TBT Data Breach?!

[Ras]

Guys, I just got an alert that says:

The site belltreeforums.com has been reported in April 2019 to possibly have suffered a data exposure that could include 120466 records

I don't know what's going on, but change your passwords and take precautions. This message will probably be deleted, but I want to warn people.

 

[MasterM64]

Interesting report, what source did you get this information from so people can decide for themselves how legitimate this information is?

 

[Ras]

Lifelock

 

[Alolan_Apples]

I think it happened before that. I remember seeing a site announcement about it.

 

[Kurb]

oof luckily i signed up not too long ago

 

[Bcat]

can confirm this happened awhile ago. Nothing bad ever came of it as far as I know however. Just change your passwords if you're still worried and go on about your business.

 

[Ably.Saucey]

I think it happened before that. I remember seeing a site announcement about it.

Yes, didn't we get the 2 factor sign in afterwards?

 

[radical6]

Everyone should get a password manager anyway

Also I use haveibeenpwned to see if my email was leaked anywhere. I had a frigging calories app get breached

 

[EpicGamer12]

There was a mandatory password reset after the data breach. As long as you keep your passwords fresh, unique, and don't share passwords between sites, you have nothing to worry about.

 

[moonbyu]

oh snap, there was? i should change my password just in case

 

[AnimalCrossingPerson]

There was the 2018 one (https://www.belltreeforums.com/showthread.php?444940-Site-Password-Reset). Not sure about more recently.

 

[Jeremy]

As others have already mentioned, this was from February 2018. If you haven't changed your password since then or use the same one on other sites, you should change it. You can read more in the announcement thread for this here.

 

[Kurb]

all hail jeremy

 

[BonkOnTheHead]

If anyone uses the same passwords for everything they use online for sites, apps, etc. they're not very bright. If one gets compromised that means everything you use online would be compromised.

Having a password in a foreign language isn't secure. Having only numbers and letters as a password isn't secure. Having only numbers isn't secure. You should have at least one capital letter and at least one symbol in your password. You should have 2-3 or more passwords that you use for things that you can easily remember them with this combination. I have 5-6 different passwords I use and remember them all.

Someone "hacking" your password isn't merely them guessing it. There's keyloggers, remote access trojans and programs that go through a dictionary of words combined with numbers, etc. to guess possible passwords.

Too long didn't read: Don't be naive on the internet.

 

[AnimalCrossingPerson]

There's keyloggers, remote access trojans and programs that go through a dictionary of words combined with numbers, etc. to guess possible passwords.

Most websites, including this one, lock out users based on IP address for a while after however-many failed login attempts. Brute-force isn't really feasible for online accounts, and certainly wouldn't be worth the while just to get someone's account on a niche forums website. They go for the low-hanging fruit - buy a list of login details and try them on websites where accounts actually have value, such as PayPal. Security is good and all, but no-one's coming after your TBT account.

 

[Twiggy_Star]

I ussally don't bother making a long and unique password every time becouse I rarely stay more than one year on an account so if an account gets hacked and it's almost a year old, no big deal for me (assuming the hacker won't do any mess on the site using my account)

 

[Reckoner]

I ussally don't bother making a long and unique password every time becouse I rarely stay more than one year on an account so if an account gets hacked and it's almost a year old, no big deal for me (assuming the hacker won't do any mess on the site using my account)

the hacker can still somehow get your personal info or sell it even if you think it's not too much of a deal.
heck, people have had their entire identities revealed just because they posted a simple image online.

 

[BonkOnTheHead]

heck, people have had their entire identities revealed just because they posted a simple image online.

Using sites like tineye to do a reverse image search rarely works properly and doesn't make someone a "hacker".

Most websites, including this one, lock out users based on IP address for a while after however-many failed login attempts. Brute-force isn't really feasible for online accounts, and certainly wouldn't be worth the while just to get someone's account on a niche forums website. They go for the low-hanging fruit - buy a list of login details and try them on websites where accounts actually have value, such as PayPal. Security is good and all, but no-one's coming after your TBT account.

Why wouldn't it be worthwhile on a niche forum? You don't think people on here aren't using the same email and password for here as they do for paypal, their online banking, facebook, etc? People are dumb. They use the same user names and/or passwords for everything they use online. Whether the place is a niche forum or a serious site isn't the point.

 

[Reckoner]

Using sites like tineye to do a reverse image search rarely works properly and doesn't make someone a "hacker".



Why wouldn't it be worthwhile on a niche forum? You don't think people on here aren't using the same email and password for here as they do for paypal, their online banking, facebook, etc? People are dumb. They use the same user names and/or passwords for everything they use online. Whether the place is a niche forum or a serious site isn't the point.

that wasn't what I was talking about, but whatever
i was talking about the simple data within an image and how you could find someone's location and timezone using it

 

[AnimalCrossingPerson]

that wasn't what I was talking about, but whatever
i was talking about the simple data within an image and how you could find someone's location and timezone using it

Oh, EXIF data? Most services should strip it, and I don't geotag my photos anyway, but yeah - best remember that exists if you care about it.

- - - Post Merge - - -

Why wouldn't it be worthwhile on a niche forum? You don't think people on here aren't using the same email and password for here as they do for paypal, their online banking, facebook, etc? People are dumb. They use the same user names and/or passwords for everything they use online. Whether the place is a niche forum or a serious site isn't the point.

My point is no-one can really do anything with a TBT account. They can view your email address and private messages, and post "I stink", but that's about it.

Why go through the effort of spending ages cracking my TBT password, for example. "Oh look, AnimalCrossingPerson's email address is so and so and AnimalCrossingPerson's password is so and so. Let's try those login details on various websites. Oh, it doesn't work. That's a shame. I should have bought a list of leaked email address + password combos instead."