(Archived) Forum Hacked

[Murk 8]

I see the forum was hacked this afternoon. What are the implications for account security?

[C6REW 416]

+1 on that

[GrumpyMonkey 4,315]

I see the forum was hacked this afternoon. What are the implications for account security?

The hacker claimed to have exposed user info and dumped passwords. Who knows? In my opinion, this would be a great opportunity to just change your password. Nothing is 100% effective, but with very little effort you can make it exceedingly difficult for a hacker to break into your stuff. I recommend doing the following:

(1) Use a password manager

(2) Use a long password (15, 20, or more characters)

(3) Use a random password (have a password generator make it)

(4) Use a unique password (one password for each site, so even if hacked, no damage)

(5) Change the password regularly (even if hacked, no opportunity to use it)

(6) Use a unique and randomly generated email address for your password manager (no way to access your pw manager).

I'd take this opportunity to change your password. It only takes a minute, and it can't hurt. I doubt the hacker really got anything, but better safe than sorry.

[EDIT:] Evernote has since confirmed that know passwords were compromised, because the forum does not have access to that information.

[BurgersNFries 2,407]

I hope I'm not speaking out of turn here, but per an EN employee I texted, passwords were not accessed by the hackers.

[C6REW 416]

Hmmm,

Unless I am mistaken my password doesn't work anymore!

Regards

Chris

[C6REW 416]

Yep, cannot change my password.

Windows and iPad are not working. So far only the iMac is getting to the forum.

Regards

Chris

[BurgersNFries 2,407]

I see the forum was hacked this afternoon. What are the implications for account security?

The hacker claimed to have exposed user info and dumped passwords. Who knows? In my opinion, this would be a great opportunity to just change your password. Nothing is 100% effective, but with very little effort you can make it exceedingly difficult for a hacker to break into your stuff. I recommend doing the following:

(1) Use a password manager

(2) Use a long password (15, 20, or more characters)

(3) Use a random password (have a password generator make it)

(4) Use a unique password (one password for each site, so even if hacked, no damage)

(5) Change the password regularly (even if hacked, no opportunity to use it)

(6) Use a unique and randomly generated email address for your password manager (no way to access your pw manager).

I'd take this opportunity to change your password. It only takes a minute, and it can't hurt. I doubt the hacker really got anything, but better safe than sorry.

I agree. Although the EN employee said passwords were not accessible to the hackers, that doesn't mean the hackers couldn't use apps to try to break into the accounts. Just to be safe, I also changed my password.

[C6REW 416]

Looks like my password has been changed so I cannot enter whatever it is to change it!

Oh dear!

Chris

[GrumpyMonkey 4,315]

I agree. Although the EN employee said passwords were not accessible to the hackers, that doesn't mean the hackers couldn't use apps to try to break into the accounts. Just to be safe, I also changed my password.

I doubt the user information and passwords were compromised, either, but it is just so easy to change a password, I don't see any reason not to do it. As soon as I saw the site had been hacked, I changed my Evernote passwords, and was done within maybe a minute.

[BurgersNFries 2,407]

Looks like my password has been changed so I cannot enter whatever it is to change it!

Oh dear!

Chris

Have you tried the forgot password option?

[GrumpyMonkey 4,315]

Looks like my password has been changed so I cannot enter whatever it is to change it!

Oh dear!

Chris

I recommend going to the www.evernote.com website and changing your password there. I had no problem doing it earlier.

[spg SCOTT 736]

For anyone else that tries to change their password on the forum:

It is not possible to do so via the forum, because the passswords (and login in general) are not handled by the forum sorftware, rather they are handled by the Evernote account system itself.

This means that, to change your password you will need to log in to Evernote.com and do it from there.

I am not 100% sure, but I think that this means that by hacking the forum software they couldn't get passwords anyway, since that is contained within the Evernote account and all the forum sees is an authentication cookie.

But like I said, not 100% percent sure on exactly how that works. FWIW I have also changed my password, just in case.

Scott

[BurgersNFries 2,407]

And to clarify, from what I've seen & heard, only the Evernote MESSAGE BOARD was hacked, NOT the Evernote servers (where your notes reside). But under the circumstances, as GM said, I don't see a reason NOT to change your password now.

[BurgersNFries 2,407]

FWIW, it's the same hacker(s) that hacked several of NBC's websites, today, including Saturday Night Live's.

http://www.theverge..../nbc-snl-hacked

[BurgersNFries 2,407]

A little more info here:

http://updates.gizmodo.com/post/34988818791/hackers-replace-nbc-sites-with-smorgasbord-of

[C6REW 416]

Just back on line for me!

Missed the site, now that is bad isn't it!!

Chris

[Kiwimarc 1]

I actually received an email - addressed to me by my Evernote user name - regarding the matter.

When I followed the link to the forum within the email it took me to a very dodgy Paypal window......

[gbarry 2,657]

I actually received an email - addressed to me by my Evernote user name - regarding the matter.

When I followed the link to the forum within the email it took me to a very dodgy Paypal window......

Shady. Thanks for reporting, I'm going to reach out to Invision on this and we may want to get a message out to the rest of their client base if we can verify it's related.

If it is, I will include this in an administrative email I'll be pushing out to every registered community member.

And to echo what others above said--we use a cookie to authenticate, so your Evernote password, and Evernote account, are not held with the forum. That said, any incident that works as a reminder for our users--or anyone really--to take some additional steps in increasing their own data security is a Good Thing in my book.

[gbarry 2,657]

Looks like my password has been changed so I cannot enter whatever it is to change it!

Oh dear!

Chris

And to officially close this part out, you cannot change your passwords in the forum, because there are none to change

[C6REW 416]

Looks like my password has been changed so I cannot enter whatever it is to change it!

Oh dear!

Chris

And to officially close this part out, you cannot change your passwords in the forum, because there are none to change

If I knew what you meant, that would be great!

But no matter, as long as we are safe and sound and back to normal that is all that matters!

Best regards

Chris

[GrumpyMonkey 4,315]

Looks like my password has been changed so I cannot enter whatever it is to change it!

Oh dear!

Chris

And to officially close this part out, you cannot change your passwords in the forum, because there are none to change

If I knew what you meant, that would be great!

But no matter, as long as we are safe and sound and back to normal that is all that matters!

Best regards

Chris

Hi Chris.

I think what it means is that if you logout and try to login you'll see that you do it through the Evernote website. With that sign-in at Evernote, you can access the forums, but the company that owns the forums does not ever see your password, so there is nothing on record, and therefore, nothing to get hacked.