Change Your Password

ACEdit: This was somewhat of a misunderstanding, so there's no need to change your password. See FlagCapper's post

Sup guise. Letting you know what you all need to change your passwords associated with your accounts. As it turns out that people on ELR can get ELR passwords of other people by playing around with the site. Cool, Huh? I've tested it out. It works. That being said, if you use the same password here as you do on ELR, change it. (Since you can't change your password on ELR)

kthx.

Good thing I don't use ELR anymore.

I don't use the same one .

Wow, ELR is quite secure
Will do! *imitates Inu's avatar*

k it are changed

Could you PM me how that's done?

No wonder I had my password for irtl changed by someone else. O.o

Sheldon wrote:No wonder I had my password for irtl changed by someone else. O.o

I think that was rabid, actually. But, that was not me for a fact.

No, that most definitely was not rabid. Sheldon talked to rabid in the stream about it when it happened.
Thanks for the headsup though.

Thanks for the heads up. Moved to Announcements.

I have absolutely no idea what Inu is talking about -- I absolutely could be wrong but it seems like speculation to me.

Inu, please PM me what you're talking about so I can either dismiss this as false / confirm.

EDIT: What I find really strange is Inu is really active on ELR, he's posted nothing about this there, but goes straight to IRTL which has... how many ELR users? So this is kind of pissing me off because this thread is here on wrtl's announcements based on nothing more than Inu's word.

FlagCapper wrote:I have absolutely no idea what Inu is talking about -- I absolutely could be wrong but it seems like speculation to me.

Inu, please PM me what you're talking about so I can either dismiss this as false / confirm.

EDIT: What I find really strange is Inu is really active on ELR, he's posted nothing about this there, but goes straight to IRTL which has... how many ELR users? So this is kind of pissing me off because this thread is here on wrtl's announcements based on nothing more than Inu's word.

Explained in a PM, sorry. It really does make sense once you think about it though. You can't change your password on ELR without you, so there is no point warning people who can't do anything about it. I went to IRTL, because this is the group most effective.

EDIT:

Okay. I'm killling myself over this. I was talking to Oam, who found the exploit, and he was like, LOL FC FIXED THAT MONTHS AGO. (He didn't say that exactly that way.) What was happening was that I've used the hack when I tested it, on Ghosty. (Which he knows, and he already changed it when I asked him too), though I wanted to cover my arse if someone IP checked me. >.>

I still recommend changing your passwords from your ELR one. It's not that hard for someone to possible get it another way.

Though, this is without FC's input. I don't know if it still works, this is just what oam told me.

Okay, so as Inu said, this was fixed a LONG time ago. Even when it was active, and like two people knew about it, you had to actually know someone's password in order to find which account it belongs to. So if someone's password was something like "linerider" or "password", then you could guess that and then you would have to manually search through all the accounts on ELR to see if the results you got matched a query you made (I'm being purposely vague here, but the point I'm trying to make is that if:

A. you had a reasonably strong password

OR

B. the attacker searched through the ~2000 accounts manually on ELR and didn't find you

you are safe). Now, that said, I shouldn't be even having holes like that in my site in the first place. The reality of it is is that ELR is the first website I ever made and it is actually very poorly coded and makes amateur mistakes as a result. And several months ago I patched a bunch of these along with this one, and have been trying to raise the quality of the site's code to "Not coded by a 13-year old" since then.

Also, Inu, if you know about or find something like this you should notify me, instead of waiting months and then going to scare everyone on a different website. Your argument for helping people on a different website because you can't change password on ELR is stupid, because anyone who uses ELR would have seen a post there and would know to change their password on all the websites where they use that password, and not everyone on ELR goes to IRTL. I could understand posting it on both for previously active ELR members, but posting it just on IRTL makes no sense whatsoever.

Either way, had you told me about this when it did work I would not have banned you, or will ever ban someone for disclosing a bug that makes the website safer. I'm not sure what gave you that impression, but next time, please just let me know, and FFS check to see it actually works instead of posting [censored] like this:

"As it turns out that people on ELR can get ELR passwords of other people by playing around with the site. Cool, Huh? I've tested it out. It works."

It looks really stupid when it turns out that it doesn't actually work, and it isn't actually a problem.

tl; dr -- Issue was fixed a long time ago (and it's very unlikely it was actually used to find your password), Inu decided to wait several months before going and warning everyone that posted on a different website.

I understand that. Oppsie Dasie.

I didn't do anything wrong. I just didn't do it to it's fullest potential. There's nothing more I can really say other than,"My bad, opps".

Rainbow Dash wrote:I understand that. Oppsie Dasie.

I didn't do anything wrong. I just didn't do it to it's fullest potential. There's nothing more I can really say other than,"My bad, opps".

Nice half-apology. It's amazing how close you managed to put the words "I didn't do anything wrong" and "My bad".

FlagCapper wrote:

Rainbow Dash wrote:I understand that. Oppsie Dasie.

I didn't do anything wrong. I just didn't do it to it's fullest potential. There's nothing more I can really say other than,"My bad, opps".

Nice half-apology. It's amazing how close you managed to put the words "I didn't do anything wrong" and "My bad".

I'm sorry.

Ok. Gonna close this. Thanks FC