Forum Redesign Announcement

cally6008

I'd like to know if the PM is being sent just to people, who mse techies think, have weak passwords
Or to every MSE member

digitaltoast

Other posts about it here:

https://forums.moneysavingexpert.com/discussion/comment/64301946#Comment_64301946

and here

https://forums.moneysavingexpert.com/discussion/comment/64301955#Comment_64301955

digitaltoast

Love_A_Bargain wrote: »

I just received a change of password message as well. Has anyone changed theirs? I find it was abit strange so I popped on here to check.

Well, as I noted in my other thread about this, I did, but not following the links. Just logging in as normal then changing it from 8 letter and number mix to something this length (32) and quality (but not this, obviously!)
s2&)e)(}e3a8w^<Z*|k+|A~"81tFmXB`

JimmyTheWig

How are they identifying which passwords are weak? Presumably they don't store users' actual passwords?

scorpiolady

I just got the same pm and as my password was quite easy to guess i did change it ...

hostertlady

I have had the same message too!
my password is very hard to work round so god knows why I need to change it!
I am not going to change it yet.
just in case....

Former_MSE_Ian

Hi hostertlady,

hostertlady wrote: »

my password is very hard to work round so god knows why I need to change it!

To be on the really safe side - and that's where we would like everyone to be - you need a long, complex password these days. It's got to the stage now where calling it a "password" is misleadaing. We should be thinking more in terms of "passsentence".

If you got the PM please do us a great favour and change your password . Thanks in advance.

Ian

digitaltoast

I just want to add something to this - while having a strong forum password is good practice, it (and your forum passwords) are as weak as your email password. You could have a 128 character hi-ascii MSE password, but if your email password was "password", then all your forum (and banking) are belong to teh hackerz.

And by that, I mean, hacker gets access to your email account, or forwards it, or copies it. Then just uses "forgotten password" links. And scours your email for dates of birth, other password clues. Sometimes sites will send out a password reminder of the actual password, and if your other passwords are the same, then Bingo - they're into everything. They'll then change your password and email address and lock you out.

It's a real shame there isn't a 2-factor authentication module for vbulletin, but meantime if you have MS Outlook/Hotmail, Yahoo, Gmail etc, you can make yourself almost totally unhackable (barring stupidity) following these simple tips:

http://lifehacker.com/5938565/heres-everywhere-you-should-enable-two+factor-authentication-right-now

and here's why: http://www.mattcutts.com/blog/google-two-step-authentication/

Same goes for Dropbox, Box.com, twitter, facebook, Blogger, Wordpress, Evernote, Steam and so on. If you've got ANY of the the above, you really really should enable 2-factor auth.

Stay safe

Monkeyballs

Cheers all! I just checked and the PM has been re-dated and I've seen posts from other MSE Mods stating that it's genuine.

That said, mine is a combo of upper and lower case letters as well as numbers and special characters so I'll keep mine for the moment thanks.

MB

Old_Wrinkly

Monkeyballs wrote: »

Cheers all! I just checked and the PM has been re-dated and I've seen posts from other MSE Mods stating that it's genuine.

That said, mine is a combo of upper and lower case letters as well as numbers and special characters so I'll keep mine for the moment thanks.

Which DOES make one wonder why a user with a password such as that is being asked to change it ... :think: