buddy