Site Post » Possible Password Hash Leak · 4:14am Dec 20th, 2012
Hey guys,
We have nothing to validate this other than hearsay, but we have a report that password hashes for users on the site were accessed by a group of people. Because of this we recommend that you change passwords as a precaution. We have also updated our backend to support better encrypted passwords, so changing your password on Fimfiction will give you a much stronger password for the future.
We apologise for this, but again, it is hearsay right now and I want to let you guys know so you can take precautions if you're concerned.
As a note: If you don't understand the terminology, a password hash is an algorithmically generated version of your password. Plain text passwords are not stored, but it is possible to crack hashes given sufficient time.
630185 Wow, did you seriously just do that? Lord that's embarrassing.
They'll never guess my password of 1234!
Jeez, what a pain. But hackers are hackers after all....
What is a or are password hashes?
Changed mine just in case.
As a sidenote to this, you may want to fix the formatting error with the blogs, so that the list appears beside the text instead of underneath.
And weirdly enough I reset my password because I couldn't log in earlier.
630185 It's the fastest way to get banned
That's some disturbing news right there. I'll be sure to change my password then.
>changing your password on Fimfiction will give you a much stronger password for the future
That still applies if I change it to a new password, then change it back, right?
aww... but this site had my favourite password... oh well time to change passwords again... AGAIN!
P.S. Thanks for the heads up Knighty
630220
If you change it to the same password that won't help if your password gets cracked.
Aaaand password changed.
Entry phrase altered
Store those password hashess in a sturdier box jeeze
Thanks for the heads up, time to alter my security.
something happened, my password was changed/failed to work until I reset it. thought I had been hacked :O
Thanks for informing us, That way we can take precautions in case if what you said is true
Well shit. Thanks for the heads
*cough* GNAA maybe? *cough* *cough*
My account has no stories on it. I don't think they would care to steal mine, it's only a little bit of blog, two or three followers and my "fav'd" list.
Also what happened to the approximate word count? I read a shit ton of words!!!
Thanks for the early notification, even if it is just trolls.
Oh for Faust's sake!
630261
One wonders what these people could accomplish if they devoted their time and effort to something even marginally productive.
And before some points out the imagined irony, yes, I consider fanfiction marginally productive. Like how skim milk is technically milk and not bottled water.
I'm changing it for the sake that I just found out that it says 'Password must be at least 8 characters long'. Mine was only 7.
Were all the hashes leaked or only a few?
630191
Hey, that's the password on my luggage!
630191>>630298
Well, time to go update my settings.
And someone change the password on my luggage!
Awww crap! Why do I use the same password for Fimfiction and my swiss bank account worth millions?? WHYYYYYY????
Hey, someone should get legal action taken against the GNAA for hacking websites and sending falsified legal claims posing as lawyers. Maybe a petition is in order?
I know there's something I can say about rainbow tables and Rainbow Dash here, but I just can't think of what.
Actually, I just like saying rainbow table.
Not saying it was them this time, not completely positive.
630298 So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! That's the kind of thing an idiot would have on his luggage.
~ Dark Helmet
630303 I know, right?!
All my other accounts have a ten-word, eighty-character passphrase with mixed letters of mixed case, numbers, and special characters, but I used a simple one-word password for my Swiss bank account and FiMFiction! Dx
But no really, my BitCoin wallet is secure as fuck, and my FiMF password won't be found in any dictionary wordlist out there.
Hope they're running quad-Crossfire 7970, 'cause they'll have to get it brute force.
Thanks for the warning! dl.dropbox.com/u/31471793/FiMFiction/emoticons/misc_Vinyl_Scratch.png
I've been meaning to switch my password for a pass-phrase for a while now. This is as good a time as any, I suppose
630224
I think he was talking about future compromise, but anyway.
PBKDF2 at least, right? And what was the previous algorithm?
scrypt sound sexy, shame it's stability is shifty
630224 I know that
Is this that GNAA shit again? God, honestly, don't these people have a life? I'm not bawwwing here, but fuck me, spending your whole day trying to check for security faults at websites just out of spite or whatever it is they do it for (haha, the lulz? pathetic)? That doesn't make you any less of a fat, virgin, neckbearded faggot.
Such a pity...
630191>>630298>>630301
630224
I bet your password is chode
Well, I only have a few followers and a story with 200 or so likes...
My account isn't exactly 'catch of the day' but I'd rather not lose it.
Guess I'll change my password as a precaution. Thanks for the heads up.
630303 Pfffft. I just made my password the same as Fort Knox's rear entrance's password.
Knighty, this is sort of a big deal. Is it within your power to send out a mass PM to all the users stating this? Because I think we both know not everyone follows you.
I won't change my password just to see what they'll do when they hack me. What's the worst they can do? Delete my account? Just means I can retire early. Expose me as some shameless, hedonistic pervert, or make me looks like a jackass? I do that everyday on my own, thanks. Also thanks for the warning knighty, now I've got something to look forward to.
Loathe,
Your Antagonist
Fuck it, you all take my password:
It's Fuck you guys, my password's mine!
Not too overly worried as I use a different password for each site. But still gotta ask - are the hashes salted at all?
Well, ok, if you insist. How 'bout 54321? Your right too obvious... OHHH I know 654321. GENIOUS
. By the way anypony care to explain what Garbo802 posted? Apparently it was embarrassing... 
???
so these hash passwords are some level of encryption, so about how long would it take to brute force un-encrypt them would you say? i would guess between .01 sec and 500 million years.
looked more into it, it's not really brute force, but about how long can they reverse or look up or what have you to figure out the password? rough estimate. also salting looks to help in scenarios like this. that is if the hash passwords where salted