@La Yeah, obviously. I’ve seen the thread. This news post should have been made right away.

Glad to have an official news acknowledgement of the issue, but I agree that it's unfair to expect children, or honestly even older players (no offense, older folks, I know my and my partners' moms and their friends and it's a noticeable issue...) to know how to create a strong password.

On top of that, when I asked a while ago about password strength, I was told that '8 characters is enough' and that the site only stores like...12 or 16 characters as it is, so if that's still true, passwords here are by design what most would consider weak in today's online world.

Finally, I and others are still really hoping to get clarification about how the passwords are salted, hashed, and stored. If they're transmitted or stored in plain text at any point (and again, when I joined I was indeed sent my password that I chose, in plain text) then it doesn't matter if your password is password, hunter2, CorrectHorseBatteryStaple, or sjshBdu475$/*1369hd)2SjfnUHg, they're all equally vulnerable.

I appreciate the work you've been doing. Thank you.

Whew, comments are going fast. Yeah, as I've said, the fact that the system was able to determine my password was strong enough to not need verified the first time around is a HUGE red flag.

And yeah, Sombra, same. Ten years, here. I love the site a LOT, most fun I've had on one in years, but the staff communication about this issue hasn't been great, I'm sorry. The victim blaming is EXTREMELY unprofessional.

:)

@Mordos

Several players have had their accounts compromised and have lost items/MP/AU/pets because of their lack of responsibility towards their accounts.

This is textbook victim blaming! I've been a victim of parental abuse for years! Trust me!! I know 100% what this is! And, frankly, it's incredibly disgusting!!! And HIGHLY triggering to me, and possibly many others!

AND! Like almost half the posters here have said, password strength DOES NOT MATTER if the passes aren't hashed and stored securely, NOT IN PLAIN TEXT.
Staff wouldn't have weeks of work ahead of them if passwords were stored correctly to begin with.

Also, stop blaming whatever the Other Site is. That's unprofessional and looks very bad.

@AlphaGreyWolf Lin just said it's not blaming the players.

There were no security leaks within mara at all. This was literally down to players that had really weak passwords. The guy cracked into their accounts. That's literally what it was and why it's being pushed so hard to have a complex password.

No victim blaming, simply please secure your account and follow the instructions outlined in the news post if you're not sure.

@Sombra - it wasn't how the passwords were stored that was the problem. The person CRACKED the passwords, didn't use any security breach.

And no, it's not "textbook victim blaming" it is trying to prevent stuff like this happening again.

As someone whose account was compromised, I am grateful to the staff who repaired the damages and to the players who patiently waited with my items in their inventory. It has been a pain for everyone involved. However, I am a little saddened by the victim-blaming rhetoric. Perhaps I needed more secure locks on the door, but that doesn't change the reality that someone broke in, tossed my items out the window and gave my pet away. I did not share my password with anyone, so whoever obtained it did so without my permission or knowledge. Shame on the person who accessed my account! I hope their dentist is scary and that they have 3 cavities at their next appointment. And I have learned from this experience. Read the Google Guide to a Strong Password, follow the advice, and avoid the trouble I went through. I will confess--I don't believe it was worth the time of the staff to restore my account and I don't believe they had any obligation to do so. It was generous of them. But I believe we can be kinder in how we discuss account protection going forward. "Lack of responsibility" didn't put one of my pets in the pound and send my items to random users--a bad person did. Let's not make it so easy for bad people in the future. :thumbsup:

Edit: Wow, while I wrote my comment a lot more were posted! Sorry to keep beating the dead horse. If it was a pinata there'd be candy everywhere by now!

@Xois

Thank you for explaining that and thank you staff for all your hard work
Delete my comment if you want cuz this was before all that was cleared up
:)

@Xois
Hmmm, you're telling someone who was abused by their family for close to 10 years that this isn't victim blaming and honestly. That's hilarious.

You know, it's a whole heck of a lot harder to "crack" (the term you WANT is "bruteforce") a password when it's actually thrown under some security instead of in databanks for the world to see. :)

Mmhmm. I don't feel my account is secure at ALL currently, and I pride myself on making sure my passwords are secure. It isn't in our control if our passwords are stored in plain text.

Many of us have spent hundreds of dollars on this site. We're paying customers. I'm not trying to start crap, but I do not feel comfortable with the security of my account, and I am powerless to rectify that without the assistance of those responsible for maintaining the server. I spent money, and I do what I can to remain secure. If I should lose that because of poor server security, well...

As I've said, an ounce of protection is worth a pound of cure. We appreciate the effort you're all putting in, but it's moot if the root problem remains unsolved, and we simply seek clarification and reassurance on that matter.

Users are not attacking you, and I'm sorry if it feels that way, but paying customers need assurance. Thank you for your understanding.

:like: