MaraPets - News

75

Snot ~ SB {they/them}

@Sombra You can't assume you're the only person in the world who has been abused.

Ian and admin work very hard to help players. There is no way they would do that to anyone. There is weeks of work.

And bruteforcing passwords don't matter if it's hashed/salted/whatever - it is literally a simple run through on that person's account to get in.

So again, no security breach, no victim blaming. We just want people to be able to safely play marapets without worrying about their account. And admin want to be able to do their job instead of spending weeks fixing accounts that have been broken into.

Admin and Ian love marapets. It's like a second home and it hurts to have someone break into it and then have players turn round and abuse them about it.

29

Chevrine smol birb, many yell

1,362 posts

goodness it's moving so fast.

Again, no one's saying weak passwords are okay.

I simply seek clarification that passwords are safely stored. If they are, great! Marvy! It doesn't matter how the compromised accounts fell into bad hands initially--this is a wonderful time to talk about security and this includes server security.

Thanks!

sig art by tomo

tired birb, low patience
limited spoons, picky spending

21

ColdLegumes Oh no

1,265 posts

Are the passwords hashed/salted?

75

Shaggy

20,086 posts

All passwords are encrypted and stored safely. To reiterate, Marapets server was not hacked and none of the compromised account information was stolen from Marapets servers. The accounts were accessed because they had easy passwords, easy to guess or work out by trial and error. Your account is as safe as you make it.

29

Chevrine smol birb, many yell

1,362 posts

@Shaggy Can you offer any insight on how the site can tell which users had/have weak passwords after they're set? Or what standards the passwords are encrypted to? How they're transmitted?

I absolutely appreciate the initial answer, thank you.

Also eeee...telling a user they assumed they're the only person who had been abused is... :shocked: O_o I'm uncomfortable. I don't like talking about my own experiences in public but...yeah, I'm uncomfortable. I don't think Sombra ever implied that, just that that phrasing is victim blaming, which...well, it is. @Xois

sig art by tomo

tired birb, low patience
limited spoons, picky spending

15

coolgirl218

777 posts

So what I am understanding is staff and Ian need to develop a password system that makes players have passwords that are 13-16 characters long, capital letters, including a symbol, and numbers. for example: Baranacle!!123

kinda like most other websites:like:

Staff

75

Mordo

Staff 47,645 posts

@coolgirl218 already has :like:

75

Shaggy

20,086 posts

No I can't tell you that as only Ian knows the answer. I have nothing to do with site coding or security. I don't actually think it's a good idea to broadcast how a site encrypts information either. We know the accounts were accessed by the hacker entering the passwords and some compromised players have confirmed that their passwords were not strong. We have no access to any player's passwords except our own. That is why we cannot tell a player what their lost password is and they have to request a reset, which is randomly generated. If we do have to manually reset a password we suggest the player change it immediately.

75

Peekaboo not all who wander are found

12,310 posts

I'll throw out there that I don't think my password could've been randomly guessed (it was not "weak" as some people are implying--it consisted of two unrelated non-Mara words and a number), but perhaps a program trying random word/number combinations could've cracked it eventually if there was no limit to the number of login attempts that could be made in a period of time (though it would've taken an extremely high number of guesses). It seems more likely to me that my password was obtained because I used it on a different site that had security vulnerabilities and was compromised. Shame on me for not having a unique password. Lesson learned the hard way!

75

Shaggy

20,086 posts

We know at least one other compromised account used the same username and password on another site so we do believe that the other site could have had a security breach and the hacker may just be trying the same username and password combinations until he found some that were the same on Mara and maybe other sites too.

15

Furgiven

2,587 posts

@Pib i like the idea of only a few attempts allowed before it's locked/ a verification email is sent or something.

Staff

75

Mordo

Staff 47,645 posts

@Furgiven thats would be great but if you could see the amount of accounts that do not have an up to date email address :'( giving account support is very difficult in those instances.

75

Shaggy

20,086 posts

There is a limit of 10 attempts before you are locked out for 30 minutes. It has been that way for a long time. Also passwords now have to be at least 10 characters with upper and lowercase and numbers. If your password does not meet that criteria your account will remain un-verified and you cannot play on the site. We are doing what we can to make sure your account is safe but you also have to take some responsibility.

20th July 2018