[Frank Serpico]

Oh thanks for the info Omni ^^

[aguila]

Thanks for the update Omni, and I attempted to change my password but I get an error,
Spoiler (Click to View)
MyBB has experienced an internal error and cannot continue.

Error Type:
MyBB Error (40)
Error Message:
The specified input has been blocked. Please go back and try again.

[Rikk‌a]

Im a bit confused on this i recieved 4 emails last Tuesday in my inbox ..saying this ...
Dear Wrаith,

We are currently investigating a possible account security compromise at HackForums. In order to ensure your account is indeed secure we ask that you change your password and enable Gauth/2FA. You can verify the validity of this email on HF which we will confirm and provide additional details. We apologize for any inconvenience.

Thank you,
Omniscient
HackForums Admin

now that day i changed my password but when i do a trust scan it says
Last Password Change: Never
Gauth/2FA: Enabled 12-16-2015

So do i change my password again ?

He didn't add the plugin when you changed your password.

[Faith Connors]

ty based omniscient for keeping us safe

[Blazin]

I'm glad I got 2FA enabled.

[memesaregreat]

I hope HF is going to be fine.

I heard that nulled got nulled :P

[Kyle Beats]

Is there a recommended email to use that doesn't filter emails?

Outlook sometimes does but it's like a 80% chance that it won't but considering it was stated if you don't receive the email you'll lose your account I don't want to take the risk.

[#Exploit]

Thanks Omni, I'm gonna check now.

Regards

[You Just Got Sarged]

The desktop app?
Take a look at this thread here!

https://hackforums.net/showthread.php?tid=5259529

I try that. https://www.authy.com/app/desktop/
I click on the Operating system I use and it takes me here:


https://chrome.google.com/webstore/detai...aolb?hl=en

It displays this for me:


Once when I click available on chrome which is my only option it takes me here:
https://www.google.com/chrome/?brand=GGR...m=et&hl=en

[Retribute]

Is there a recommended email to use that doesn't filter emails?

Outlook sometimes does but it's like a 80% chance that it won't but considering it was stated if you don't receive the email you'll lose your account I don't want to take the risk.

Right. I think it's best to stay away from Microsoft emails.
I think Gmail is fine.

[Ritract]

I will upgrade soon so I can then add additional security to my account.

[Omniscient]

What if for whatever reason we don't get the email? can we avoid this happening by changing our passwords manually without the email?

You will be unable to recover your account and access it unless you have a valid working email. I was hoping my first post made that clear.

"If you do not get the email then you will lose access to your account." and... " You will need to have a valid working email account that does not spam filter HF emails."

I've already changed my email will I have to change it again?

No, it's not necessary to change your email if it's valid and working.

I've enabled 2fa and changed my password.

Now I just setup a different email for this website entirely.

That's not a bad idea for most members as long as you don't forget the emails login credentials. It prevents your primary email from being exposed from a leak. I myself prefer to use email forwards so that my primary emails are private. An email goes to my secondary account which is known and then forwarded to my private email account which is unknown. So I still get all the emails I need without exposing myself to certain risks.

I still would like to know if there has been an actual breach or not. Better safe then sorry though.

I'd like to know that too and yes, better safe than sorry.

At the end of all this we'll have a more secure HF which is better for everyone.

"So everyone at some point in the near future will be getting an email to reset their email." Dammit...typo...fixed and it was suppose to be "reset their password"...thanks for point that out.

What about the Ubers that already got told to change their passwords?

It's true that some members might be changing their passwords multiple times in order to ensure account security.

What do you mean lose access to your account will you close account who don't change their email?

Your existing password will cease working. You will need to a password reset which is done via email. If you don't have a working email you may end up losing your account access permanently. I will do my best with account recovery but there will certainly be no guarantees and it's likely going to be a slow process.

So do i change my password again ?

You don't need to change your PW if already have in the past 4 days. However, when I do full site password reset, all members will lose access until they reset their password again via the PW reset page and activate a new password. So again, no emails from HF means you will not get a new password. Yes, that's crazy sounding so I suggest you make 100% sure you have a working email. Essentially this will cause all users to activate their accounts again.

[BSk84]

Despite being a literally utter newbie to the forum, I take it as a excellent sign that the Admins are so forthcoming about this sort of thing. Security vulnerabilities are a fact of life, and are a "Red Queen" sort of problem (ie. intractable to complete resolution). Now if this breach had occurred and none of us were informed -- now that would be cause for concern. Thanks for the heads up.

[SureDawgg]

Well hot damn. Was not expecting this

[Blazin]

Everyone should have 2FA enabled by now, especially if you value your account in anyway here. We should let regular members use this feature for free.

I dunno if I get the emails from hf to my HF email though on here. Think I had issues with that once.