[Omniscient]

As part of our roadmap to enhance account security we will be doing a full site password reset for all accounts. So everyone at some point in the near future will be getting an email to reset their password. If you do not get the email then you will lose access to your account.

Please confirm your email is valid and accepting HF emails unfiltered. If you need to change your account email please do so now. You will need to have a valid working email account that does not spam filter HF emails.

Use this link to check or change your email:
https://hackforums.net/usercp.php?action=email (Only change your email if it's invalid such as lost access or doesn't get HF emails because of spam filters)

Also you will need to ensure that any notifications we send about changes will be allowed to be sent to you:
https://hackforums.net/usercp.php?action=options
Check the "Receive emails from the Administrators" please if you wish to get email notifications when we do send them. Please note we've only sent it out twice in nine years. We have no intention to make it a habit of sending email blasts and we are against using email promotional spam.

I will ask that all members with 2FA/Gauth access enable it asap. It's vital you secure your HF account using this method.
https://hackforums.net/gauth.php

If you have not done so also change your password even though we do plan on a reset it's good to have a fresh password on the site. One that you don't use anywhere else and is unique. Trust Scan page now shows when you last changed your PW.
https://hackforums.net/usercp.php?action=password

I'm sure many will ask when we plan to do the password resets. I can't say 100% for sure but my best guess is within two weeks. Could be a lot sooner depends on how fast I work and what I find when it comes to the accounts security. I may opt to upgrade us to MyBB 1.8x before doing a PW reset just in case there is an exploit being using in 1.6x series. In that case it could be a few weeks as it's a lot of work. And it doesn't make sense to do a PW reset until I know we're secure.

There are lots of rumors of dumps and leaks. But let me make it clear that indeed these are rumors and there has yet to be any confirmation that indeed we have been dumped. I actually find it hard to believe since no one has shown actual proof they have the DB dumped. Realize there are a lot of childish braggarts in this world. Many will lie about having the DB when in-fact they don't have it. Some will take credit for any compromise when in-fact they didn't do it. Members are reporting being threatened or blackmailed, in which case, I suggest you ignore the bullies.

If it wasn't for my own threads stating that I believe we've been compromised no one would be behaving any differently. While I don't regret making the thread I do think it should be made clear that there is no actual proof so far. I am starting to seriously question if we have been compromised in a way that a dump was possible. Currently the situation is that we have Ub3r and l33t accounts being stolen. No data on HF has been changed. The site is operating normally. There has been no manipulation of the database as far as I can tell. I've not found any shells on our servers. I have not found any evidence at all that we're potentially compromised at any level beyond these stolen, or possibly sold, accounts.

Normally in the past when we are indeed compromised it's much more evident. The site is defaced. The database is leaked and I see actual proof. Server gets owned with things like a root password change. Admin accounts get altered. All types of mayhem normally occurs. And the hackers delight in it, take credit, and do a full-on victory dance. So far....nothing...and that's very odd.

These facts are very true:
1. I'll secure HF.
2. I will secure accounts.
3. HF will continue as usual.
4. Eventually, we'll get compromised again.
5. Rinse and repeat as they say.

Thank you.


EDIT:
Suggested services:
Tutanota.com (encrypted)
Gmail.com (2FA login provided)
Protonmail.com (encrypted)

Yahoo, Outlook, Live, Hotmail, and AOL all work with HF but may experience intermintent problems with delivery.

EDIT 2:
A simple way to check if you're getting HF emails is to enable email notifications for PMs.
https://hackforums.net/usercp.php?action=options
Check the: "Notify me by email when I receive a new Private Message."
Then send yourself a PM. Yes, MyBB allows you to PM yourself.
After you verified that you get emails you can uncheck the option for email upon PM.

[Sevn Alias]

So HF is now full secured? And you might ban accounts if the user logged in since few months ago. To avoid scams.

[Magna imperium]

Thanks omni for the update.

[NormieFag]

So HF is now full secured? And you might ban accounts if the user logged in since few months ago. To avoid scams.

That's not how that works. There's always a margin for error.

[Granny Bacon]

Thank you for your update!

[My Computer]

Thanks for the update Omni. :)

[$uicide]

sounds good, looking forward to this :D

[Iwata]

Has HF been hacked or something?

[xFR3]

Have you checked site logs? I doubt it got dumped again because otherwise there'd probably be someone bragging.

[Treeline]

Thanks for letting us know Omni

[MysticParadox]

Glad to see the new security changes.

[Cara Delevingne]

Thanks alot for this update, appreciate it

[F16™]

Thnx for update Omi 🤝

[❤️Kill❤️]

Thanks for keeping us up to date Omni!

[Redwall]

Thanks for the update omni
Safety is first