Re:SourceForge attacked, resets 2 million account passwords ...
by bradleyland on Saturday January 29, 2011 @01:20PM
(#2155959)
I'm not sure how this protects users? SF was already compromised. If someone gained access to the passwords in their database, they're already out in the wild. Changing your password now has zero benefit to the user outside of protecting access to SF itself.
Re:SourceForge attacked, resets 2 million account passwords ...
by nodata on Saturday January 29, 2011 @04:33PM
(#2156450)
> I'm not sure how this protects users? SF was already compromised.
The passwords were potentially compromised. Changing the passwords for their users means the user accounts won't work with the (potentially) compromised passwords any more.
> If someone gained access to the passwords in their database, they're already out in the wild. Changing your password now has zero benefit to the user outside of protecting access to SF itself.
If the user is using one password for all websites that's a separate problem. This move is to protect SF users' accounts.
Re:SourceForge attacked, resets 2 million account passwords ...
by bradleyland on Saturday January 29, 2011 @11:03PM
(#2157324)
Both of which are protection for SF, not for the user. Personally, I use a utility called 1Password, which means I don't use the same password for very many sites. My point is that for those who do use the same password for SF as well as other sites, this move doesn't protect them. It only protects SF.
In short, I disagree with the wording of the title. This does nothing to protect users, it only protects SF.
Re:SourceForge attacked, resets 2 million account passwords ...
by bradleyland on Sunday January 30, 2011 @12:04PM
(#2158445)
Nothing. The breach is over. And they should force user password changes. I'll say it again. I'm simply disagreeing with the phrasing of the title painting this as protecting users.
The passwords were potentially compromised. Changing the passwords for their users means the user accounts won't work with the (potentially) compromised passwords any more.
> If someone gained access to the passwords in their database, they're already out in the wild. Changing your password now has zero benefit to the user outside of protecting access to SF itself.
If the user is using one password for all websites that's a separate problem. This move is to protect SF users' accounts.
In short, I disagree with the wording of the title. This does nothing to protect users, it only protects SF.
... thinking the same thing. github is the new sourceforge.