[Rubixa]

If we change our password before the mass password reset, will we have to change it again after you sent it? Just want to make sure.

I would assume so, Nothing wrong with changing passwords now and than again when it comes through anyway.

Nice work you're putting in Omni.

[Zexo]

Just double checked to see if I would receive the email and i'm good so ill just wait here.

[PrivateDonut]

I would assume so, Nothing wrong with changing passwords now and than again when it comes through anyway.

Yeah I assumed I would, I just thought I'd ask so I have a heads up. I use unique passwords for every site I go on, so unless hackforums has gotten dumped I should be fine until the mass password reset.

[Rubixa]

Yeah I assumed I would, I just thought I'd ask so I have a heads up. I use unique passwords for every site I go on, so unless hackforums has gotten dumped I should be fine until the mass password reset.

All good, and yeah that's common sense and good of you to do. Yeah, you should be fine.

[Cecilia]

First off, my comment was more about general security, not this problem specifically. I'm perfectly aware that adding SSL doesn't prevent accounts that are already stolen from being accessed.

1. I am more than familiar enough with HTTP to weigh it's benefits and downsides.
2. Most people use the same password on various accounts. Transferring your password in plantext is NEVER a good idea. Also, cookies in the clear aren't really helping. If you're on HF on a publically accessible hotspot, chances aren't terrible of someone intercepting.
3. There are 2 major downside to using HTTPS that I can tell. A) you have to pay for valid SSL certificate and B) it slightly increases the CPU usage of the server. Considering omni's cashflow is far from being depleted, and the fact that servers are designed for this sort of treatment, and that OpenSSL and any commonly used SSL/TLS implementation has been highly optimised, and the fact that much of his money goes towards HF improvements, there is really very little reason NOT to enable HTTPS...

Also, Google will prioritize searches with sites that have HTTPS enabled, so you get minor SEO benefits, too.

But whatever. Who am I to make recommendations on how he should set up his natwork? My certs and over 1 year working in the field mean nothing anyways.

Wasn't his reason before something like: "not going to be added because it would never be true https because of all the user content involved would all have to be hosted on secure sites themselves including signatures and avatars which not everyone will do".

[Rude Boy]

All my PMs were deleted, this too involved in this?

~Rude Boy 🤝

[RSA]

Will this require us to have to redo our Gauth? Or, will we need to be secure of it still?

Thanks for the update.

[PrivateDonut]

Will this require us to have to redo our Gauth? Or, will we need to be secure of it still?

Thanks for the update.

When he sends out the mass password reset, I'm pretty sure we will need to re-log in, therefore we will have to enter a valid gauth/authy code.

[RSA]

When he sends out the mass password reset, I'm pretty sure we will need to re-log in, therefore we will have to enter a valid gauth/authy code.

Alright, thank you for the confirmation.

[Crypter_]

Wasn't his reason before something like: "not going to be added because it would never be true https because of all the user content involved would all have to be hosted on secure sites themselves including signatures and avatars which not everyone will do".

Yes. Mixed content is a bit tricky. Forcing HTTPS would be bad in this context, but allowing it to be enabled would be a good thing. HTTPS Everywhere would upgrade images that could be served over TLS (i.e. Imgur, Giphy) automatically. The only real problem is the CDN bill for serving HF's assets over TLS, but you could just disable the CDN on TLS connections.

[[Rn] 7s^2]

I have Microsoft's Hotmail account. Is it cool?

Edit: Sorry. Didn't notice the Edit 2 part of your original post. I will verify it now. Thanks Omniscient. :-)

[AlirezaVF]

oO lets check this out
i hope it wont make problem for users

[Cyber Coder]

what if those stolen accounts that made omni suspicious are not because of hf being compromised but because someone added a very hard to find backdoor in some used program here (like blackshades) and he stole their accounts ?

[PrivateDonut]

what if those stolen accounts that made omni suspicious are not because of hf being compromised but because someone added a very hard to find backdoor in some used program here (like blackshades) and he stole their accounts ?

It's possible, as Omni said in the main thread, there isn't any signs that hackforums has been compromised. It's most likely users using the same password on multiple sites, not having 2FA enabled, or getting ratted.

[goingdownscreaming]

* i ended up doing a password reset etc, i couldn't get it fixed even with rather stupid simple passwords.

I am getting a error when trying to alter my password. Is anyone else experiencing this? I have tried replicating the same char usage as with my previously used password(as a test) and i am getting the same issue.

MyBB Internal Error

MyBB has experienced an internal error and cannot continue.

Error Type:
MyBB Error (40)
Error Message:
The specified input has been blocked. Please go back and try again.

Please contact the MyBB Group for support.

Is it just a matter of the chars i previously used isn't allowed or am i just a bit to tired and not able to actually use the Internet properly ? : ]