News for hackers. Stuff that matters.

A comment on Ubisoft hacked, account data compromised.

Re:Ubisoft hacked, account data compromised by dansanderson on Tuesday July 02, 2013 @03:13PM (#5980097)
They sent a notification email to every customer asking them to change their password. The email includes the user's current password.

I know this because I received such an email-- intended for someone else who accidentally used my email address for their account. So not only is Ubisoft storing raw passwords and sending them via email, they're not verifying email addresses during account creation.

[ Parent | on HN ]
Re:Ubisoft hacked, account data compromised by Brandon0 on Tuesday July 02, 2013 @03:39PM (#5980229)
No way, really? According to the article they claim to "encrypt" the passwords (they actually mean hash). Any way you could post the contents of the email (minus the personal details)?
[ Parent | on HN ]
Re:Ubisoft hacked, account data compromised by dclowd9901 on Tuesday July 02, 2013 @03:44PM (#5980259)
I think he's misunderstanding the email:

>As a result, we are recommending that you change the password for your account: dclowd9901

All I see is the plaintext representation of my username.

[ Parent | on HN ]
Re:Ubisoft hacked, account data compromised by dansanderson on Thursday July 04, 2013 @02:21AM (#5989418)
Ah, glad to have that clarified. The username in the misdelivered email I received looked very much like an attempt at a memorable password, not a username. Thanks!
[ Parent | on HN ]