CF Passwords Hacked?

[Delancey]

Just a heads-up-

I’ve recently received a few junk emails that include my CF password in the title. Preview of the body says something like “your computer has been infected by my malw...”

While I used this simple password for a couple different things long ago, it has been used exclusively for CF for many, many years.

Here is useful link to help you figure out if your passwords have been hacked.

https://haveibeenpwned.com/Passwords

It checks the password you enter against the various hacked password lists available for purchase on the dark web.

[DeepFrz]

So you actually entered your passwords into that site? Wouldn't it be prudent just to change your password?

[Delancey]

You have probably been hacked and didn’t even know it.

The purpose of the site is to provide people a way to find out if they have been hacked in the past. Given the fact that some acknowledged data breaches have affect hundreds of millions of people, chances are you are one of them.

Give it a try. You might not like what you find out.

If you dig in there the site tells you specifically NOT to enter any current passwords you are using. It’s a legit site. Not a scam.

Of course change your password. I don’t really care about CF so never bothered changing the simple one I had been using.

[DeepFrz]

Okay. Great.

I noticed that Firefox has a notification that CF is not a secure site so it behooves us all not to use the CF password for anything else. Of course we shouldn't be using passwords or user names for more than one site anyway.

Hopefully CF will upgrade the site.

[Lake-Effect]

Almost a year back, I received one of those extortion emails that happened to include one of my passwords. Fortunately, I use multiple passwords: hard ones that are never stored and are unique for each important site, and a simpler throwaway password I use for logging into sites with very low security implications - like CF.

The extortion email used the throwaway one, so I can't be sure what site it leaked out of. Anyway, I just made up a new throwaway password and changed it on all those low-consequence sites. From the OP's experience, maybe it was CF.

Moral - manage passwords carefully, and don't also use important passwords for trivial sites whose concern or need for security is low.

[andrewparker]

When you click that link, the request to https://haveibeenpwned.com/ may include the referer field, which indicates the last page the user was on. In this case cruisersforum.com. Providing your cruisersforum.com password at that point would be a bad idea. It's a legitimate service but don't provide any passwords that you currently use. Just change your password.

[B23iL23]

We would hope that CF do not store passwords in cleartext and that in tech terms, they are hashed and salted. Assuming they are, then the only way the 'bad guys" can get that password is to capture it as you are entering it - ie on your computer. That would mean your pc/laptop is infected and has an exploit on it.



If CF are storing passwords un-hashed, then all bets are off.

[Lake-Effect]

Originally Posted by B23iL23

We would hope that CF do not store passwords in cleartext and that in tech terms, they are hashed and salted. Assuming they are, then the only way the 'bad guys" can get that password is to capture it as you are entering it - ie on your computer. That would mean your pc/laptop is infected and has an exploit on it.

If CF are storing passwords un-hashed, then all bets are off.

It could also just be hacked wifi points if you log into CF while travelling, since CF isn't using SSL (https) . (No excuses CF, it should be secured)

[benvanstaveren]

Folks, if you are receiving that type of spam, change your passwords. Chances are you re-used an old one that was found in a dump online, and people are credential stuffing with them.



You can use https://haveibeenpwned.com/ to enter your email and/or your password to see if an email address you have used on sites before has been leaked, or your password has been found in a dump.



Please note that this does not mean cruisersforum has been hacked; although possible but I'd imagine the staff being aware and doing the responsible thing


Also it's perfectly safe to enter your email or password on HaveIBeenPwned - the site is ran by a rather famous security researcher as a free service to the internet community at large, and will only tell you if your email address has been found in data leaked through hacks of various sites.

[benvanstaveren]

Originally Posted by andrewparker

When you click that link, the request to https://haveibeenpwned.com/ may include the referer field, which indicates the last page the user was on. In this case cruisersforum.com. Providing your cruisersforum.com password at that point would be a bad idea. It's a legitimate service but don't provide any passwords that you currently use. Just change your password.

That's... a little paranoid. And I'm in IT security for a living so that's saying something (we're a paranoid lot by nature)

[B23iL23]

True. Just noticed that. Means browser connection is wide open. Not good CF.

Originally Posted by Lake-Effect

It could also just be hacked wifi points if you log into CF while travelling, since CF isn't using SSL (https) . (No excuses CF, it should be secured)

[StuM]

Originally Posted by Delancey

Just a heads-up-

I’ve recently received a few junk emails that include my CF password in the title. Preview of the body says something like “your computer has been infected by my malw...”

While I used this simple password for a couple different things long ago, it has been used exclusively for CF for many, many years.

Those junk emails are prevalent on the internet and are using old compromised password lists. I'm aware of people receiving them who have not used the stated password for many years. That is likely to be the case here.

[kev_rm]

CF is not https. Any secrets you send to it are obvious to anything between you and CF servers. Password managers are your friend.

[Lake-Effect]

Originally Posted by kev_rm

CF is not https. Any secrets you send to it are obvious to anything between you and CF servers. Password managers are your friend.

If a site's login page is not https, the password still travels in the clear, even if you have a pw manager.

[DeepFrz]

Originally Posted by Lake-Effect

If a site's login page is not https, the password still travels in the clear, even if you have a pw manager.

True, however, a good password manager makes it easy to have separate passwords for each of the sites that you have to log in to. That way if your password for CF is hacked it doesn't lead anywhere other than your email address.