[UPDATED 5/25/2016] Password Resets
8 years ago
5/25/2016 UPDATE
We've made some improvements to the password recovery system. If you were having issues prior please give it another try!
For the safety and security of all users, we have reset ALL passwords and active sessions.
To Reset Your Password:
Use the Password Recovery Tool here at https://www.furaffinity.net/lostpw/
Having Trouble?
If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary.
Fur Affinity staff will NEVER ask for your password!
Changes and Updates
* Full security audit of the code regarding the way it composes and makes database requests
* Partial [ongoing] audit of how the code makes use of incoming request parameters (GET, POST).
* Changed database auth credentials for the account the code uses to access the DB, and reduced its privileges.
* Changed password hashing backend to BCRYPT (with a high enough computational cost. maximum supported password length now is 72 characters).
* Removed all ImageMagick use from the app server, and deleted the packages.
* Reset all user passwords
* Deleted all active user sessions
* Fix for inconsistent code behavior dealing with usernames and passwords supplied by web forms on all relevant pages. In certain cases characters were removed or extra characters were * added to them before they were processed by the code.
* Fix for inconsistent code behavior when dealing with text data from web forms. In certain cases characters were removed or extra characters were added to different text fields before they were processed by the code.
* Modified the Login page, making the page page honor Read Only mode, adding Captcha.
* Modified the Password Recovery/Reset page. It now displays success/error messages on-page and limit reset requests to once per 15 minutes per account.
* Emailed reset codes expires in 1 hour.
* The site now stores timestamps of last reset request and successful reset for later usage/investigation.
* Added check to prevent "restoring" back to the same password as before the attack
We've made some improvements to the password recovery system. If you were having issues prior please give it another try!
For the safety and security of all users, we have reset ALL passwords and active sessions.
To Reset Your Password:
Use the Password Recovery Tool here at https://www.furaffinity.net/lostpw/
Having Trouble?
If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary.
Fur Affinity staff will NEVER ask for your password!
Changes and Updates
* Full security audit of the code regarding the way it composes and makes database requests
* Partial [ongoing] audit of how the code makes use of incoming request parameters (GET, POST).
* Changed database auth credentials for the account the code uses to access the DB, and reduced its privileges.
* Changed password hashing backend to BCRYPT (with a high enough computational cost. maximum supported password length now is 72 characters).
* Removed all ImageMagick use from the app server, and deleted the packages.
* Reset all user passwords
* Deleted all active user sessions
* Fix for inconsistent code behavior dealing with usernames and passwords supplied by web forms on all relevant pages. In certain cases characters were removed or extra characters were * added to them before they were processed by the code.
* Fix for inconsistent code behavior when dealing with text data from web forms. In certain cases characters were removed or extra characters were added to different text fields before they were processed by the code.
* Modified the Login page, making the page page honor Read Only mode, adding Captcha.
* Modified the Password Recovery/Reset page. It now displays success/error messages on-page and limit reset requests to once per 15 minutes per account.
* Emailed reset codes expires in 1 hour.
* The site now stores timestamps of last reset request and successful reset for later usage/investigation.
* Added check to prevent "restoring" back to the same password as before the attack
Merch Store
yet not all high-traffic websites have high-IQ admins
that's OK though. we're all just trying to do our best here :)
I was surprised that FA didn't have HTTPS. I thought that was just something that any site would have. Oh well, it's fixed for me, at least.
in the case of FA the admins are just too stupid to auto-redirect all connections to https ...
There you go, Furaffinity with HTTPS, it exists.
It. Is. Not. The. User's. Obligation. To. Type. "HTTPS://".
The site itself should have that as an automated function. Which means, and I will repeat again: it should be done BY THE SITE ITSELF; the HTML coding should be set in a way that the site should be httpS by default, which is not the case on FA.
If after this small and concise sentence people still don't understand it, I strongly suggest either learning how to read and try to understand simple English.
The method you use to connect to a server is solely the client's responsibility and choice. HTML does not dictate whether or not you connect using HTTPS as opposed to HTTP. In order to force HTTPS connection, that would require modification of the web server's configuration and possible additional server side scripting.
It's not that I don't understand what you're saying, it's that protocols are client's choice and should remain the client's choice as forcing a protocol on someone else may be an unwanted action. If you choose to use furaffinity using HTTPS, then you may specify the HTTPS protocol.
I'm sure it's not hard to type one letter.
Yes I am kinkshaming.
Unbirth
Cockvore
Anal vore
Vanilla sex
Oral vore
Dildo TF
Cockvore and anal vore are the only ones of these I've ever been even a little ashamed of.
But right at the top of what will be the most viewed page on this site for days, you felt a need to share a list of what you get off to.
Like...
*their submissions/favs
We share Vanilla, but other than that I just like circumcision of furries XD
And rightly so; sex is for creation, not for elimination. I like my kinks as much as the next guy, but there are just things that are fundamentally bad.
No offense-ish, though.
At least vore can only (legally) be fictional. As long as it stays solely in art it's not harming anyone
fetishes*
Sorry, autocorrect.
Like I could see that opinion relating to violent gore/'realistic' vore. But in regards to vore as a whole the majority is highly unrealistic 'being swallowed whole' stuff. (I'm not into any of it personally, this is just what I see)
http://www.furaffinity.net/gallery/sparkythechu/
The ones that don't evolve into this are... "lucky," I suppose.
Basically what it comes down to is you don't condone and aren't comfortable with violent acts depicted in a sexual way, from what I can tell?
And I can certainly understand that.
Sorry if I offended you with this indirect reply; I've just been in a lot of religion-based arguments lately. I'll try to keep it off that topic.
Religion (sorry) is the biggest example of brain conditioning; just look at the extremists--otherwise normal people turned into suicidal maniacs. Brain conditioning exists and in great prominence in human society. If we applied it in the correct manner, we could work as one unit and advance at a much greater pace, but alas, our social intimacy is not great enough. We have too much mistrust for each other.
...The human form also has a lot to be desired. I don'the know what evolution was thinking.
No one cares.
Most lower animals aren't nearly sentient enough to be comparable to eating a human or even a DOLPHIN as they are operated more by instinct rather than voluntary actions; it's simply survival to eat another animal as food, not a fetish.
I'm aware of you consciously attempting to give "sentient" much too broad of a definition by inserting quotes.
Sure, things like necrophilia, pedophila, and other very dirty attractions are condemned everywhere and for a good reason. Except I don't see how something as virtually impossible and fictional as vore is "bad." Compared to bondage and paw attractions, it's pretty tame and some friends that I know of can seperate fantasy from reality. There is something called fish swallowing, but rarely practiced. It's dangerous anyways.
It's still killing and eating for meat. Not much different. It can go on hand with bondage, a feeling of control/vise versa.
Oh like? Examples please.
If you've ever been to the deep web, or at least heard of it, you'll know vore isn't just a fantasy, it's a very real and equally disturbing deviance that mustn't be ignored, but often is because of the anonymity of the deep web. Even now, hardcore vore fetishists are chatting on The Cannibal Cafe clones and such.
If you go on with the continued interest of vore, though unlikely, can spark a flame of sexual attraction of death and dismemberment. You know what time does to chances, though? It increases them. The more you wait, the bigger window you're giving that seemingly harmless spark to ignite that gasoline. Chances are increased still if you are teased with the fact you can never achieve satisfaction with this fetish unless you break humanity's greatest law. Psychopaths rarely realize they are so until it's too late.
Scientific research shows habits and interests are passed down by the parent to the child. I don't want a time bomb to be passed down to our children. Vore has no room in this, or any, species.
Lower animals are like robots. They have no significant consciousness or meaning to life. They are practically meant (and on some levels, literally) to be eaten. Destroying a computer isn't going to affect your consciousness, right? Like it or not, certain animals shouldn't live through their life expectancy. Depressing at first, but then you realize your emotions aren't noticed or understood by cattle.
The thing with bondage is that it doesn't necessarily signify harm. It can also promote submission when appropriate, which is actually a good trait for any social species. I actually find the act moderately arousing, especially on the receiving end. I also have a paw fetish.
Heck furries aren't physically possible in general.
Genetic manipulation makes almost all that you listed physically possible. Hell, there are actually some primitive herm animals. Micro isn't possible because you can't shrink atoms; macro isn't possible because our anatomy can't support tremendous weight.
*Sorry, responded in the wrong thread.
Mmmm, I'm smelling bias. The basis if something is bad as in "unethical" is debatable.
...You were talking to me, right?
We need that drawing
If you draw it ginme a shout in my page
We need a drawing of that please!
"Changed password hashing backend to BCRYPT (with a high enough computational cost. maximum supported password length now is 72 characters)."
- Thank you! That is a good move (qwhich should have been done years ago...)! Although "high enough" is relative. Care to share the actual cost? Just curious. That info doesn't impair security as far as I know.
"Removed all ImageMagick use from the app server, and deleted the packages."
- Just to clarify, you mean you removed it from servers that don't need it, but it still does image processing on the appropriate machines, right?
"adding Captcha"
- There is no reason for the Captcha to be displayed by default. This is both annoying and breaking autologin. It should be enough to display it after the first failed login attempt. If you tie it to username and store the flag internally then it cannot be worked around by changing proxy etc. What do you think?
The rest sounds good to me, though there are many more things you could do to improve security. And I honestly hope that you truly managed to close all holes in the code in this short time period. It would suck if FA went down again in a few days.
Guess we'd better ditch PHP. since it has 475 CVEs: https://www.cvedetails.com/product/.....l?vendor_id=74
And Apache HTTPD since it has 190: https://www.cvedetails.com/product/.....l?vendor_id=45
And MySQL since it has 243: https://www.cvedetails.com/product/.....?vendor_id=185
I mean, ImageMagick only has 48; that's far too low! https://www.cvedetails.com/product/.....vendor_id=1749
And that's only bugs that have been assigned CVE numbers. Lord knows all of those products have been patched numerous other bugs.
And, if you want a surprise, the product with the most CVEs is... OS X followed by the Linux kernel. x3 https://www.cvedetails.com/top-50-products.php
Trying to do the email reset for my account
Email sent to accounts[at]furaffinity.net now just twiddling my thumbs over here.
I sent mine the moment I realized FA wasn't going to let me in and I'm starting day 2 of the wait period
Hopefully all this will get sorted in a day or two and everyone can move on >>
Sent two emails regarding this, now just gotta sit and twiddle my thumbs.
I had a bit of a problem.....I've accidentally signed up a website named furry network as a mistake for google , and there is no way to deactivate my furry network account.
Can you me how figure a way to permanently delete my furry network account ?
Fatal system error!
Submission type is not allowed! Please do not insert code that doesn't belong there.
[Click here to go back]
I'd give it a half-hour or so minimum before that changes, there's probably a flood of people all changing their passwords at the same time.
...Unless the code somehow got screwed up during the audit, then we might be waiting for a bit longer before we can submit anything...
I really hope it's the first one.
lmfao
Just a regular day on FA.
If you used the same password for FA on another site with the same user or email YOU NEED TO CHANGE THAT TOO. The hackers have peoples passwords, and your other accounts are at risk too.
Why FA isn't warning people of this, I have NO idea.
PS. I am just making sure I understand ^u^
Again, though, they stated it was ENCRYPTED data that was stolen, not unencrypted data.
I'm used to American people mentioning "their business" (even if it's not "their money") and throwing lawsuits left and right for the fun of it, though rarer that it specifically comes from the Silicon Valley non-corporate residents (we know the IT competence of typical law-making politicans around the world, don't we?), but we have a similar law in Germany in theory - and in practice I've never received one such information mail. Do other companies actually really comply with this?
(if it's not also mentioned in IT tickers, my usual method of detection is that every company gets a dedicated email address from me - the moment it is used for SPAM I know they either sold my data or have been breached. By the way, this happened to my bad-dragon-address already, and they didn't react to me neither)
encryption is a reversible process, no information is lost. the cipher text can be transferred back to the plain text, knowing the used function and the (shared secret or assymetrical) key. This also implies that the cipher text usually is of same length as the plain text (disregarding padding), which is information leaking you don't want in password scenarios.
hashing is a function to generate a very short piece of bits (1 bit parity in the extreme to about 23 bytes for bcrypt) from arbitratily input length data - that is, it is by definition lossy. There is no definite way to get back the one plain text used to create the hash, and in general it is desired that even finding any kind of input resulting in the same hash should be "hard".
Passwords are generally always stored hashed. The idea is that when breaches like this happen, it is hard to get back to the original password, for which hashing functions are way more suited than encryption (this didn't stop Adobe from encrypting, instead of hashing, their passwords).
So "encryption" is not the term, or even the practice, we're after here.
And "hashing" is what is, and ought to be, done.
In the days when rainbow tables were a thing - the time span between hard disks got cheap enough to store the sparsly pre-computed hashes and before GPUs became cheap enough that you just do brute force again (using e.g. hashcat) - salts were essential to ward those of, and even today it's necessary, to force an attacker to brute force each password individually instead of all at once. Some treat salts as secret (and it doesn't hurt to do that), but their strength lies not in secrecy, but in being different for each user.
So, "salting" is also what is, and ought to be, done.
"Reversing" a hash function should be easy in theory. Since it's lossy, there are so many more potential passwords which would fit the same hash. That's where the "cryptographic hash" is used - a function designed to make it really improbable to find matching plain texts (one would be enough, or two in cases like hash collission attacks for e.g. document signing spoofing), and "hard" to brute-force it. That is true today as it always was, but computers got so much more powerfull that the mathematics couldn't keep up in terms of complexity. So what is done today is repeating the step - password salt, hashing, take the result, hash it again, take the result, hash it again, a variable number of times easily in the thousands. This is also known as "key stretching".
And that's what bcrypt, currently industry best practice, does: repeatedly hashing salted intermediate results, beginning with the original password.
So I refute your claim that "Salting and Hashing" is "replaced in the industry" and that it would be "not secure".
The impression from the old continent is that Americans either do it for fun, or if they think they can somehow profit from it regardless of ethical values, and sometimes even just out of spite because they don't like someone or a differing opinion. The latter looking like running to mummy if the classmates say mean things.
Also companies, and the type of persons rising to the top of them, are not generally known for adhering to the law "because it IS THE LAW" (that's for the small henchmen, anyway), but because they can't get away with it otherwise. The newstickers are full of examples where they tried.
I'd be happy if you could point out the "we sell your mail address" in the Bad Dragons ToS for me, as I haven't noticed that back when I signed up some years ago.
You see that's still the original text of the bill, not the text after it was amended and passed.
You are mistaken, I apologize but it's true.
You're a sweetheart.
Really? Are you sure about that?
Also, hashing is not a form of encryption. Encryption is a method of concealing data. Hashing is a method of reducing or destroying data in a way where later another set of data can be hashed and compared to verify the data is the same. The important point is with the key encryption is reversible, whereas there is no way to reverse a hash.
In this case FurAffinity chose a password hash, bcrypt, which is specifically designed to be computationally slow. This is in opposition to normal cryptographic hashes like the SHA family, which are designed to be fast. This allows cost to be inserted into the password hashing scheme to slow down brute force attacks.
looks like you were a little late
you're using a mac
Otherwise, good to see a bit tighter security with logins now.
It is GREATLY appreciated!
I mean, if I'm stuck manually doing it that would suck, I'm just curious. :)
Sucks that its inconvenient for robot programs, but those things are unethical as hell in the first place. The computational cost of spiders on a host website is boggling.
...
Except how would you even be asking this question if you didn't?
That way 3rd party software is still functional and security is at the users discretion.
But that actually isn't the problem - you're right that the idea is insane, but the idea is insane because if you are hitting the captcha that means you are not logged in. The site therefore doesn't know whether you want a captcha or not, because it doesn't know who you are. So it'd be more or less impossible to implement, except maybe by checking on the backend *after* an invalid captcha is submitted to see if the username in question has captcha disabled. Which is silly.
Literally just now.
* After a failed login forcing that IP to captcha logins for an period? That's fine.
* Having a captha on every single password-reset-code-request? That's also fine.
But this is either:
1) Rushed out ("Quick, we need a Captcha! Just throw it on every login request...") which means the security audit as a whole was rushed so we're likely to go through this AGAIN.
2) Being done this way specifically to punish/block the FN and other automated migrate-off-FA tools while claiming security.
Since right now? It's not adding appreciable security.
Freakin' GMail and FaceBook doesn't require a captcha on initial login and they're attacked FAR harder and more constantly than FA ever has been.
Longer PASSWORDS?! Hell yeah. *cracks knuckles*
Nowadays, there are "reputation" companies that will look out for mass emails that have the same content, and mark it as spam without FA's knowledge.
And most e-mail providers will notice this, and filter the e-mail to be either:
- Deleted on arrival
- Sent to the Spam folder.
Which, in turn, would have an impact on new users waiting for their reset codes or registration codes.
That and most furries dont like email in general in my experience so idk what itll do
They only have to be patient and wait their turn.
Sorry about the inconvenience!
password111111111111111111111111111111-hits limit
Basically. xD
I just love long passwords in general so this just thrills me.
https://xkcd.com/936/
actually impossible to crack
If it were just some guy in russia looking for credit card numbers that would be another thing.
But I still have that little bug, the 1 comment which actually doesn't exist. I read in the previous update it would disappear, I hope it will soon by the way.
Generate a card from a code you can remember. Then any time go back to the site and regenerate the card if needed.
*mind blown gif that i'm too lazy to look up and link*
$hash = sha1(crypt($password, '$2a$07$'.sha1(md5('teststring')).'$'));
which is crypt using blowfish
HEAVEN OR HELL LET'S ROCK OW OWWWWWWWWWWWWWWWWWWWWWWW
WHAT'S NEXT BABY
Good. >=I
Oh wait... =\
Anyway, its good to see some improvements going on now. Hopefully this wont happen again and you guys find out who did this and pursue legal action against them, especially since user's personal data was involved.
I... I wouldn't count on that. If you read this comment http://www.furaffinity.net/journal/...../#cid:49922548
You'll see that if they try that, due to their rather not apt way of acting with this and previous scandals, they are very well putting themselves on the line of fire to get themselves liable to some penalties. Even if those laws don't apply as is, it wasn't them getting hacked that would get em, but their irresponsible way to react to it since the moment they got the news of the first ImageMagick exploit. What any website has to do on such a situation is lock down, modify the code, alert users, and come back once they fixed their code, even if no data was lost, just to be safe. They kept on and on pushing back on doing any of this, acting as if it was okay even after it was shown that people had their passwords stolen from here, and only telling people 12 hours after the first row of password being stolen reports surfaced.
Not to mention no one knows who made these attacks (yeah I feel it was multiple ones, most likely some after the site was brought back up the first time but can't confirm, just speculate), so you can't call to trial anyone if you don't know who or what organization did that.
http://puu.sh/p1Dq9/3daa668f8f.png
And it's going to be problematic fixing this now that some long passwords have already been set. A 72 character password having been truncated to 50 characters by the input field will generate a different hash when that field starts allowing the full 72 characters.
Thanks for pointing this out.
Ehm I set it to 100... I hope that doesn't break shit in the long run?^^
I'm quite excited that Weasyl is planning to release the source code for their site.
You know, would have made some sense to get this initial reset sent just to email on file without having to guess it.
Sorry about the inconvenience!
Until giant fuck ups like this happen.I don't understand why you would wait to update your website's coding and security until after a giant attack like this one occurs instead of before as a preventive measure.
Like goddamn...
So it's like early access.
To Bad the code is not opensource, some pull requests would be nice.
They don't want to open-source it because of all the vulnerabilities it has, even though doing so would allow those vulnerabilities to be spotted and fixed by people who actually care about making the code secure.
Truthfully, if it's as bad as I've heard, the better thing that would happen is what happened when Netscape open-sourced the barely-usable Navigator/Communicator browser in March 1998: Everyone working on it threw the 1998 code away and started from scratch, resulting in the Mozilla Browser (now Seamonkey) and Firefox.
Firefox is NETSCAPE?! Haha. I remember liking Netscape more than IE back when I was a kid, and was always pissed that the school computers used IE. That's really cool info!
Edit: "threw away the code and started from scratch, resulting in Seamonkey and Firefox." I can read, I'm just a bit tired. Haha.
*sarcasm*
So... no, they had plenty of time. If they had done what they should have when they got the news of the exploit, non of this would have happened.
Wait that's actually a pretty spot on comparison now that I think about it.
You should know by now that the age of site's coding is not the issue, it's the fact that the original code wasn't that good to begin with and it took an attack like this for the administration to actually update it and its security features.
Tumblr, recently, which resulted in everyone having to change their passwords.
Valve, when steam released a huge amount of credit card information and gave access to random accounts.
Amazon, Sony, Target - all in the news, big security breaches, stolen personal information.
Kickstarter, dropbox recently as well, to name a few.
If those websites can't reliably prevent this kind of attack from happening, like... I duno, man, FA is supposed to be able to?
Well I'll guarantee you one thing: IB, Weasyl, FN - none of those sites are immune to security breaches like this one either.
That's the internet.
It's not the fact that this site had an attack of that proportion, it's the fact that it took them an attack like this to finally update the security features to it and not beforehand with the other attacks prior to this one (ie Yiffyleaks and a good number of DDoS attacks it had).
Get it through your head.
Sorry my head is so extremely thick, but I'm on an obscene amount of dayquil for the Flu, I'm extremely stressed at work right now, and I'm apparently I'm an idiot (you're not the only one who has pointed that out to me in the last few hours.)
Now I think I've been fairly polite when disagreeing with people and I've never resorted to insults, but I've received quite a few -- I guess that's what you should expect when you have the wrong opinion.
DevilishDoctor I'm sure you got a little upset and didn't mean to make it personal like that, so I don't hold it against you, but I think you will understand if, for the sake of my health and my sanity, I want to just withdraw from this topic completely.
I apologize for disagreeing with you, sincerely. My opinion has not changed, but I will do you the favor of not speaking it anymore. I've decided to go offline for a week or two.
Thanks for doing your job the best you can.
Also, there is a glitch in the code and even though it supports 72 characters it's limiting it to 50 right now.
Years ago, I was rewriting an ancient PHP login and did some research into standard DES hashing, only to find that by default it truncates all passwords to a max of 8 characters before hashing. Now that's ancient.
I found that while stage 1 was stripping leading and trailing whitespaces and lowercasing both the provided email and the one stored in the database before comparing them, stage 3 only lowercased the database email without stripping whitespaces out of it.
Hence the comparison between them failed, if for some reason the database email field value was padded by whitespaces on either sides.
Which was the case with your accounts.
The code has been stripping whitespaces from emails before storing them in the DB for a while. It's one of those cases of anomalies/inconsistencies in the old data.
That said, the password reset page issue you brought up has been fixed. Many thanks, as always :)
Is this a common problem? Looking forward to getting back into my account.
Thanks!
at least ive seen that reply on some other comments like this one
On twitter they said we were getting an additional 10 days.
the original 2 days of downtime
the 6 day rollback
this 2 days of read only.
Providing barely enough for the people who support fa the most is just another slap in the face at this point.
I don't have any control over it regardless. lol
As it stands now, there's no incentive to keep advertising with furaffinity once the extension is over. Hell, I've been supporting for months but now with the amount of people seriously leaving and even locked out, it's now a question if they're even going to be worth it anymore.
Plus I freaking swear that fa is going to be down again in the next week or so, either from another attack or the site recode, and then we'll be in the negative again, but I guess we have to see.
If FA goes down again I suspect we'll be issued additional compensation. In my experience of advertising any down time is compensated for ad holders. At least in the last year.
Regardless though, I think we're both just on different spectrum of what we expect when a company messes up/has an issue that effects us. I can definitely see where you're coming from. It would be nice to be given greater value, but I never would expect it. LOL. <3
Honestly, I'm just bitter overall and how this entire situation was handled, and wish they'd show a little more respect.
I'm more worried for the folk that reuse the same password on other sites.
A proper password hasher uses a random, unique salt for each password, so even if you reset your account with an identical password, the hash stored in the database will be different each time. If FA wasn't using unique salts, then brute-force cracking passwords would be a hell of a lot easier.
Wait, does it really assign a specific number to pw reset requests, or just counts how many you've done on an account?
https://chrome.google.com/webstore/.....falko?hl=en-US
Gee, why write a hotkey script when you can have a dedicated extension?
Seriously, get your shit together FA, we have another mass migration from site now.
Plus what also doesn't help, as many users have stated, is that tye sites coding was outdated.
You can't expect the technical team to constantly monitor the activity going on inside the server, because there are thousands of logs to read through.
A majority of companies only react when something has happened.
And don't say I'll get a response from that email... because something tells me it's gonna take 2 years for the half a person working on them to get to them all.
You never changed your email here?
It's completely automatic BTW
I tried using all the emails i have ever made for myself, and none are attached to my username anymore. I emailed that accounts email, and still haven't heard back. I'm pissed, how could NONE of my emails be connected to my account? I only have 3 emails ever!
I know they're busy, so it's not like I'm not going to wait. But it would be cool if it didn't take upwards of a month to get back to me. They have a lot going on though, so I will be patient for as long as possible.
"Because, some of us have had security issues with this site in the past and chose to use a temporary email so our shit doesn't get stolen again!"
Should an email just be sent or is there someone than can be noted about it?
♪ And she said, “We are all just prisoners here of our own device” ♫
♪ And in the master’s chambers, they gathered for the feast ♫
♪ They stab it with their steely knives, but they just can’t kill the beast ♫
Check your addons, remove any you don't recognize, and run a full scale virus scan.
Try reading the Privacy Policy and TOS over there sometime.
dA stopped giving a fuck about everything with a single exception: money.
dA stopped giving a fuck about everything with a single exception: money.
I managed to get it after my second password reset code attempt.
THAT AIN'T SECURE. I THOUGHT YOU SAID YOU MADE IT MORE SECURE!
UPDATE: Should be HTTPS now.
This has been fixed now.
So, passwords being reset after a couple hours. Probably should look into that.
Be strong FA!and its not like you need one for each site, just 2 emails or perhaps 3.
But yeah like.. congratulations on you and your organized email addresses. We are allowed to complain that the account retrieval process is stressful and annoying and scary (yes scary, some of us make 100% of our income through insecure accounts on this stupid website), we're allowed to bitch that it's taking forever to get our accounts back and maybe say "Hey could you guys do something different to help those of us without access to our emails?" without some chode popping up like "Hurr I still have my account, maybe you should have been better prepared.." Like, yes! No fucking shit. We should have updated our emails. We didn't, here we are. Now it'd be nice to find a system to prove the identity of the HUGE amount of people who don't have access to their old email, something faster than waiting on an email from [email protected], one that'll probably take about the same response time as a trouble ticket. (hint:years)
Also nobody is scapegoating the difficulty of the process when you don't have email access, people are mostly just pissed that this website is still about as secure as a damn blanket fort, and upset that this is happening. FA didn't cause us to not keep our emails secure, but this hack is due to their never ending lack of security and it's rightfully pissing people off.
Some people here want to get on their account and take enough commissions to make x amount of money by x day this week so they can pay their rent. So, yeah, tl;dr people have a right to be pissy at the faulty way FA has come up with fixing the problem.
It's like this every time, half of us are just pissed that FA screwed up, and then there's the other half of people who either weren't affected by the problem or just enjoy white knighting for the shittiest furry site ever.
Like you can be mad all you want but I just am not angry about it, since sites usually reset passwords or make you do so after attacks like this i expected it. Though they really should have giving a weeks or at least 2-3 days warning imo.
Like i never told anyone not to complain or be angry or anything? I didn't defend FA or "whiteknight" it either? I feel like you are mis-directing your anger at fA and this process onto me because of some offhanded comment i made.
Just a dick move imo
alright, resort to junk/alternative mail that you can use for 'risk' sites/games blabla. Like most of others use.
Again, keep a physical copy/book of mail, passwords... for both site and the mail...
AAAAgain. Blaming Fa for not changing/uppdating or at freking least checking in on your email(s) in years (Duno if that applies to you, but to most comments around this journal that the common factor) is not their fault.
I would go into more details on how to do it right but i have a feeling it would fall on deaf ears.
It is their fault, since their "security" is a complete and utter clusterfuck, even after this "update".
I may be deaf, but at least I'm not brainwashed.
> not simply writing that email down somewhere so you have a reference when you need to access it
> not having everything compartmentalised so that one security breach doesn't cascade into your entire personal effects getting blown up
Christ, you're even stupider than I recall. And that's saying a lot.
Some people are intelligent enough to have a separate active email for important things like bank and another for sites like FA. Also, some people are educated enough to know that learning your email address form FA getting hacked has ZERO effect on your email, unless you were not intelligent enough to use different passwords everywhere.
It's called common sense.
You really shouldn't insult others, especially when you clearly are ignorant of the subject at hand.
Not all the people are to blame here. Of course some people are but not all.
Since Fur Affinity is owned by IMVU, and IMVU is located in the State of California, and I am also a resident of the State of California, this applies: I also have not received any email or other such notification (what you have at the top of the page isn't conspicuous enough) notifying me of this data breach pursuant to California Civ. Code s. 1798.82(a); specifically, email address and non-encrypted (as far as the law is concerned) password were obtained. Since you're just now using bcrypt, it is reasonable to assume that previously you were using a hashing algorithm that was not "generally accepted in the field of information security". Please address this to all users who are residents of the State of California (or, perhaps more easily, all users, full stop) immediately, or I will consult with a lawyer.
This was taken from my father who works a part of the government. It could be wrong, but I am working on contacting my brother, who is a lawyer and will know this answer.
Oh yeah, maybe I'll get business from the tumblweeds!
As someone who actually sinks money into this website, I have all the right to rage, how about you?
And yes I could have. Everyone is saying it. If there is a possibility of private information being linked, FA should have sent a mass email a long time ago. This is a situation where you have to know IT to understand what should have been done and still has yet to be done.
also free or not, i think people have a right to complain when their accounts may get broken into due to FA improperly storing passwords. when you're a service that stores passwords, care must be taken to follow standards.
think of it, LinkedIn is a free service, it's gotten broken into and 176 million user data was leaked (and sold), allowing malicious parties to hack, phish, etc. if you're a victim of this, would you just go say "oh whatever, the service is free anyway"?
in both cases, the damage isn't limited to this one site. if you have sensitive information sent through notes and that got leaked, would you be okay with it?
being a free service doesn't give you a pass to do whatever you want and skimp on security. at least, that's what i think, i hope you'd understand.
Also screenshotting and will do the same.
ByCrypt came out in 1999, they had plenty of time...
https://leginfo.legislature.ca.gov/.....201520160AB964
I'm just going to go ahead and file a complaint (http://oag.ca.gov/contact/consumer-.....ess-or-company) this weekend. They've had plenty of time to do so "in the most expedient time possible and without unreasonable delay".
:3
not to mention the atrocious lack of updates on twitter. I've loved FA for 4 goddamn years, and I've never been so enraged at the poor handling of this situation. Still waiting on those emails to come out about password compromise, which should have been out a bloody week ago.
Good lord...
Hopefully that helps others reading if I'm correct!
Still, that is some SHIT coding.
Alot of people have decided to leave FA thanks to issues like this and it hasn't hit other websites like this this bad. I really want to stick around here because I view FA as my 2nd home.
I hope there will be more improvements since it's not the attackers fault... also it's not a game :/
As for the salting, no idea either.
Sorry, couldn't resist. XD
You're my Tani to english translator :D
no excuse, just a red box that says I can't request a password change until another 15 minutes have passed, and it was well beyond that timeframe
Sorry about the inconvenience!
I wish other furry art sites got as much traffic as FA did cause I don't really wanna stay with a site that gets hacked several times a year.
My main job is around websites, i offered myself several times too. But silence
Analyze source code> discover vulnerability> utilize> disaster
quoting_mungo (staff)
#link Posted: May 22nd, 2016 11:13 PM
It was not known that the USB drives contained the site source before the attack. It was known the USB drives allegedly contained source code, and tech was in the process of verifying whether that was the case and whether the code in question was current when the attack took place. Now, in hindsight, it's easy to say the possibility should have been enough to pull the site, sure. But it wasn't nearly so clear at the time
But if you have trouble with that, consider using a password manager so you only need to remember one very-hard password and it will take care of all the others. I use this: https://lastpass.com/
But you gotta write it down somewhere xd
Also I feel sorry for those who used throwaway/old emails that they don't have access to any longer. :(
Oh wow I just noticed that we signed up within a few days of each other.
Sorry about the inconvenience!
IS BABIES!!
I hope all of you are doing well.
Or lack access to those emails as not changed the contact information in a long time
p.s.
:) please do not swear and be calm. and those who dropped this resource real
bad fag!You neglected security for many years (took you THIS long to implement simple HTTPS and SSL? Really?) even though you knew and still know that the site is a swiss cheese when it comes to security. This is made even worse when we account for the insane amount of traffic that goes through on a day by day basis, often containing personal information YOU should have protected.
What are the odds that those who still have the site's source code are having a field day with it right now? Hell, even if we all change our passwords, our personal information is still out there; this alone could have dire ramifications for some and it is all YOUR FAULT.
It blows my mind knowing that there are PLENTY of IT people in the fandom, yet this particular site is probably the most vulnerable of every furry art site out there.
I'm not going to congratulate you or say you've done well, because you should have been working to avert situations like this in the first place.
quoting_mungo (staff)
#link Posted: May 22nd, 2016 11:13 PM
It was not known that the USB drives contained the site source before the attack. It was known the USB drives allegedly contained source code, and tech was in the process of verifying whether that was the case and whether the code in question was current when the attack took place. Now, in hindsight, it's easy to say the possibility should have been enough to pull the site, sure. But it wasn't nearly so clear at the time
I've sent in an e-mail about being locked out of my main account.
Since I assume loads of people are having the same issue at the moment, is there any word on how long it might take to receive a reply, just to have a time frame? Thanks.
Therefor, every single account needed this.
http://www.furaffinity.net/user/phocksylawksy
just be patient if you email em though, i can see they got a lot of people in similar situations :3
Was easy to me but man, is very annoying.
As of now, I am using LastPass to manage my passwords.
Every site I use now has a unique password. And I don't even have to remember them.
The really big bother is having to remember where I used the old password on all sites I've been on, especially if the site handles card transactions.
As much as I like the idea of password managers, they are still vulnerable and unreliable in a great number of ways. It always pays to keep a backup of your account passwords on paper, as long as that can be kept locked away.
A text file full of passwords... in the cloud.
You can never be safe from password thieves.
And people always claim they are leaving but always come back.
All about that money, imo.
So idk its that time of the year again where people just try to go somewhere else but fail
Hopefully that's the issue!
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
Imagine FA was a city with thousands of people in it and suddenly a cyber attack took place cars, trains, and electrical appliances starts going haywire and then blackout, things just got silent, the following day power was backup but some still has lost contact with others (related to watchers) and some lost there recent web files (related to artworks), and all we can think of is "What just happen".
Sorry about the inconvenience!
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
As said in this very journal:
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
Also, you're only switching to bcrypt now? I'm surprised at that. I thought that was generally viewed as the absolute bare minimum for password hashing for at least a good few years now...
DES hashing, a really ancient standard, will truncate all passwords to 8 characters. Truncation to 72 characters is a bit more modern, but even production systems will often use fewer.
Anyway, that's bytes, not characters. So I guess they're limiting passwords to ascii too? or are we gonna see some funky truncation with unicode input? I guess it doesn't really matter. It'll either work or it won't =P
She requested 3 times already, but it didn't help.
If possible to send it to kia.egbert[at]gmail.com
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
Help, please?
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
"Partial [ongoing] audit of how the code makes use of incoming request parameters (GET, POST)."
That's really important to avoid SQL-Injection (no problem to day), XSS, Overflow, passing secret Parameters as GET-Params, ...
"Changed database auth credentials for the account the code uses to access the DB, and reduced its privileges."
No more Database Auth in PHP-Code ;)
"Changed password hashing backend to BCRYPT (with a high enough computational cost. maximum supported password length now is 72 characters)."
bcrypt is a great chose, with AES256 it's the best.
"Modified the Login page, making the page page honor Read Only mode, adding Captcha."
should be protect CSRF.
You are have a lot of new security features, SeemsGood.
the e-mail I used to create this account was an abandoned e-mail from 10 years ago. Now I cannot access my account...what fucking luck.
Anyways yeah i already sent em an e-mail. i've just been waiting for hours with no luck
That's uhh... that's just great... :T
----
Problem: After changing password, cannot log in (with old or new password).
To replicate: Request password reset and set up a new password. Log into the account. Change the password back to the old password. Result: neither old nor new password works any more.
Solution: Request yet another password reset, with a new unique password.
Security note: Providing FA correctly hashes passwords, changing back to the original password is completely secure - providing the original password is strong (128 bits of entropy). This has always been the case for my account.
Secondary problem: For users that have changed their e-mail address and not updated their profile yet, how are they going to reset their passwords?
>If you are having issues resetting your password using the above tool you can email us at >accounts[at]furaffinity.net for assistance. When emailing please include your Fur Affinity username. Staff reply time may vary.
Would a solution akin to Google's ReCAPTCHA work? https://www.google.com/recaptcha/ Or just some sort of espeak/festival-rendered TTS sound clip served alongside the static image? I do appreciate that FurAffinity's website continues to work without JavaScript, unlike some other sites.
Though I am not visually-impaired or directly impacted, I have a good friend who is legally blind (very low vision capability, not able to drive), and this would render the logged-in portion of the website unusable to them.
Aside, requiring a CAPTCHA all the time seems a bit silly when even Google allows you two sign-in attempts before throwing up a CAPTCHA. Please consider relaxing this requirement in the future.
And, yes, I very much appreciate most of FA working without JavaScript. I hate "app" design, and DA (in particular) has been driving me insane. I won't even touch Furry Network.
Happy the site is up again.
This was a necessary step yes, and I'm glad it was a step taken, but a little forewarning would have been nice.
just a Theory :-\
Facebook I don't care about.
I'd rather use my own brain as my cloud service.
Even if it is bad - and I know it
I should still have that option.
At first I tried the free, and when I saw how useful it is I didn't think a moment to pay that $12.
Has worked well the last, forever.
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
It's just unfortunate that this had to happen.
Thank you Fender, Dragoneer and Admins !
You all worked hard to bring it back, Congratulations! X3
I feel grateful! x3
I'm not an artist and I need your old account to view my favorite artists updates. Can I restore my access? Thank you in advance
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
Why don't people read the journal first?
I'm not able to recover a couple of my accounts because of old email address association, to addresses that are no longer functional. I've had the accounts long enough that, I never thought to reset my email address. Fur Affinity never sent me emails, and I had no reason to change my passwords because I simply never forgot them.
So basically I can now never recover my other accounts.
Wonderful.
Search for comments posted by Fender for assistance.
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
Why don't people read the journal first?
lol
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
Why don't people read the journal first?
I tried putting in all 3 to get my password reset, and apparently NONE of them are connected to my account anymore. That's not even possible.
I emailed that accounts[at]furaffinity.net and still haven't heard a reply.
If I have to make a new account for my art i am going to be pissed after all the hard work I have put into my current one.
Just great. Hope it gets resolved soon, I want to be able to log in to my main account........
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
Still waiting on a reply email so I can hopefully get my main account back.
Since when is stating facts disrespectful? As IB is the only place outside the dark web that allows "cub" (=underage=child characters) porn, all the cub porn artists and lovers are there. This is a cold fact, no reason denying it. Sure, you can argue that drawn child porn is not real child porn, but do you really want to?
Wrapping the truth in nice words won't change it. And you are right at least in that I do not have respect for child/cub porn or people who condone it, but that I think is within my human rights.
As per your request, I won't use the word "pedophile". I will say "cub porn lovers", hopefully that satisfies you. But it won't change the truth.
There are things beyond tolerable, and in my opinion underage-porn is such.
Terrorism fails this test. ISIS fails this test. Cartoon cub porn does not fail this test. (And no, this is not just "my opinion." There is no proof that cartoon cub porn presents a clear, present danger to any third parties.)
If you reject the "harm principle," then you're just saying "I'm tolerant of things I'm okay with tolerating." That's not a very novel idea; everyone can do that. You might be looking for
Again, it's one thing to dislike something. But when you say you're refusing to even share a site with people because of what they're into, that's just plain hateful. You speak of your right to an opinion, but it sounds like you would deny others their right to free expression, and impose censorship upon them. There are filters on IB anyways; the only reason you'd avoid the site because "of the 'pedophiles'" wouldn't be because you didn't want to see it (you could already assure that), it would be out of petty spite and contempt.
That's the first point. Secondly, I -do- tolerate your decision not to visit a site because you hate people for their fetishes, you can visit whatever sites you want. Just don't expect to be able to try to justify your bigotry in a public comments section without getting called out for it. When you begin calling for other people to not be tolerated, however, then it becomes not a personal choice which should be tolerated, but an attempted transgression against the rights of others, which shouldn't be.
_____________
All that said, you can believe what you want; people like you rarely change their minds. I'd just prefer, and I'm sure I'm not alone, that you not put an icon on your page that identifies you as a safe haven from hatred, bigotry, and judgement, and then spring this on people. It's deceitful and you shouldn't do that.
Just means the site has to present the captcha for the user to solve before it can run.
I was able to change my password on /controls/settings/ to both pre-breach and pre-reset passwords without any attempt to stop me or any notification that I had done so.
Of course, my current password, after those attempts, has been reset to a new random one, but that's beside the point.
It does matter because the (hopefully now-previous) hashing algorithm is now known, and rumor has it it's too weak anyway, which means it's easy for the bad guys to discover from the hashes what the old passwords were.
Anyone with any interest in your account wants the account itself, not just whatever may or may not be in it, because they can use your account's connections with other accounts (not just ones you use) in order to gain access to ever more valuable data. About the best recent example I can give is the compromise of Dragoneer's worth-nothing Gawker account a year or three ago, that the attackers were able to leverage into a break-in of his FA account, and since his account is one of the keys to the kingdom, a devastating compromise of the site and potentially all of our data. Although you may not have accounts that valuable, you probably have relationships with other accounts that can be used in a chain to break into something valuable somewhere.
The account itself counts as data to protect.
Please pass along my serious disappointment in the team who performed the security audit for overlooking weaknesses as obvious as this prior to service restoration.
I wanted to express my absolute distaste for the way things have been handled and especially the way they have been received by the community
I am glad to be using other sites to upload my content, it may not attract as much traffic but it's still way better than trusting you people.
Someone said it.
I'm actually leaving this site since apparently, these morons don't have the decency to let us know to change to accurate emails first, and so my boyfriend lost his account of 5 years. No reason for me to stay anymore. :')
Let's hope these guys have fun in the filth they've created, though!
Taking the site out of read-only mode to allow users to change their registered emails when we knew credentials to be compromised would have been subjecting our users to an unnecessary security risk.
Sorry about the inconvenience!
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
The visually impaired do use the website.
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
...
*busy changing passwords on everything else*
Hopefully I'll have
I sent an email to the staff, so hopefully I'll get some assistance of what to do.
just be patient if you email em though, i can see they got a lot of people in similar situations :3
And thankies panda <3
At the very least this Captcha isn't horrible that is to say, a human being is able to read them, which is not always the case in my experience. x.x
I personally suggest an image identification captcha.
EDIT: Thanks for global reset I guess LMAO though now locked out of another account
i get being positive but in all seriousness this is a time to be upset with staff for incompetence, NOT kiss their ass for finally doing the right thing only when they're forced to.
There was a warning to FA users to do our own password resets (which I did). If that wasn't sufficient warning, then either A) anyone who didn't reset their password didn't care or wasn't worried about losing any info that they have on FA, or B) those people are morons and probably deserve to lose their accounts anyway.
So now we have the staff thinking a global force is the best solution.
There is a lot to blame them for, I'm not defending FA at all, but it is not their fault that people use non-existing emails, and then are lazy to read the damn journal.
Maybe I'm wrong, but I'm pretty sure that with ample warning (and I'm sure our definitions of "ample warning" differ, but I'm sure that legally, a line can be drawn somewhere), FA could've absolved itself of any liability for sensitive data being breached (or at least, as much as they could absolve themselves considering that outdated coding and weak password encryption algorithms are a huge factor in all this data being breached in the first place).
Also, it is your responsibility to update your email with an existing one when your old one stops existing. I was really surprised and shocked that so many people didn't care enough to do this.
This is the message I get when I try to put the email that I used to create the account in. Soo annoyed is an understatement.
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
However,it would have been better to have given people a day's warning so you don't have to spend days manually re-setting accounts. Especially since some of these accounts could be a decade old.
To look up there E-Mail Address and realize "I have no memory at the Address"
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
I had to re-register because I don't know what email I used to sign up, every one I had failed. I was going back on my old profile to re-watch and favorite everything, but all my favorites are gone.
:(
....I'll just go back to not contributing to the FA community whatsoever and lurk again thanks.
is there a way to fix this or am i stuck with making a new account? its not a big deal i dont use this site to make a living or anything but idk no point and spending hours setting it up if i can just have my old account back
pls respond
There's going to be a wait time since everyone else is asking for help too, so patience is a virtue well needed.
Guess im just going to have to put up with it i suppose, great.
if not .then i'll reupload the artwork
You may all go back to furiously jacking off now.
Note me please admin of some kind.
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
Well, then all you can do is wait. They probably got thousands of emails, it will take some time for them to help everyone.
Yes, this was a total fuck up but even the BIG GUYS have had them.
The story of Googles trusted five and what happened to them is a good one about no matter how good your security is it can be compromised and released to the wild in an instance.
https://www.youtube.com/watch?v=y4GB_NDU43Q
Give that watch. It's worth it.
>The (Fictional) Day
>(Fictional)
Good job projecting something completely fictional as a fact.
Oh, and by the way, I know it happens to the big guys. However, in a lot of cases, the big guys at least TRY to remain up-to-date when it comes to security. FA's compromise comes from YEARS worth of negligence. The two cases cannot be compared at all.
the story
STORY
Point being, I feel an email that detailed their plan, the whole site wide password reset and information on why they are doing it would have been a significantly better idea. At least that way some of the users would have known it was coming. If that were the case, I'd blame myself for not changing my email, however I recall trying to change my old email to my current one a while back, but I couldn't even do that. I can't remember if it was because the option wasn't there when I tried to do that or if it was some stupid thing were they had to email your old account first. I don't remember, maybe my memory is going bad, but I recall there being some obstacles when I tried to change my email.
Regardless, I still feel the sitewide password reset was rash, especially with how little people actually used their emails in conjunction with FA, and that is a sign that communication is bad between the users and the site if emails are almost never used as a news feed. Personally, I feel like there were better alternatives that could have been explored.
I'm not defending FA, they fucked this up big time but bash them for what they did wrong, not for the very few things they happened to have done right.
You just have to have the user solve the captcha when they're logging in.
didn't feel like doing this sooner? Every decent company in the planet does that every year except you. "We'll fix that later"=when it's too late.
* Changed database auth credentials for the account the code uses to access the DB, and reduced its privileges.
If you CAN reduce it's privileges, that means you didn't do that account's security properly in the first place. The first thing you do in a proper web app is check the db user privileges and reduce them as much as you can. "We'll fix that later!"
* Changed password hashing backend to BCRYPT (with a high enough computational cost. maximum supported password length now is 72 characters).
"nah saltless one-pass SHA-1 is enough we'll fix that later lol"
* Removed all ImageMagick use from the app server, and deleted the packages.
With all due respect, can't you just update the package to fix the exploit? Or fix it yourself from imagemagick code and compile it?
* Reset all user passwords
* Deleted all active user sessions
Exactly what you should do, kudos for this!
* Modified the Login page, adding Captcha.
You should remove it after people stop bombing it with botted login attempts, right now it's just annoying if you want to automatically do something with a script or something.
As a person who actually understands a thing or two about web development you wouldn't have had to do almost any of those fixes if you actually did any security auditing/maintenance from time to time, but you don't. Probably because your code is 12 years old and mostly made out of spaghetti php, hack on top of a hack. While this problem was almost unavoidable (I know that you cant really protect against software exploits with 100% certainty) the fixes you did here are rather odd considering the site's age. As in those issues should have been fixed ages ago. By the way, how did you perform the security audit?
Tbh you should have re-coded this whole site from scratch ages ago instead of just fixing and fixing and fixing it, this time with a proper framework and more scalability. I think you actually tried that once ( http://en.wikifur.com/wiki/Ferrox_(software) ) but I don't really know how you managed to fail it. I think you should try again.
quoting_mungo (staff)
#link Posted: May 22nd, 2016 11:13 PM
It was not known that the USB drives contained the site source before the attack. It was known the USB drives allegedly contained source code, and tech was in the process of verifying whether that was the case and whether the code in question was current when the attack took place. Now, in hindsight, it's easy to say the possibility should have been enough to pull the site, sure. But it wasn't nearly so clear at the time
Are you just giving out passcodes to anyone who claims this? I sincerely hope you at least expect people to have some sort of proof that their account is actually there's. Either by asking what the original email address was even if they dont have access to it, or any other personal information that could link back to the account to prove ownership.
What is the process on this?
Also I've heard that hotmail accounts don't seem to allow emails from Furaffinity even if you whitelist them? Is this true?
http://programmers.stackexchange.co.....-beat-captchas
All it does is annoy the users.
Why? are they afraid people are moving like crazy to Furry Network so they make it hard to import? (that is a tinfoil theory, i'm actually joking i don't believe they would go as low as that)
So, whoever made the captcha appear by default either doesn't know what they are doing or had secondary intentions. Neither option sounds very good.
While people can argue about things like the code used, how the attack heppened in the first place and what not, I think it's fair to say it's been well dealt with in every capacity from what I can see and read and I will say great work to those giving their time and effort to not only investigate, but do whatever work needs to be done.
I'm familiar with events like this, not to this extreme, but similar all the same in the past few years on other sites and while i've seen damage be repaired, sites fixed in time, i've rarely seen such a response and push to deal with it as quick as possible too, again while some may say otherwise whether due to history (which I never factor in, history is history, moving forward is where it is) or other reasons whatever they may be, I say well dealt with.
and for those who say about security and coding, even the best secured sites get hacked eventually, now sadly a fact of life, whether small communal sites, banking, shopping e.t.c
but the main thing is how you deal with what's happened and either lower or stop more damage.
Just my thoughts and summations on this whole thing.
Oh man I can't wait for this fiasco to be behind us. Gotta hand it to the staff though, they're handling things very professionally, what more can you ask for?
and yes, anyone who wants to shoot flak at me for saying it is welcome :)
This is a good time to clean out old accounts!
Hours, days, weeks, months....... yearS???????
I know alot of people are having this problem and peoples jobs are on the line since other websites have barely any traffic
so uh it'd be nice to know atleast a- time frame when to expect a reply to the accounts email?
._.;;
This aint the last of giant fuck ups. Just watch.
Either or, the backlash is showing, considering a lot of people have been recommending Furry Network and Weasyl to me and a lot of other users, but we all know how this is going to end up: People leave a week and come back to FA. It's a little unbeleiveable how horribly the ball was dropped here, even more so after we were sold to IMVU to solve all these potential issues that would pop its head into place.
I mean, when you have people like Troy Hunt commenting on the poor credentials of this website, what does that have to say?
https://twitter.com/troyhunt/status.....rc=twsrc^tfw
It's actually kind of scary, because awareness of the poor security of this website is now getting more attention than ever before. What is it that you, the FA staff, are doing to actually address these needs?
In the case of users operating under throwaway accounts, what good would it to to send out an email? It'd do fine for the 50% or so of furs who use their main email, but the smart ones amongst us have learned to compartmentalise after FA's constant fuck-ups.
Even so - you're expecting furs to have some sort of modicum of common sense. I'll get back to you once I'm done laughing.
Quoted from someone in comments waay above: http://www.furaffinity.net/journal/.....4#cid:49922548
According to CA law they have to, being that not only IMVU the parent company is headquartered in CA but that CA residents are on the site (myself included) we have a law in CA that states a online business MUST notify their users if personal data is compromised, being that their encryption was broken it rendered it null, may as well have not been encrypted at all.
As thus it is the responsibility of FA to address everyone as per 1798.29 and 1798.82 of the Civil Code, relating to personal information, that was amend by SB 34, SB 570 and AB 964
AB 964 states and I quote "AB 964, Chau. Civil law: privacy.
Existing law requires a person or business conducting business in California, or any state or local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
This bill would define “encrypted” for purpose of these provisions to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information technology.
This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
This bill also would incorporate additional changes to Section 1798.82 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last."
https://leginfo.legislature.ca.gov/.....201520160AB964
And then let me continue laughing, because I figure FA's going to fuck this up harder and harder.
and the end is Neer
Email not supplied. Please type in the email registered with the account.
When I'm trying to reset my password for my second account, this keeps appearing even known I have everything filled out and it's really frustrating me. I have the code, I have the correct email, I have the correct username, the system just isn't accepting anything I type in and it's really driving me up the wall
If you are entering the data you received in the email, you should be filling out the form in the "Enter new password" step and pressing the "Reset Password" button instead.
I know the error messages you listed are only shown when pressing the "send code" button, but you are saying you're pressing the other. The only thing I can think of is that you somehow are seeing the wrong password reset page, perhaps a cached copy?
Try clearing your browser's cache or waiting a little (in case the cache is on your router's side)
Could it possibly be an error in the site's database? One of the factors might be because I'm using a mobile instead of a computer
I'm curious as to how you are addressing people who need to email you if they no longer have access to the emails linked to their accounts?
Are you just giving out passcodes to anyone who claims this? I sincerely hope you at least expect people to have some sort of proof that their account is actually there's. Either by asking what the original email address was even if they dont have access to it, or any other personal information that could link back to the account to prove ownership.
What is the process on this?
They are required to provide multiple proofs of the account ownership, preferably even contacting us from known good alternate accounts on social media sites or elsewhere.
I'm not keen to all details as it's not me who is performing this task.
This is my second/species account so maybe that will help since this one is also linked on my page?
I'm not sure, I hope that's enough information for them to email me back with the password reset since I've been waiting about 6 hours now on a reply. I dont mind the wait I'd just like my account back soon so I can access notes for commissions I currently owe.
Anyways, thanks for the feedback I appreciate it! I was told by someone that they were asked no security questions so it made me worried for my own account.
So I have no way accessing my main. I opened an email to support about perhaps offering PSDs of artwork I have posted in my account. And the email I emailed them with had past history of buying advertisement space for my main too.
So fingers crossed.
The delays are just because there is a very large amount of these requests to process. I can not comment on the order in which they are being processed though, as it's not a task I am involved in.
I've sent an email to accounts[at]furaffinity.net about it, but haven't gotten an answer yet...
I want to know why it keeps saying that I cannot enter my main account [
I suppose it'll do. I appreciate the progress, regardless. As long as the site is back up and running.
Best I can say is be patient ^^
was there a DDOS event or something?
During BLFC, there was someone who was handing out the source code code for FA on USB drives that was able to be leaked via a loophole in an application called ImageMagick. Because of this leak there was a massive hack by someone that caused the entire site to be shut down for several days and to have to roll back to the last back up, leading to the loss of 6 days worth of art, comments, journals, watches, accounts, etc. Apparently the attack on the site was bad to the point that the staff have been working as hard as they can to apply new security measures to prevent this from happening again.
This has been a huge endevor on the part of the FA team, considering how fast the entire thing went down.
either that or i forgot, which is possible...
it keeps saying the email isnt the right one when I used the same email in 2009.
I made the temp. account so I can write a comment here.please help
Because a lot of people are literally leaving the site in droves in my eyes due to incompetent security measures.
Because that's just unacceptable at all sorts of levels to have a site compromised that badly.
Just a lil' concern, I hope you can enlighten me,
How is the site recode going? We cannot be 100% sure and safe if the current source code is still out there, in hand of who the hell knows...
Please tell me you are about to complete it and source change will happen somewhere this days... I'm serious, having a source code means they have a way to find exploits, even if you mannaged to fix security in many areas, as I've read in this journal. Unless you got all vulnerabilities sorted, or you are working on the ones that could be left (or finding if there are any vulneraibilities you may have overlooked)
Anyway, thnaks for the effort on fixing things up, it's the very first time I see you guys solving issues this quicky. Congrats ;)
Some holes/exploits in our existing source were already fixed during the site downtime, including the vulnerability used to execute the attack, and further fixes have been done and will continue to be done since then.
As long as you are watching over any exploit, it means things are somewhat secure.
How much you estimate, it will take to finish the new code?
Can mod reply to a hotmail.fr email?
Todays a great day lemme tell ya with me making a new account n'all
FUCKING GORGEOUS
Hope my email gets through but seeing the amount of password resets I say a good 12-20 days before I can get into my account back :/
Why the hell was my original account email address taken off during this whole madness? It's the email I usually use for social/art sites and I know better that it's not under another email. I'm pretty sure I'll have someone tell me I was using another email but I usually only use 5 email addresses that I commonly log into.
In the meantime I've sent an email, this is ridiculous how this could be an issue really.
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
I know a lot of people are having this problem, but come on. What is a timeframe for replies to emails? Are we going to be waiting days or weeks to be able to access our accounts again?
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
My luck it wasnt the Yahoo one because that one is Deleted since Years.
What a pain. Ugh. `<|{
THIS IS SUCH A MESS.`<:{V
...Oh wait. 8D
I know it really sucks, but I'm sure they'll get it sorted out!
*In the voice of Michael Rose* NOICE.
That is all for now.
I sent an email about this so I hope to hear something about that soon, but jesus christ
What we have, people, is a security breach. Now, let me be clear, FA has attempted to take this into consideration, yes. They've edited some things that sound like music to uninformed ears, but what you have to keep in mind is that THE SOURCE CODE IS STILL OUT THERE.
Hackers will be hackers. The code is still out there, and chances are, it is STILL botched to hell. A complete re-code is the only thing that is even going to somewhat fix this entire situation. We can reset our passwords, install a stupid captcha, whatever. But that code is still in the hands of god knows how many people. And in the midst of this chaotic blend of fear, confusion, and blissfully unaware contentment, another attack is not " IF "...it is "WHEN" .
I strongly suggest any users here who are producers of art, literature, or otherwise who heavily rely upon FA for advertisement and commissions to change their plans and fast. Start trying to get a name started for yourself on other websites, start urging your commissioners to send emails instead of notes for orders, etc etc. Do this to protect your own asses, people. Because if you've been around FA as long as I have, whether on multiple aliases or just one account...you should know that the staff has a horrible reputation of just spitting on their hands and wrapping duct tape around every single problem temporarily.
I know running a site is hard. I know dealing with this many people in a crisis is hard. But god damnit, Neer, and all you other staff. At this point with a site this big with a population this large relying so heavily on it, why have you NOT taken the precautions needed way down the line already?! WHY has it taken an utter crisis and security scare for you to start trying to fix shit? And WHY have you been saying " A recode is roughly 80% done" for ( if I recall correctly ) like a year?!
By the way, those of you pissed about this whole thing, you have a right to be, but please don't post a bunch of " FUCK YOU FA I'M LEAVING BYE" journals. This shit clogs notifications and is going to make it a lot harder on your fellow artists to catch up on their income and advertisements from this downtime. If you wanna leave, go. Make a simple journal of where to find you and go, that's okay. But don't post ranty ass shit that is going to make people want to just nuke that journal button.
-sigh-. Until FA starts showing some true improvements, I can't trust the staff here any further than I could throw them. Please, everyone who is passionate about your art, no matter what medium, take my warning. Go post on Weasyl, Furrynetwork, Inkbunny, Tumblr. Give your watchers the locations... You don't have to leave FA. I'm not....yet. But make sure you have a back up plan because this is not looking good and you other people here shouldn't be so content...you should legitimately be frightened for your security, even if passwords are changed.
Like to anybody who got exploited by this, their emails were hacked into as well to try and gain access to other accounts. I've had friends who have a special google email dedicated to FA and they received a "someone tried getting into you account from here" messages from google.
There are some people here who may have used this site and made similar passwords and emails to use widespread, but I find that the insults flinging around that people who do that are lazy or stupid are a bit unfair.
Remembering passwords can be difficult and frustrating, and having multiple email accounts to keep track of can be the same. Also there are plenty of people here who may have signed up for this site at an early age where we were not as well informed. And even then, not everyone is an IT major or knows that much about the risks of the internet. Some people choose not to learn, some people, it is simply too hard to understand, and that's okay! It's sad that everyone's security has been slammed so hard. I've never seen this kind of thing for sites as big as this handled in such a poor way.
I will say, that the massive pass reset, I think, was necessary, so kudos to staff for that. Is it inconveniant? Absolutely. Could it have been done better? I think so, but only so much better. It's too hard and I would guess damn near impossible to just pick and sift through who had already reset a pass, and honestly it would have shot FA in the mouth more if they let us 'handle the password resets' ourselves because people wouldn't reset, they'd get hacked, and blame FA for it.
FA has needed improvements for a very, very long time. I do hold the fault to them partially, as well as hackers. But imo, staff of a site that is clearly known to be this big and to be targeted so often... there were measures that could have been taken a long time ago.
I'm not leaving this site because I cannot afford to. I'm handling my commissions elsewhere from now on, but I cannot leave because the population remains too large here.
However... And this is another shout out to artists. Right now, FurryNetwork and weasyl are fucking booming. TAKE THIS TIME AND TAKE ADVANTAGE OF IT. People are angry and turning to other websites. Whether FA comes back or not, take this opportunity and snatch it. I am updating my weasyl and FN with artwork every day and getting a very nice number of watches because those websites are spiking in traffic from this event.
Even if you think FN and weasyl won't win..even if you think Furaffinity will pull through. Take this time of chaos and turn it into a time of progress! The traffic is amazing on the other sites right now. use this time to form your backup plan and make sure you have a possible line of customers on those other sites in case doomsday ever does happen to Furaffinity!!!
Seriously, all I can see it doing is what the acronym says, "Completely Automated Public Turing-test (telling) Computers, Humans Apart," and making it harder for the humans.
Seriously guys, this is fucking terrible
At least now I can get around to favoriting all that art I bookmarked while the site was read-only.
ImageMagick may have some problems but if you use a white list to prevent exe files from being uploaded this sort of thing would probably not happen.
BCRYPT is a good way to go for security but if you are not protecting the salt that is used your just as vulnerable as before. BCRYPT prevents users from recovering passwords.
Reseting user passwords is a good thing but it would have been better if an email had been sent to the accounts to let the users know this happened.
Captcha is only good for preventing bots but it makes it more difficult for users to login if they can't see the text. Some letters look exactly the same as others.
If you really want the login process to be truly secure use a different name then the user account so that it is only specific to one particular user. This way hackers can't get in if they know your username/email address.
Password Recovery should be done with a two step login process by a combination of a username/private id fields to fill in. This would make the recovery easier and plus prevent hackers from getting in using someones email.
Timeouts on reset codes is a good idea.
Preventing restoration of the previous password is also a good idea.
DA on the other hand is all about the Drama and it will drive you insane. Furaffinity drama is almost nil.
I do run my own website but I don't know everything. Furaffinity does a lot for its users, and as such is a site I enjoy going back to again and again.
DA is pure shit, staff are horrible and are ruining the site, pedophiles are everywhere, nonstop drama, hackers everywhere...
When I used to be on DA before I was wrongfully accused of sexual roleplay and banned straight off the bat I was involved in constant drama 24/7 with people I've never even seen or heard of. On here I finally catch a break from the constant drama
FA is much better than DA in every single way in my opinion
good job, FA. seriously, good job.
http://www.furaffinity.net/user/watcher12/
I tried earlier to reset my password...problem is, I set up my FA account a little over 7 years ago on an email address I had at a local college I once took some classes in, which is not in use and/or deactivated since then. I know, in hindsight I should have updated my account with the current email I use a long time ago, but...
I am starting to get really worried as a result to be honest. ;^^ I'm guessing I should email accounts[at]furaffinity.net about the issue and include my FA username, but I'm not sure what exactly I should say in addressing my problem...I may be overthinking on that bit, but I just want to make sure I'm doing it proper.
Crossing my fingers on this...I really hope I'm not perma-locked from my account at this rate. ;^^
I've seen 1-2 people comment on the journal that when they got their replies, the answer was that they were unable to be helped (though I may be HOPEFULLY wrong on that)...and that worries me. ;^^
Well, shoot, now I feel like I may need to send another email detailing said contact info from other sites on my main/real FA account...? I never thought to include this info. until just now learning about it... ;^^
Thank you for pointing out through the linked image what else I could do to prove my identity, this does help. :)
https://twitter.com/furaffinity/sta.....57677411667968
This month has being rough for all so i really appreciate your help.
on a side note, the captcha thing is spazzy as hell. took five attempts, kept claiming it was incorrect even when it was.
My issue here is, the email address I registered on the site when I joined FA a little more than 7 years ago is that I've either forgotten the password to access the email...or even that if I did remember and tried to log in there, that email has been deactivated since a few years back...possibly rendering me perma-locked from my FA account. ;^^
The account I'm using right now is just a substitute one, and my real/main account is
and always has been
Just another user here
I sent the email to the address listed some time ago.
Haven't seen any reply.
So I figured I'd ask.
my account is
http://www.furaffinity.net/user/lord-daniel/
As for those arguing that the password reset thing is dumb because it uses emails I'd agree with FA on this, though it pains me to do so. I don't think they did this situation well, but it's certainly not unreasonable to expect a user to have access to their contact email supplied to the site. It's not their fault if you forgot your email's password and don't use the email anymore when you could have, in theory, updated it here.
this is sad
http://www.furaffinity.net/user/articwolf29/
http://www.furaffinity.net/user/articwolf29/
http://www.furaffinity.net/user/articwolf29/
http://www.furaffinity.net/user/articwolf29/
Note that it may take a day or two, considering the number of emails they have already received.
but dOES ANYONE ELSE ON MOBILE HAVE ANNOYING POP UP ADS?
they've been here for a while but they're even worse after this update, like they pop up way too often
this suuuucks :\
haha mobile is more convenient for me so this is what I have to deal with cuz of it
There is no indication nor feedback of what said limits are on their respective forms. So when you take something from say GRC's PP, paste in it, the form doesn't tell you you've gone over the limit, it just lops the trailing data off without telling you and says everything is gravy. It took several attempts to realize this was the issue.
It only worked for one and it wasn't even my main account.
Guess I'll be waiting for who knows how long before I can recover it...
Once I do I'm going to make all new emails.... So this doesn't happen again....
What happened is that someone found a vulnerability in FA's code, and was able to use it to get information from the database that contains user email addresses and a form of the password.
However, if you were using the same password, it might be a good idea to change them both.
maby they priortizing over some people.
but half hour ago on here i got a reply from staff saying this:
"No, requests are handled in the order they came in. However, there are a lot of emails to go through. " -quoting_mungo
http://www.furaffinity.net/journal/...../#cid:49929038
I cant get it back ...
like I tried using my old email for it after using my current email. and it worked.
HOW EVER! the old email address is locked, i tried to unlock it but it wont..
before this happend, I did have zyaixor moved to my current email.. but ever since this happened I guess it got reverted back to the old email address...
still no email tho >W<
past week I got the email and been working with admin and I got the acocunt back finally!
yay!
still no email back . - .
I hope I atleast get a response when I wake up tomorrow cuz holy butts this sucksssssss
What do?
LOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOL!!!!!!!!!!!!!!!
I no longer have access to that email because of Google and now I have no way of accessing the favs and subs I had on my old account that has been active for over 3 years. Thats 3 years worth of favorites gone all because you made the choice FOR ME to restart MY password.
A password that was only used on this account only and was not endangering me in anyway but you just had to make the choice FOR ME to restart the password. Now im fucked out of everything ive been collecting on that account and I can't even find a way to get back onto it to at least restart a new account. Even then it would take fucking HOURS to re favorite everything
The modding Nexus had this same issue. You know what they did? ASKED ME to change the password and not force it onto the users.
So good job the doxxxers got what they wanted in a way. At least from me because now im fucked out of 3 years worth of photos and artists I like. Top fucking quality administration you have here.
And no, im not lying just to get into someones account. That account has literally noting on it other then favs and I think like 2 PMs other then that noting worth of value to anyone else but myself..
This is a real cluster fuck you have on your hands. This could have all been avoided with a simple message at the top saying (Change your password) and been done with it now both the users and the admins have to deal with this headache.
Hopefully there's a way to recover my old account.
; ;
never
So if you can please help out, I would greatly appreciate it. Thank you for your time.
And I mean, the kind of that were inactive years ago.
Because even small stuff piles up over time.
You can thank Dragoneer for that.
How can I get into my main account, MY BUSINESS ACCOUNT, if your system is fucking up? How am I going to get to the notes that I have, how am I going to talk to my commissioners? How am I going to update my portfolio?! I can not make another account that is my official username that I use for my business! I NEED that account!!
~
I was able to use my old password- which if I am able to, then so too is anyone else. (changed it btw after checking it)
The only real thing this did was to make it harder for people to log in and a lot of people don't even know what email account they used to join.
Captcha to log in is a tacky freakin band-aid don't you think?
Id rather deal with a site that had it's shazbots together (deviantart) since before FA decided to hit its head on the tumble out of its crib.
I sure hope everyone has the brain for this massive oversight and just leaves for the first time ever... I doubt it,.. But at least I TOLD YOU SOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO
had a different password linked to this mess from the very word "GO" and me... I'm fine. Not even a coder, but I sure can read when coders are talking about the instability.
Anyone who has a problem should have seen it coming for all the warnings they had in advance over the past 7 years.
I used the same password on one of my side accounts and it accepted it fine but when I tried that for one of my other side accounts it told me that I was using a password that might have been compromised.
and I still can't get into my main account.
This check now has also been added to the account settings page.
It's basically a measure to prevent people from shooting themselves in the foot.
If you've already changed your password then you've got nothing to worry about. Nobody had it but you.
All emails upon which I have active say they are not associated with the account. And now that passwords have been reset for the majority, if not all users, I cannot create a new one. Is there any possibility I'll ever be capable of accessing my primary account again? If not, can it be deleted?
also works on beta
Congrats, my account has been around much longer than beta's been around.
However, I was a bit worried because I couldn't remember what Email I used for my NSFW account.
After some digging in my emails, I found the email I used for my other account, only to realize it's the same one I used for my main?
FA- Why can I use the same Email for more then one account? ( I didn't realize I did this )
Is this not a security issue?
I just sent an email requesting aide in getting into my account, ihad forgotten the old email i forgot to change on that account. I figured it out (thankfully) but that email won't be read till next year
I've a friend with sameissue, he's still struggling to remember the old email password, and won't see FA again for about a year when his email is finally given a proper glance
As much as i like this site, the time it takes to get moderator help is way too ungodly long
Your friend will get helped.
Let's say 1 email arrives every second, and that it takes an average of 1 minute to handle each email. That would mean that #1 in line would be waiting ~60 seconds to get their account back, while #10 would be waiting ~590 seconds (their email arrived ~10 seconds later), or almost 10 minutes, and #100 would be waiting ~5900 seconds, which is over an hour and a half.
In reality it probably takes more than one minute to handle each email, but I think that example at least works to illustrate my point.
You'll get a response, and the people working the queue are working as fast as they can.
When it takes over a year to look into to someone having issues with another, well after the fact the issue had been resolved, it's just a tad bit ridiculous, you know?
I don't want to be chased by slow resolutions
Behold the celebratory dance of my people! https://www.youtube.com/watch?v=rQzFz6r074o
It took several hours for me to even get a response, but you know what? It was worth it. Have some patience.
If you're having issues with your email not working for the reset, RE-READ THE POST. Instructions are there! Please, there's supposed to be something between your ears, let's use it, shall we?
Chill with the demands, they WILL get to you.
Rumors flying around they are ignoring some user emails.
I wouldn't believe those rumors for a hot second, a lot of people will toss this site's name in the mud more than they should. Honestly, fA does it enough to itself without angry people throwing more mud around. Chances are, they sling it because they haven't gotten a response and may have irked some admin at some point. Ergo, long wait time must mean they're being ignored. Of course, I have no clue what sparked the rumors, all I can do is speculate that they are baseless.
of emails to go through: https://twitter.com/furaffinity/sta.....64092602638337
It'll probably take a long time to wade through all of these. Even if they had a
lot of people working on it. I don't think 24 hours is long enough to go through all
of those emails.
Well, I'm glad the email was responded to okay.
Hope things worked out.
it got tentacoos
I think that with 32 numbers and letters, the noob hackers will have some problems.
Team, you do a good job, thank you for your responsiveness and your efficiency!
but each recent gets pulled under to the bottom with more emails that gets flooded in.
life is not a FIFO stack
Thank you very much.
https://i.imgur.com/mOmZ8hd.jpg
Figured this out because someone wrote a blog post explaining that it had something to do with autofill(for me it would be on Chrome, etc.).
Already sent the email hours ago but it's clear it will take awhile to get a response.
After reading it I thought "no way this could be what happened to my account, that would be insane", but sure enough, here I am. :P
I didn't use autofill way back when I used this account so I had no issue getting it back, lmfao.
Well I can't get a recovery e-mail from it so maybe it's for the best it's not happening to everyone. ;w;
The FA downtimes and stuff is just something you get used to xD
Because the system not recognize any of my e-mails...
I need my main account back!
Sorry about the inconvenience!
i changed my password once already,was forced to change it again just now,and it kept telling me errors and shit so i nearly got locked out...thanks fa the errors are a bitch
How about the ghost note notification we keep having?
(nuke not used, also got a few more notes after the ghost notification appeared, but the ghost is still there as if we had an unread note - note that seems to be lost but still notified)
it adds 1 to note notification (if we have 0, it shows 1, if we have 1 it shows 2)
I hope it stops soon...
Also I don't think the forced password reset was a good idea... it shouldn't be handled this way I see. so many people lost access to their accounts...
It's our own responsivility to change our passwords, I bet some used the same one anyay xD
A huge, intrusive notification (a kind of unblockable pop-up) should be showing till the user changes their password instead:P at least you'd have avoided so much drama and problem reports
As for forcing password resets, since the password hashing algorithm was changed, there's unfortunately no way around that. There's basically no (secure) way to change hashing algorithms and NOT have old passwords invalidated.
Have the user log in with their old password, perhaps show a slightly hidden email (like so******* @ d****n.com) so they can figure out what they need to check, and then once the user has verified it actually is them, have them enter a new password that gets hashed using the new method.
It's somewhat common for websites to seamlessly switch hashing methods, PHP's password_verify can automatically handle a few different types without any additional work. Just verify, then if correct, hash with new settings and store.
I'm glad the site now have a better security system.
Pour ma part, j'ai remis le même mot de passe que la tantôt, puisque je l'avais changé après l'attaque.
Quand, fura disait que les données utilisateurs n’étaient pas infectées, j'ai préféré le changer quand même.
Translate:
Thus, you speak French not.
For my part, I put back the same password as this afternoon, because I had changed him after the attack.
When, fura said that the data users were not infected, I preferred to change him all the same.
No, my main language is not french.
As an uninformed guess, it could be 24-48 Hours before you get a reply, so sit tight, and they will get to you.
As a suggestion to the Admin, it may be worth giving an ETA On the journal header so people have an expectation of how long they should wait for a reply before posting/sending a duplicate email?
1) Is there anyone who's actually successfully reactivated their account despite not being able to access their email?
2) What is the process of manually reactivating your password like?
3) Any estimate on the response time for these email activations?
Sorry about the inconvenience!
I have contacted accounts at furaffinity 2 times.
I still have not received any kind of answer or help.
Been here for 6 years but this time I'm definitely going to leave and try out other furry websites.
It might take a while but maybe someday FA will fuck over its users enough times to sufficiently populate weasyl and I can have a fanbase there.
I'm not suppose why?
So, I had to create a new account in order to asking what should I do now.?
BTW. This's new account but use the same email on my old account and still working.!
Sorry about the inconvenience!
What am I supposed to do?
If i need to make a new accounts again, i think never want to still in here...
I have my account and password, but i can't open my account now.
Hacker attack your server, it not my wrong and not my problem, but now i need to found my email again?
Really a big joke in life.
So that FA may be lost a lot of user.
So really, no need to come in here and shit all over people wanting help. Really, have some empathy. Mistakes happen and it's no reason to act like an ass.
We can change the FA Password and the Email by outself...
You NO NEED make a big problem to us (The users) like this........
Email? Oh god, i already forget it, i only know my FA accounts and FA password only.......
i really don't want to wait days. My job is here y'know? I wish there was a better way
I also need to contact the people who were doing charity work for me to help raise money for a charity Im part of.
My Account Name is yucks6900 and really would like to log back in to my account
My Account name is Ecko7 and i would be really, really grateful if FA let me use my Account again!
Sorry about the inconvenience!
Sorry about the inconvenience!
The verification email was thirty minutes late even though I was #1 in line for a password reset email.
I, for one, commend the staff on their response. Leaked source code usually takes weeks to fix.
To me, the way you guys undervalue the staff's work is the same way people undervalue an artist's work. They're the artist just trying to do their job and you guys are the nitpicky commissioner. You have no idea what their going through, so please be reasonable. And don't assume anything.
Also, this: http://www.ncsl.org/research/teleco.....tion-laws.aspx
47 states and other territories have laws concerning security breaches, notifying users, etc. California (IMVU's location), Virginia (where the site is hosted), and Louisiana (my state) are all on this list. A suggestion/strong encouragement/small notice on the page does not meet the entire criteria for an acceptable alert, and there is plenty of doubt that your "salting/hashing/encrypting" methods met industry standards. I don't know this for a fact, but your lack of transparency is *not* helping.
I like this site for it's simplicity and early 2000's website design nostalgia, but y'all are seriously opening up a can of worms with a potential class action lawsuit. And when lawyers get involved, other things start to get nit-picked.
Ignoring a problem does not make it go away.
However, I'm pretty sure IMVU has a lawyer to spare to have a look over these laws. They had plenty on hand to bully that one coder in record time, so how long will it take to do a proper review of any and all applicable security breach laws?
Yes, it is FA's fault they got hacked but it is definitely your fault you didn't have a working email for password recovery.
i have a few points to discuss with some of you: why you guys blame FA for all this hurtfull damage? okey they may have not backed up for a week but it could have been worse: the backup could have been deleted or wouldnt even be there(meaning no backupss being made).. then you lost all your art submissions commisions etc etc.. it wasnt even FA this time but the imagemagick tool they had on here..theire not at fault this time( also blame the hackers for doing it in the first place and not FA for trying to get the site up and running asap)
theyre redoing the code.. they finally got actuall more money to actually do more.. they cant just buy servers in bunches and install them at once. they are expensive,. why cant you see they try but get set back due to this kind of stuff or due to people complaining constantly about it. they probably getting, like they said, the software and hardware stuff in as soon as possibly possible. but they cant rush it and add/install/replace it directly. all at the same time
and stop being rude to staff for keeping the site running! i know its hard but you wanting to get them to solve it/stuff by saying your ffing code is a swiss cheese repair it, and your staff is incompetent and never does anything, or something of the sort, doesnt help. this wasnt FA codes fault but imagemagick (third party software) which they found out 1 day later after the exploit had been found had an an exploit. if you want them to solve it point them to a hole or problem instead of cursing at them.cursing never helps anyone..
also a quick note. after doing the backup if accounts were made after the backup was made ( 6 days prior to outage) your account probably isnt in the database..
and for those who didnt read it :
Having Trouble?
If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary. ( copied pasted this from the journal)
From what I've heard, this is something a few users have been experiencing, where they cannot access their account for whatever reason despite changing their password
Could any of you help me fix this? If this is something you'd rather I emailed you about rather than messaged here, I'm sorry and will correctly email you about it. But please, try and fix this if you can.
He's losing it... Getting aggressive... losing hope...
I just want FA to fix this!
If you see my comment, it says it's an email/username thing...
AND FOR ONCE PEOPLe READ THE JOURNAL.. AND STOP ACTING AS IF YOU CANT READ OR FIND AWsNSERS THERE..most of you just post the questiopn from an awnser anyway
And for what it's worth, the previous password hashing was literally so bad that you could just google the hashed passwords to get the actual password. There's such a thing as a duty of care to the users of your site, and the security here was so poor that people can write better versions without prior coding knowledge in under 10 minutes.
I'm sorry, but this isn't about whining because information got leaked, I'm not stupid enough to use the same passwords on every site I use. There's things called Data Protection Acts. They're designed to make a company liable for ensuring the safekeeping of their users data, regardless of how insignificant that data is, and to inform users of breaches and the potential ramifications. This site fucked that up big time, and by burying your head in the sand, like you are doing right now, all you're doing is encouraging them to keep on doing the minimum to protect their users.
This happened after the password reset. So there is no way to get it back? My patience has been cut in half, I don't have anymore options.
I don't think emailing staff will help, they'll think I'm supposedly a stranger trying to take an account.
Sorry about the inconvenience!
Sorry about the inconvenience!
"To Reset Your Password:
Use the Password Recovery Tool here at https://www.furaffinity.net/lostpw/
Having Trouble?
If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
To clarify as well, if you cannot recall your e-mail address you registered with, then send an e-mail in as mentioned above, as staff will no doubt assist you in getting your account back.
For those still waiting on e-mails, please be patient in regards as this can be a very slow process to deal with, especially on this kind of scale, seen it before on a small scale and know that, even with lots of staff, it can take a fair while.
Seen some sites offer a whole lot less.
Also, kinda feeling like a copy should be somewhere, just incase, never know who's zooming down the newspost reading comments instead of reading the post itself, which I tend to do i'll admit ^^;
Will say, agree on having some sort of pre-notice to it all, would've went down a bit easier, but meh... what's done is done ^^
How do I proceed?
So unless you have an answer to my question, please refrain from commenting.
If you need proof it's me, check the signatures on the art there, a few should match the signatures on the art on this account.
Since it keeps saying the email isn't connected wich baffeld me since those are the only ones used for Fa :/
I emailed but no reaction whats so ever. I need that account so FA please email freaking asap >_>
I only have 3 emails that I use to sign up to websites, Yahoo, Gmail and Hotmail and none of them "correspond" to my main account.
It can't be any other email, so it's not my fault. This problem is the codes fault so all we can do is wait. Just know that you are not alone with your problem.
Sorry about the inconvenience!
And that is...
They did not give notice of the password resets here on FA during the Read Only downtime or on their facebook/twitter accounts.
If they had taken this simple step to announce a day or two that the passwords were going to reset, then it would have given a lot of users the time that they needed to go in and check/change their email addresses to the current ones that they use. A lot of users never updated their emails because of the fact that they never thought that the Admins would go and reset their passwords.
Because of them neglecting to do this one simple thing, we are now looking at a mass exodus of FA, not because of the hacks or the read only down time, but because they can no longer access their main accounts/side accounts or any accounts in general because they are now locked out with no way to access this site.
Again if only you gave time to let everyone know of the incoming password reset then maybe this wouldnt have happened.
I understand that it talks about resetting passwords, but to me, it sounds like something that users would have the option to do once the site goes live again. This is why no one bothered to update their emails. We had no idea you were going to do a system wide reset of all user passwords.
I would have my account right now if they'd done this.
Because of their lack of notification i'm now locked out on my main and most important account. And no sight of sound from them changing it. If they just gave a warning so everyone could see which emails they used and if they where still active they would have had a lot less shit to clean up.
This would have saved a lot of issues cause i wonder how long it would take them to fix it. Especially with restoring accounts :s
It would have lowered the "I don't remember which email I used" problem though.
there are a lot of problems going on right now so no one solution would have helped in the long run. there would still be people lost in the mix. Like me.
So all I can sadly say is grab a ticket and stand in line.
gmail UP
Yahoo mail Up
outlook Up
good :)
1. Why put a CAPCHA on the user log-in screen?
If someone has stolen FA passwords, typing 4 characters in a box isn't really going to stop them logging-in to FA.
2. Which idiot has broken the "NUKE" button?
I just had to delete over 100 artwork submissions, shouts and watch notifications of artists i follow manually.
Sorry about the inconvenience!
Are you aware of this? Please let us know asap if this is being looked at!
https://twitter.com/Arokh74/status/.....16595969015809
I'm using Adblock Plus and do not have a problem but I know not many people use this. Please, everyone, be cautious!
NOTE: Upon further inspection this could just be a phishing issue, but if anyone gets this, please do not make the mistake of clicking anything in the ad.
Get whichever version of adblock works on your mobile browser and you'll never get this message again.
But thank you. ABP is working wonders for me, and I won't be using my phone to log into fa.
Its gonna take a loooooong time to get through those emails. I know they have more than one person working on it but in my mind it's just literally Fender sitting at an old gray desktop computer alone in a small room full of ancient dusty file cabinets, squinting into the screen and replying to each email at the pace of a snail
This is my pokemon character's fan page only. And my main has over 5 years on it. Really irks me hat I cannot access notes, and by now thousands of submissions to sort through. Irony of it all, this account uses same email as one I have password reset issues and it went through just fine for this one.
I'm not surprised at all at the ridiculousness of your issue. Having the correct email but it not working. It wouldn't be FA if it wasn't full of bugs.
i want to reset my pw, but fa tells me my email doesnt match
The email you provided, "[email protected]", did not match the email registered with the account "stitch-mimulus"
send a support ticket ...
http://www.furaffinity.net/user/stitch-mimulus/ is my account
guys please help D:
Sorry about the inconvenience!
i mean im willing to show anything or do even a live chat/camchat
i just dont want to let my 8-9 year old acc die cuz of that hack atack :C
Another user who had to recover their account via email wrote about their experiences here:
https://www.furaffinity.net/journal/7590747/
my acc works again ;DDD yay
user: "Why couldn't I just do it.
Furaffinity: "Clearly we know whats best for you."
user: "yeah but now I can't get into my account that I've had for years because the email on it isn't current.... thanks for that."
You finally set some time aside to work on the site, and you waste it on the most useless "security" feature to be invented in the past 30 years. Captcha is easier for a hacker to brute-force breach than for a human user to interpret visually.
Sorry about the inconvenience!
Just gonna put this out there, FA staff good on you for what you did to quell off the attack, but honestly the password reset thing could've been handled much better than it did because it seems like it was a complete mess for a LOT of users trying to get back into their accounts, but hey some of the users were very patient about it, that's a good thing, it's having the patience to put up with it until things can get solved.
For the users that came in crying, sobbing, and in general being salty because you probably didn't read over the journal details in your anger, made a new account just to express that, that's not cool. I'll agree staff did not handle this thing too well, but it doesn't mean you should flip the table because you wanted instant results.
An judging by how this is going, this is a mess, if they wanted this to be handled better, staff should've let the site go live with a 24 HR warning for all users to change their email addresses because they need to update the login's security features before they went ahead with it, because the action was rushed, I can see why many users would be upset at this.
It honestly would've been the more clean choice. FA also still could've implemented the capcha or whatever firstly before making passwords be reset, because if the hackers are using bots, bots can't get pass, that means the hackers will have to do it the harder way, individually and if I were a hacker, I'd want my work done in mass, not one by one.
For me it was a bit of a nuisance mostly because I did the reset on my tiny smartphone as I wasn't at home when FA went live again.
And like I mentioned before if I knew I could have the same email on all my accounts I would have done that.
Really hope to hear back at some point today. This whole situation is frustrating.
Sorry about the inconvenience!
Personally note me for the info if you can change it now please.
I don't believe FA tracks your old passwords and keeps you from using one that you used to use in the past.
Sorry about the inconvenience!
Sorry about the inconvenience!
Guess I'll wait patiently for your response.
IF YOU ARE HAVING ISSUES WITH ACCESSING YOUR ACCOUNT PLEASE CHECK OUT MY JOURNAL.
I talk about my own personal experience with the trouble I had and how to make things easier. I got my account back and I may have some answers to your questions in my journal.
http://www.furaffinity.net/journal/7590747/
http://www.furaffinity.net/journal/7590747/
http://www.furaffinity.net/journal/7590747/
http://www.furaffinity.net/journal/7590747/
Hope it helps! Good luck everyone
Sorry about the inconvenience!
While mine is pretty obvious since this account is reffered on it but what do you need todo.
Also how long does the turn around time cost? I have commissons on that account which i now have 0 excess too since they site keep whaling that my email isn't correct. I have send you guys a mail and i really would like to know how long it would take since this is really important ://
I'm afraid I can't give you an estimate for how long it may take to recover your account, but the staff responding to emails are doing their best to help everyone out as fast as possible.
Any how thank you kindly for the reply. I've send a email 18 hours or more ago so i hope i will get a reply soon..
Thanks.
Sorry about the inconvenience!
I am trying to recover my account and I can not do that. I E-mailed you guys and there was no response and I did check everything and there was still no response
This is my user page and I know you are busy, and I thank you in advance.
http://www.furaffinity.net/user/fatinuyasha
I have an second account
My problem is, I can not reset the password from this account, because I have deleted the e-mail adress for 3 years ago, because I have moving to another e-mail service, so I have no chance to reset the password, by myself!
What can I do at this point?
I know your busy and also everyone else has problems.
But just to let you know on my other account (main account)
I did the email and request code part but not received a email for the code...tryed 3 times know over 12 hours.
Not in my junk or spam and I've saved the email address as accounts[at]furaffinity.net but I not getting any code or email from you guys
Have tryed resenting my password 6 times via the email code and I haven't received one email yet!
I've made sure your not on my block list. I have put the FA email addresses into safe senders on my outlook (hotmail)
I've checked my junk and spam mail
Still nothing :(
The first used the exploit to download a virus to their server allowing the attacker to steal the server code
The second was just to make a show by deleting everything possible
As I said to you before Dragoneer, this pattern of not updating security would cost you. And now it has happened.
My prediction this time? I have a feeling more is coming, and this time it's going to have an even bigger impact.
Either get your ass in gear, or get your ass out.
FA will be fine without you and Yak among the good people of this community.
I am sure the staff at IMVU will thrive and do a better job at managing FA.
if it is any of the previously discussed just send an email to accounts[at]furaffinity.net explaining your problem and information about your account and wait.
FA Staffing may be blatantly incompetent at times, but they're not malicious.
I say this because my friend is unanswered from 52 hours now, and so while I'm not overly concerned, it would be good to know what the progress looks like so that those who sent before that point are able to say with confidence that they got overlooked, instead of waiting several weeks only to discover that human error caused them to be skipped.
Will we have problems communicating if we use a HOTMAIL EMAIL? I sent one yesterday.
It would be nice to know if i have to send another message from another account...
Would it save you time if you made a News Notice on what information people should send to you prove its their account?
This way, you'll save time not having to send an email to the user asking for what they need for proof of identity..
be patient .. patience pays always !
ive got my acc back in 24 hours ... its no time considering how many people have the same problem like me having problems with email~
FA has not replied to my last 4 emails. I CANNOT get into my account, the email address was deactivated a very long time ago. PLEASE help resolve this issue. PLEASE respond to my email.
Have someone send you a blank note, then delete it unread. It usually resets the counter. I hope it helps!
I had an issue where the email in the database didn't match the one I actually used to register, which I still have access to, and could clearly see the original registration email sent to me when I started this account.
When the inevitable happens, creating a new account doesn't matter one bit.
When I try to do the password reset, it says that the email I put in isn't the one I used to register, but I EXPLICITLY only started using forktonguedraggmissile[at]gmail.com
So I don't know if I'm just stupid and forgot I used a different Email? Or if this is just an error. Either way I would really REALLY appreciate some help on the issue!
I guess I'll try to get their attention in an obnoxious way... xD
STAFF: CAN YOU CLARIFY IF YOU'RE ABLE TO RESPOND TO HOTMAIL.com EMAIL ADRESSES??
OR SHOULD WE SEND FROM ANOTHER EMAIL?
Instead it is my main account
I don't want to lose all my favorites!!
They should have replicated the user table and on login if there was no password set to the new table authenticate against the old table and then force the user to setup a new password, or something in this lines not a big "we dont care about user experience a single bit, so there, enjoy this dirty fix"
I had forgot to change the email on it, so I made a new one and emailed accounts[at]furaffinity.net as instructed.
Now, my NEW email got deleted by hackers.
I'll have to email AGAIN using ANOTHER new email.
Just wonderful. And I already have been having a stresful year with my job and this shit happens.
I'm going to have a panic attack if I can't get my account back.
1) Email accounts[at]furaffinity.net
2) Give as much information as you can about your situation and email problems.
3) Be patient, holy shit. Is it that hard to ask? there's probably like 5 people going through thousands of emails. Go take a break off the internet for a moment and calm down. They'll get there when they get there.
-Bojog
RIP Omasaki
I had to make a new account just to keep up with things. It's definitely frustrating.. but not much else we can do.
Although some indication of how long it might take would be nice..
YEYEYEYE hot memes
I deleted the email and never was able to change the email before the site attack, so I cannot gain access back
I understand you are viewing tons of emails and tickets. So thank you for being very patient with us.
Reality: "I'm siding with the site cause it gives me things to jack off too."
Do I have to reset the password I made two days ago again??
*Sigh*
Glad ya like my art though
In the meantime, I changed your layout to beta for you.
-Bojog
i just checked my account and i was able to switch between classic and beta layouts with no error
They need some sleep and something to eat too, they are humans, not robots x3
The sad point is that hastily ones have wait like over night and start spamming another emails there, so there would maybe be 3 or even more emails from the same account ._.
One could handle the ~30 hours I've had without any kind of response so far, but this PLUS the 5 days ( don't know exactly anymore ) in which FA was not accessable is just too much.
They just could've given people a day to switch their e-mail addresses, but they just threw a reset in everyone's face and then wondered about people's complaints.
They're not even sending out e-mails to the people warning them that since passwords have leaked, other accounts on other sites with the same passwords are now endangered as well.
I've witnessed a lot of BS on this site since I got here 6 years ago, but the attacks are just getting bigger and the damage weighs heavier with every time something happens.
I thought it was common sense that if you have the same password somehwere else and people know your password you should change it ASAP.
A lot of people just see this: "Oh, FA is once again down for a week... Oh, it's back, just like it always happens. Period."
i know fa is trying their hardest and i commend them, but their negligence on this matter is beyond acceptable and only caused them to work harder.
an email SHOULD have been sent out letting people know of the issue, no excuses :/
Yes, they should have sent an e-mail, but I doubt they wanted to send it to all users. It was probably easier to do it this way. like they've always done. Correct way to proceed? not really.
i have a feeling the community is gonna be feeling this attack for a while
seems they've been doing a really good job so far
I'm stuck using my husbands ex-profile here until the staff can help me sort out this mess since, unknown to me before the fact, the Email associated with my main profile had been closed on me.
I have to say that HOTMAIL/OUTLOOK Email service is WORSE than cancer.
It says I have an error or invalid user but I see that my profile is still up
Where can I write so I got help with that?
Thanks!!
I send a mail as well within the first hour or so of the website being back up again. Have not received any mail back, and given the timing of me having send the mail I refuse to believe I am 'down the line' still. I also am not able to receive the mail on my reopened Hotmail account - simply nothing seems to be send there.
At this point I do not believe its them being hesistant to respond to my ticket, it seems more likely that my mail was blocked and thus not read, or I am not receiving their responses.
I whitelisted everything in hotmail, and checked all the spam/junk folders on my normal e-mail adress I am using for correspondance though. This seems rather hopeless, unless they can actually confirm they have received my mail.
That'll keep out all the meanie hackers for sure!
Can you tell me...
If i forget my Email when i register my FA account...
When i send email to [email protected],
"What information i need to writing in the mail, then can help the administrator more easy to find back my FA account?"
Any other information that you think could help verify you own the account would probably be helpful, but the staff responding to emails will work with you to figure things out.
Wish that can get back my FA accounts...
(sigh...)
Or something, should I just tell her to make another account?
Responses may take a while, as there's a lot of emails to go through, but everyone will receive a reply as soon as staff is able to process their recoveries.
Guess it appears that I'll have to start all over again from the beginning in FA (Unfortunate fresh start) lol~
Don't get me wrong, I knew my other email password I rarely used it much over the years since I first joined despite the fact that it was expired xD
Responses may take a while, as there's a lot of emails to go through, but everyone will receive a reply as soon as staff is able to process their recoveries.
It just makes me sad I can't access my primary account, but I'll just keep waiting.
It's been more then 48 hours now since i send the email. I'm still unable to get a new password cause it keeps whaling that it isn't my email which can't be true. I REALLY need this account:
do i need to send another mail? This is really important. How long will it take?
If you haven't already the best option I can really give you for the meantime is leaving a shout on your business account's profile directing people to contact you on this account until you can get back into that one.
And yeah i did. Migrated most my work to other sites. I'm just annoyed since i was always font of Fa untill this shit storm happend.
Anyhow thanks for the info. I'll keep a close eye and poke again when needed
Greets
And people bitch about not having a choice to reset their password...I think FurAffinity was trying to save its ass from a bunch of "AHHH MY ACCOUNT GOT HACKED FUCK YOU GUYS IT'S ALL YOUR FAULT" from people who didn't want to change their passwords.
I agree, seeing people complain is a bit annoying, especially the ones who want staff to fix it here and now, instead of emailing them like they are requested.
IT-Guys this is riddicoulus.
In the past i like my old passwort.
Thanks to nothing.
Someone has our account names, our email addresses (the original registration address and the most up to date one) and our passwords. They are on a site where all a user has to do is enter a name and press enter, and there it is.
This is a major fuck up. "Whoops" does not even begin to cover it.
It's so easy to find if you're anywhere on the Internet right now.
But it doesn't. It belongs to who knows how many unaffiliated individuals. These individuals could sell the information to spam sources. They could try the email/password combos on other sites and glean more personal information that way (which is a very simple process to automate).
The database had my original registration email address, which I had completely forgotten because the last time I used it was in 2009 and it was completely different from my current email address.
It *can* be a good tool, but it is also extremely alarming if you know anything about cyber security.
Honestly the whole thing is a great reminder about Internet security in general. Everyone already should be using unique passwords for every site and shouldn't be using emails they don't want tied to certain things. Email addresses aren't and shouldn't be expected to be private.
It's incredibly alarming that FA has been that horrible and people continue to use it, but it's really kinda your fault if it makes that big of an impact on your online life.
If you want the link, you can send me a note and I'll pass it along to you, along with more information about how I came across it. I wasn't the one who posted it here, but I know where they got it.
....10 years ago.
Today, its a mismanaged art site that only has business in the mind and has a general userbase of 13 year olds with no grasp of what money is or how professional artists work. Most of the artists here want to make a living and its rather annoying having a user on dA ask you if they can pay for a 30$ USD commission with 30 'points' because it's totally the same! (note: 30 points= not even 30 cents.)
Also with inkbunny, I find it nice when you filter out all the pedoshit, but it's very niche. either you do cub stuff, or you're a sonic fanartist. I'd reccomend weasyl if you're looking for a replacement like FA but has pedostuff blocked completely.
Been waiting two days now for an email response.
Don't worry the forced password update wont stop the fact that the database was hacked and now someone has access to all our info it only locked up out of our accounts and forced us to deal with this shitty support email.
FA is a quality website
gg 10/10. No wonder I had russians try to get into my accounts linked to my shitty email on here.
It's become evident that a lot of users are both kick out of their accounts and angry about it and this board in this journal has become the only method for us to share our outrage or even sympathy for those members. So what are you doing here? You have an active account and even if you don't your as angry (or as vocal) as the people who are and yet you choose to come here and give us shit about it. Why? Is it an ego thing? Do you think the website or the developers are being hurt because of our posts?
Let me tell you what your accomplishing by telling people with account problems that they're careless, dramatic, at fault or any other hurtful adjective you can think of; brown trolling. En sighting more rage among us members who don't have their profiles back for your own ego's sake or what you think is the sites ego's sake. Were still going to be pissed off at the situation of losing of account no matter "word of wisdom" you can blast us with. It won't change anything it never has before.
If your dedicated to this site and it's community, then go back to it. Ignore this board, go back to enjoying the site that you did put a valid email for and ignore the rants and ravings that we're posting. Let us collectively scream into our metaphorical pillow until we get our accounts back, leave the site, or begrudgingly start with a new account. If you see any of this hate posting anywhere else besides personal profiles and journals then give them the white knight treatment. That is literally all I'm asking of you.
To anyone wondering, yes I received the reset password email on my hotmail just fine, but just in case add noreply[at]furaffinity.net to the whilelist like FA Staff suggests to, it took almost two days to get the email.
I hope that everyone having issues will be able to login soon.
There is hope!
Hell, yeah, wow!
The FA Staff is
Coming alive
In twenty-sixty, five, five, five!
At least I think I'll probably get an email back by then...
I've sent ONE email to the account support address, but why should I need to? So is the password reset tool even working at all?
Also, don't be so sure about what you are saying, each time a mess up like this happens, more and more people don't end up coming back since they see that it is viable to have an audience and clientele elsewhere. Like I have quite some friends who have managed to do so on freaking twitter already, even having more than they have had on FA.
So yeah, don't act like people don't have a right to want to leave and are stupid and/or "delusional"
I updated my weasyl after losing access to my main account because of this mess, and everyone there's been really welcoming, it's more active than I remember too. Someone linked me to a guide on moving there without losing your client base. If more artists just packed up and moved then it would work. But alas, I probably won't even after this. I like money too much.
Weasyl is great, I've had a lot of success there and the people are super friendly. Plus the website actually FUNCTIONS and the staff send out updates periodically. I've had a much more positive experience there.
https://www.weasyl.com/journal/6957.....fic-funneling-
I never use random emails to sign up any account online, so I was very sure that my email is the one that I'm using. Password reset? Not a big deal. I remember both my username and email well enough.
So I tried the lostpw, but damn it keep complaining email mismatched?? I keep trying and trying for a couple of times until I emailed accounts@fur. No response for two days.
Today I made another try, and yes it's still failing. Then when I was about to give up, I suspect this has something to do with Chrome autofill.
So instead of submitting two yellowed Chrome autofill text boxes of username and email, I erased one character from my email, and fill it back up as if it has never been changed literally. Autofill's yellow overlay is cleared due to this, and wow submission succeeded??!! I received the reset instruction within a sec!
What made me wonder is
- It happens on both my mobile chrome and desktop chrome.
- I literally check on every character and I'm sure the email address has no typo.
Tl;dr.
If you think the email address that you are using is correct, try submitting it by just key in the full email address without auto complete. I suspect there is invisible characters included that causing this. Cannot reproduce this again.
Or, turn off autocomplete?
A lot of people who don't use the site anymore probably aren't aware of the fact that their credentials are floating around in the dark web.
i had to make a temp account.
my user name is
I know I'm not a famous or popular artist but they only make up a small percentage of this site, don't forget this place is afloat because of the masses.
please help out i have way to much work to lose here.
In the meantime, using the "select all" buttons should save you at least some clicking compared to checking each box manually.
password reset stinks for me Give me Nothing but stinkin errors :-<
I'm
24 hours later I received an error message saying:
Technical details of temporary failure:The recipient server did not accept our requests to connect.
[furaffinty.net 208.87.150.50: socket error]
Two days later I received the same exact message.
This is the rest of what I'm receiving in this same message:
Delivery to the following recipient has been delayed:
accounts[at]furaffinty.net
Message will be retried for 1 more day(s)
I'm not sure what's wrong, but I'm not sure if they're going to even receive any message I send their way. I did send one more email to the same address hoping that, too, would help. It's been more than 48 hours since that first email was sent, and I don't know if I'm going to hear back from anyone. I just want to know if the administrators are able to read my emails at all.
I have the proof needed to verify that I'm
Please contact me. I understand things are complicated for the moment. I'm willing to be patient, but I just want to receive some word after more than 48 hours of silence.
Thank you. :)
I really thought I won't be able to get back into my account, I was so anxious.
Delivery to the following recipient failed permanently:
accounts[at]furanffity.net
Technical details of permanent failure:
DNS Error: 42155451 DNS type 'mx' lookup of furanffity.net responded with code NXDOMAIN
Domain name not found: furanffity.net
Original message
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=message-id:mime-version:to:from:subject:date:importance;
bh=XskxGgC1uGP9fGZIhZ21TIUQUqeDTWuAnLcE8m82T3M=;
b=ytn54gBQcPM5ph2i4FF69 R/18VRmNwU3yea82YOPng L 3cBOjSjlAktouWGwr5c3
USKoXxKjuULxkU9zVjW 1/znZZeIjEIlvwmhPLzqsKv4XRAuTuE6lNW fRhF0PVJHbj
W/6VzRhDUn5T2 UzRGARx1IoXIBtwdgGp8LnNL5w4KmGdg265DaoqheGUXs4Oempjhqh
Ucg 2/rBNj/LRUJbgwlwu9TG7LiAWiksiYdT2Qcn21Dcc11scwBygMIfK13nbJlszSxz
TIbUoKYNGZd1S6Bd6dxC8piv6ZIn W3pTmPo2bfRus2WigJ3OK8siuHxj2rVaW2U2G o
u7kQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:message-id:mime-version:to:from:subject:date
:importance;
bh=XskxGgC1uGP9fGZIhZ21TIUQUqeDTWuAnLcE8m82T3M=;
b=D6hVVqlZJ1rRgl 5IkN1pAI9rpZw6d6L ybpkQiQFGVbem9lwJe0/ZNcIFpvXZYjJj
ygy6zlptBJexFIvgP33VVh37/S4kuPaKeVXpK1TAWEdFtToORzQUUxfNjDma0FwRoama
iWHO9yvS6tse Tk6FqGOat9Pc7lup3yKdmxM1WmFBL6pmx27Ahp//yC/g/bFcZnXAKyd
xAB1d3XAlTKUP1HXoZrA04DYJidUUApwCSqdPcjxXNR2Y2piONUfQYgEp8FKo315Y29Y
VMzhMEG13biDQOpw62qL1pG9K0aRkU2n7jacKw iUkzB/eIk8P2b02qNvJbDS2hAbTkd
3G3Q==
X-Gm-Message-State: AOPr4FVGrlnQfbX/fCXmpuZthJhMeLumIyXLBdQkqDncIefM2T13ddL388uy/qOU8WyyIQ==
X-Received: by 10.129.109.200 with SMTP id i191mr9218156ywc.87.1463972497602;
Sun, 22 May 2016 20:01:37 -0700 (PDT)
Return-Path: <[email protected]>
Received: from ?IPv6:2602:306:cd45:dc70:71c6:34f5:1e07:3189? ([2602:306:cd45:dc70:71c6:34f5:1e07:3189])
by smtp.gmail.com with ESMTPSA id o5sm12159706ywo.38.2016.05.22.20.01.30
for <[email protected]>
(version=TLSv1/SSLv3 cipher=OTHER);
Sun, 22 May 2016 20:01:35 -0700 (PDT)
Message-ID: <[email protected]>
MIME-Version: 1.0
To: "[email protected]" <[email protected]>
From: Lighning Dash <[email protected]>
Subject: Password recovery tool help
Date: Sun, 22 May 2016 23:01:34 -0400
Importance: normal
X-Priority: 3
Content-Type: multipart/alternative;
boundary="_B03F4A58-CCE1-454A-B971-6DDDB5F33B4D_"
Delivery to the following recipient failed permanently:
accounts[at]furanffity.net"
Did you spell it wrong by chance? accounts[at]furaffinity.net
*edit* got ninja'd lol
It wasn't one of the targets, but that's put a hole in their air surveillance.
Being referred to as "Other" makes me feel inferior. :(
also hai
This is not to help secure the breach site, but rather to enforce and remind Auth., that corruption and negligence of duty is intolerable. Staff on this site are required by law to properly ensure a standard of security to its users. I can provide proof that such laws exist if requested. Your failure to ensure the safety of members here and beyond has caught attention and will be dealt with according to the severity of Staff Officer negligence.
I have served 8 tours of a corrupt criminal underground where I targeted hacker-rings and illegal gambling organizations on a particular IRC, by skillfully tagging users with sophisticated StarOp drones that would relay back information on user-doings. Ive clocked over 6000 hours (That equals north of 250 days) in around 2 years of service and over 20k total hours in SDO. And I will continue to clock more time in the future.
If FurAffinity staff does not correctly ensure the safety of its users, I will report back to OLNI Red, OLNI Command where SECUSTAT Command will mobilize a division to fire a "Warning Shot". This warning will only be given once.
No one here or elsewhere should have to suffer because of the failures of a few people in authoritative seatings.
Please dont take this as a threat. But rather, as a warning that we have our eye on you.
Dont make the same mistake twice.
- Cpt. A. "Viper" P., StarDomain Operations (SDO) Office of Linguistics and Network Intelligence (OLNI) Division 5, 2016.
"Long live peace"
P.S
I take this seriously, as should you. Dont hack me. I dont want to have to hurt you.
Though keep in mind, this response is purely based on if I read the definition of an "edgelord" correctly, so the response may or may not reflect a factual base
Plus, I'm pissed. You guys continue to prove that you're incapable of running a website. Either get a fuckin better set of staff members or get a clue. >:U
The Password Recovery Tool didn't seem to work for my main account. I knew the email I used to register and the system accepted it without issue. However, it was an AOL account I hadn't logged into in forever, and I discovered that all my emails had been deleted. AOL does this if your email is inactive for 180 days (and bounces emails after 90 days of inactivity). Regardless, the Password Reset emails haven't arrived to my AOL account at all (checked the spam folder too). I made this new account (using a Yahoo mail account) and tested the Password recovery tool and the email arrived to the Yahoo account within seconds. I suspect AOL is blocking emails from FA, even after I added them to my contacts.
I hope an admin gets some use from this post and I wish them the best of luck with this crazy mess
Dildos.
I'd like to get back into my account
I'm starting to get a bit paranoid because I won't have a whole lot of access to things while I'm traveling, and so I'm worried that I won't be about to help with the authentication.
My gallery is identical on Sofurry and Weasyl, so do you think if I could prove I still have those accounts that I could prove that I'm the person who owns this one?
. . .
Dunno. Halp!
. . .
Good thing we dont give any more personal info (than our accounts name) in here or I would have fucking china in my bank accounts by now.
I do remeber my e-mail account but thanks to your amazing skills I doubt I will ever retreive it because you fucking reseted the whole shit (even the e-mails).
And whats best, you dont even help the users of your OWN SITE.
but anyways, bet youre fucking busy playing with your dragon dildos to actually do things right for once.
I can't figure out what email I used for my main, and my side accounts, but don't think it would help
i tried to reset on my old main account i moved from, to regain access to at least one account, but the password
reset code didn't work, so little use really.
i really don't have the energy to deal with this shit right now, and like others, i hate the stupid captcha thing without
having gotten password wrong thing.
i'm moving soon/soonish IRL and i so don't have the patience or energy to deal with this whole damn mess
"-Was my information compromised? If not, PLEASE, somebody tell me. If so, can anyone tell me a way to take care of it.
-This only applies if it was: What all was compromised? Just my FA or is something wrong with the Email as well (it's a hotmail). "
the only information that /possibly/ compromised are everything you supplied & submitted into furaffinity, mostly the /you want to share/ stuff such submission, comments, etc etc, or /possibly/ your furaffinity credential information such email and password.
its not a big deal, EXCEPT if you are using same password in different sites you are currently using in furaffinity.. well, losing furaffinity account can be tough, but still less pain in ass compared losing your bank account & money
But once I confirm my business is finally pieced back together, I'm leaving
It's a shame this wasn't fixed before it became a problem..
[Click here to continue...]
I CAN'T DO ANYTHING!?!?!?!?
I just click on the "Check all" and then "remove selected"
http://i.imgur.com/YUuptGd.jpg
> System still lets you fill the form out in HTTP instead of HTTPS.
http://imgur.com/1F18z3x
I don't get how its their fault for something you're pretty much responsible for. And yet there's the guy above me who hopes those who actually kept up "fuck up someday," I mean, come on, now...
It worked, and worked perfectly, so now I'm back but have a pending request somewhere in the e-mail slushpile. Oh well, the important thing is that it worked in the end!
I logged on over the weekend
And you told my account was gone
Along with a watch list mile long
And the emaaaaiiiil I sent three days ago
To my woe
Returned the sound of silence
(And yes, in their state where FA's servers is based (Virginia?) and where IMVU is (California), it is required by law to inform people of stuff like this through email.)
So I changed my password to another one. The only problem is, I can't change it back to my original password. It says it "might have been compromised" when I try to change it back.
Any help would be appreciated. Thanks!
And it can show you i own my old accounts...
Please... help me.........
Three days? Ten days? One thunder days...?
Very disheartenment.....
Too much mail.............
I think you can showing "the date time you are being processing"...
Because everyone is waiting the reply.....
What do you think...?
Such as : "The Administrator is processing the mail of
24 May, 2106"
Because this can making the users more reassurance to waiting more time.....
Normally I would just wait but this was supposed to be the weekend I am supposed to jam on all my commissions and I'm missing details on a couple of them that are kept in notes.
https://www.furaffinity.net/journal/7592656/
You admins could have handled this better and I just can't grasp the reason WHY you refuse help
form your users who are MORE experienced than you. I just had my phone reactivated today
and ALREADY had another threatening phone call. This has caused me living hell and all because
you cannot run a site properly and not have the simplest of security measures.
About the refusing help argument. What if they accepted help...and one of the helpers was a hacker....and that person added in malicious code that was missed by the other helpers. Theoretical, I know.
For the attack that happened, the hackers gained access to FA's code using a very common image processing software that FA used to re-size uploaded pictures. Many other websites were also hacked, not just FA. Doesn't make it right, I know. But
You say "simplest of security measures"........a different password for email and other websites (not just FA) is the simplest of security measures. It's rule #1 of the internet.
I read your journal and I hope you have a seperate passwords for tumbler and your email and any other sites you use.
Again, I'm truly sorry with what you are going through
And in the journal above, they listed all the changes that they made, so we are safer
I give Dragoneer credit for sacrificing everything in his life to help everyone here.
I will miss you guys and will visit often but I do not find myself conducting business here again.
This has been changed to BCRYPT. Passwords are really really safe now. So safe, another furry has encrypted something using BCRYPT, and if you can crack it, they will send you $4500. Here is the info http://forums.furaffinity.net/threa.....dated.1531930/
I've discovered my hotmail account has been hacked into...this is the same email address connected to my FA main Account that im having trouble to access and still waitting on a reply form you guys over 50 hours waitting for a reply.
God knows who and what over info they have managed to get :(
As for your hotmail, it had the same password as your FA account? If it did, go through the 'Forgot my password' process on hotmail to get it reset there so you can access it.
And make it a different password
If it had a different password and it was hacked, then that has nothing to do with FA. Still get it reset tho.
My hotmail account has now been sorted but still waitting on a reply from FA... 72 hours waitting now I think
I keep hoping and praying
I dont know what kind of person uses the same password on everything, so Im just letting you know, making a big fuss about it and pointing yourself out that you use the same pw on everything makes you look foolish.
and yes I agree that one password over all accounts is a very dumb idea, but what is also dumb is assuming that I or anyone else is a person that does that as it is not common practice on the Internet. The security breach here is in fact very dangerous because with the information that they may have been able to get through my FA account they can seriously disable my business.
We do have an automatic system - that's the password recovery tool. Unfortunately a large number of users had not kept their on-file email up to date, and thus we are offering an option to manually help them regain access.
I guess it has to be hella hard to let the users from your own page that you are being fucking hacked(again) and that you are reseting all passwords and apparently some e-mails.
You guys needed 2FA waaaaaaaaay earlier than now. If you had 2FA this situation would have been a lot smoother if not incredibly less messy than it already is, it's automated and would make it a lot easier for people to regain account access. People are spamming you guys because your team is skipping over them. A fine example being about half my friends on this site emailed support BEFORE me but some how they were missed when i emailed like 4 hours later than them. Like how the fuck does that work? You need more people working on this and sorting it out, its taking so long right now that, like i stated before, people are loosing income from this and its affecting their personal lives literally.
You should also make it that users are able to list a secondary address then too, it would help make sure people can comfortably connect another email account that they would frequently use for this site in case of an event like this. Seriously the site has been breached so many times yet you guys learn NOTHING from the last one. How many fucking breaches does it take to get it through your teams skull that something oughta' be done about it? Ffs.
Edit: I might just add im sorry if my view appears hostile but as a frequent and long term user of this site its absolutely bullshit that in 2016 this site has such crappy and poor security, where as smaller / more Independent sites have better security. You would think by now the team would have sorted something out but yet it still feels like we're sitting in the dark ages of the internet where net security was just thumbing around hoping for the best.
I sent in my email 52 hours ago.
and a friend of mine says he got an answer to his email in 4 hours.
What is going on?!
The number 112,542 they quoted on twitter was how many passwords had been reset using the reset password page
I'm still waiting for a reply about my main account. Just gotta have patience :)
http://www.furaffinity.net/journal/7596056/
Also, the 112,542 was total accounts made on the entire website, not emails received to get this shit fixed :/
The 112542 number is the amount of people that were able to reset their passwords using the reset tool...as I said. There are way more than that many accounts on FA
Really don't care to crunch and talk the numbers, but this whole thing could have been dealt with a lot more professionally than what the staff have 'done'.
There was no proactive tasks taken when they found that the source code had been stolen and distributed. There was no heads up about the complete reset of all passwords to the users to give them a chance to fix their emails. The sign-in page is still not 100% secured and people are having the page load up as HTTP instead of HTTPS like it should be. And the fact that they Still have yet to send out a site-wide email to their users about the security breach, as required by multiple States' laws in the US, is absolutely disgusting. Hell, the only thing that damned Captcha on the sign-in page is doing is delaying the exportation of people's work as they hightail it the fuck out of this horribly coded and vulnerable excuse of a website. This all just adds to the ever-growing list of reasons why the website either needs to be shut down or go completely clean-slate with its staff because those up top don't seem to understand what they're doing Ever.
This site is absolutely shit, but you're spending way too much time talking about factors you don't know about. With no actual information on the subject, at best, you could "happen to be correct". Guessing correctly doesn't make you smart or 'right', just correct.
You're trying to come off as someone with insight on the corrupt status of this process when you're really just blindly placing chips. Worse yet, I think you know what you're doing, and capitalizing on the fact that you'll never be DISPROVEN therefore all you're doing is shitposting and ranting to blow steam with no care as to whether or not you're even right, which is a bit fucked up when someone goes on and on without a shit given about their own merit.
I understand that they're probably busy with a considerable volume of emails. I just wish I knew an ETA on a response. I'm
I understand that they're busy; and I'm willing to be patient. I just didn't know if 48 hours was well over the normal wait time.
And thank you for your response. I appreciate it. ^_^
They'll ask you to confirm your date of birth and IPV6 address. Once confirmed, they will then change your account email to the one you used to contact them.
Do you want me to mail you guys again? And what kind of information would I need to provide that the account is mine? I'm in contact with a friend for a commission in June and I would like to contact him soon with references.
Have patience. I'm still waiting for help with my main account. They'll get to us.
tl;dr constant phone calls with death threats, LOCALLY
As for her email account becoming compromised. I'm sure it is a coincidence it happened at a similar time, however if it was caused by FA's hack, that would mean her email password and her FA password were the same.
You should always have a different password for your email and for the sites you sign up on.
and they inform you of suspicious activity. I started receiving death threats same day I tried to change
my password on FA.
AOL tech support informed me I was not the only one reporting from Furaffinity. SO umm yeah
it was the hackers. Not to mention EVERYONE is on a Deep Web site now and cannot be removed.
Anyone that browses the deep web via tor can see any personal info given to FA upon set up.
I see your comments everywhere in this thread and all practically SJW white knighting FA staff.
I have been here since 2006 and history just constantly repeats itself. I have moved many times from
here but unfortunately no one else does. Not to mention most other sites have either asinine rules or
problem content I am not comfortable with.
SO yeah safe to say my presence here on FA will be extremely limited now. I don't trust the admins at all
and I would highly suggest many others start finding new places to set up shop. If this massive security breach doesn't
wake people up then this fandom is completely hopeless.
But FA is safe. The initial hack was caused by a 3rd party piece of software which has now been removed from FA. Other websites were hacked because of this software.
I hope the hackers get caught and get jail time :)
It might take 3 days as they are getting a lot needing help resetting their passwords.
They are bouncing because you were supposed to email [email protected], not admin.
Try that...They should get back to you in about 3 days
I am hoping that once they get a moment that they upgrade it one of the better CAPTCHAs eg the one you just check the box
Short version: Got account back after 3 days. Very happy I didn't use a personal or work email for this account after hearing all the horror stories.
You would only have had problems if you had used the same password as your work email.
Glad you got back in :)
Thanks!
Same bullshit as with banks and other companies which force password resets - people just add a digits next to their previous passwords. It adds zero security.
You want security? Add two-factor auth.
https://pbs.twimg.com/media/CjVXYnLVEAEayLn.jpg
Now I'm just worried.
Well, complete FA database should be considered compromised, but it's nothing new for FA really, if you paid any attention to its history, so it shouldn't be a surprise.
Like AOL/AIM is shit already as a email provider, but please, go change your passwords on other sites if you use the same password (why would you even do this) as while the onion links show that they have your emails, they have the passwords as well hidden away.
The only problem your CAPTCHA is going to solve is stop visually impaired from accessing the site. Not that FA ever cared about accessibility...
Your password resett hing is not working what so ever, so please get it fixed, I am growing impatient. I really enjoy this sit and I dont want to leave it.
It could be that the phone is capitalizing a letter or something.
If you really can't get in, rest the password :)
So... user name is case-sensitive?
Usernames are not case sensitive
The email you provided, "[email protected]", did not match the email registered with the account "Karno"
I originally opened my furaffinity page (about 9 years ago) with the e-mail [email protected]. This e-mail address has been defunct for close to a decade, now. I am unable to retrieve anything sent to it. My present e-mail address is [email protected]. Can we PLEASE fix my Furaffinity account access through an e-mail account that actually exists??
Heck - I had to open a brand new FA account ( https://www.furaffinity.net/user/kjarno/ ), just so I could post this note.
I'm sorry for writing a new one of these every new day or if I seem like a total dick, but to be honest...
at this point, I don't really care anymore :3 I'm practically done with this website. Just wanna be able
to tell people that I'll slowly be moving to other places~
kinda feel a bit awkward with out it since not a lot of people come to my other account, and just when i've come so far to get close to the 1000 watches on my original.
would suck as hell to start over again, hopefully i did it right and thank you ~
Just sit tight guys. I got a response in 5 days to reset. They will get to you.
At the same point, can i please get a response on the email i sent out regarding the incorrect email binding?
and i was send e-mail to [email protected], also 48 hours without any response
so i think must have much guys like me , but we cant do anything, just keep waiting for
just one thing that can be sure, has a lot user choose to leave furaffinity, and this number is increasing
too much problem and wait for endlessly was used up the patience......
Patience is key i really hope you guys get the help you need as well :)
Also, to those who have not yet received an email. It will happen. It took over 3 days for mine, but it was finally in. If you sent a generic one, try sending one with as many details as you can about your account. It might help speed things up.
Good luck to you all
I've sent an email on Monday and even though they didn't get back to me, I attempted to log in again and it worked after a few days.
They didn't send you a reply because they probably haven't gotten to your email yet.
Glad you got back in :)
"Having Trouble?
If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
My boyfriend had a similar issue with his account and got it back just last night.
It's not a big deal, it's just a weird problem. <:v
Never forget
Back in the early days of FA, emails were stored differently and so the Forgot my password option is having a hard time with them
DADADAAAAAAAAAAA
DADADADADA
So the admins are being VERY effective.
I am thinking that there is a common theme here with Dragoneer. Lots of people blame him.
Your other friend has not lost his account. Tell him to work with the staff. Create a new email if he has to.
Yeah, they have bad code, but so does every website
Jesus fucking Christ.
Check your junk folder to see if they are going there
This just shows why FA is attacked and the other sites aren't. Can hurt more people by attacking FA
I do business and commissions through my account here on furaffinity, I really need my original account. This is Hot-Gothics.
The only good news is that if my account was hacked for information they're not gonna get passwords from me on there. My passwords were already not similar to other sites' passwords.
Thank you for taking my comment in consideration. I understand the situation isn't easy nor funny at all for you all. Just, don't forget me, please. é_è
Still waiting for an answer, what about you ?
And thank you for working hard admins and mods !
Come one people it is your damn responsibility to keep your contact email up to date. Regardless of how much FA screwed up here, it is your fault only if you have a non-existing or inaccessible email provided.
Everyone else, just be patient. Do not send multiple emails as it simply makes it take longer for the admins to sift through. Try to provide as much identifying information that can help them accurately identify you as the true owner of the account. For me, it took one reply to an email and receipt of a second email to get back into my account and I do not place much identifying information in my account. Again, just be patient and you will get back in.
Thank you
I understand the staff has alot on their plates. But i am getting tired of waiting. I hope to get a response soon. This has set me back a week in commission progress. I am not blaming anyone. But i am honestly frustrated.
I have been waiting 5 days now. Send out my email monday and still 0 response :/
It's still super lame though. FA really should have sent an email notification (in fact they've broken quite a few laws by not) and allowed users to manually reset passwords if they wanted to. This is a giant mess that has put more work on their staff than is necessary and has frustrated the userbase :/
Or are there some known when I'm sending you a mail via gmail?
I'm frustrated and yes i truly understand you guys do your best and i feel very sorry for you that you get all the shit so to say. But i truly wonder how long this all will take? I'm afraid that it will be weeks and that would be devastating...
And again i truly understand but if there was at least a counter how many ppl are still left or a number system so people at least know where they stand that would help a lot :\
A lot of people depend on their account for business and what not including me and still silence. I hope i get this fixed this weekend. I can't not have another week of not been able to excess my main account :\ I depend on that account, people depend on me there and the fact i don't have any control over it since this whole mess makes it even worse.
I send a mail in the first day (Monday, 23/05/2016), but now still no reply...
I've got it open right now. I've asked the Password Reset function to send me a reset code twice. Twice I waited for 15 minutes. Neither time did it send anything - or if it did, the code never got to [email protected]. Yes, I checked the spam folder. It's empty.
This is getting pretty aggravating, folks. Nothing you tell me to do to fix this actually, y'know, works. What do I gotta DO to get my password reset?!
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
Damn it. Now I wish blocking a user blocked their submissions as well.
I cant change my password without it, and I cant figure out what it was under.
TIA
I am not able to get my recovery password due to the fact the emails I've used to sign up are both unreachable.
And also because I don't even remember which password I used.
My username is Strive
Account Darkfirewolf2.
Forget my user email
and now I have to redo everything again: T
"If you are having issues resetting your password using the above tool you can email us at accounts[at]furaffinity.net for assistance. When emailing PLEASE be sure to include your Fur Affinity username. Staff reply time may vary."
where I can send the message with the name of my account?
message: my account: aaa1996
good night, I lost the email address on my account, (aaa1996)
could remind me what is my email to get my keys?
I had the trouble to create me another account, aaa1996_0
but I want the data from my original account
After the password reset, my account was still connected to my old email so I sent an email at 11:05 am (Swedish time) on Monday the 23rd and I got my first reply an hour ago from when this comment was posted. I had to send a second mail with some extra confirmation info (DoB and IP address) and I got my email changed almost immediately after so that I could use the password recovery tool.
Also, I'm using Hotmail and I DID NOT whitelist any FA reply addresses, so Hotmail should work fine.
For those who hasn't gotten any replies yet, just keep waiting. It felt like an eternity for me but a reply came in the end.
To the FA team, thanks for the assistance.
I've tried to recover my password but apparently my email wasn't with the account, in fact i didn't have to put in "@(whateverwebsitemyemailisat).com" It made me very puzzled on how to get the code in order to get my account back, and I've sent you more than one message, and I haven't had any response for five days so far.
I'm a bit nervous that I might not be able to recover my account, I could really need some help.
Thank you so much.
You would expect that the e-mail that got answered would be the first sent, but it wasn't.
Hope they don't mind the extra 3 e-mail that I've sent in these last days.
i dont really want to add to the pile of recovery emails that have to be gone through manually when i have full access to my email and everything, but... yeah.
inb4 "well maybe you shouldnt use aol then :)" id rather not sell my soul and all my personal data to google more than i have to and yahoo has shit for security so no thanks. FA is the only time ive had issues with aol anyway
I'm still happy to be patient with this process. I know I'm not the only one who hasn't received a reply yet. I can't fault the staff for having to do all that work for hundreds of individual users. If anything, I just hope they got my email at all or, if they did, that it wasn't discarded for whatever reason. Thankfully, that's probably unlikely. In the end, I'm pretty sure I have the information they need to verify my identity.
Like I said, I know they're busy, and it's going to take time for them to manually verify hundreds of people.
([email protected])
Please tell me the reason Why won't you reply to me,
Wait a bit, dude.
I mean, how freakin early did you have to write an e-mail to get any kind of answer at all so far? And what about the people who.. let's say came back from holidays and just learned about the whole situation today? Will they have to wait like a month?
And then this fear of not knowing if they even received your e-mail in the first place..
We have people pulling >8 hour days (so more than full time work, and this includes people who are unpaid volunteers) trying to get people their accounts back. Unfortunately, there were a lot of users whose emails were either corrupted or not up to date - some of the former may be able to use the password recovery tool after the May 25 update, but for the latter, it's all down to the (slow!) process of manually verifying that each email comes from a legitimate account owner.
It's not about what is "enough" waiting; we would have loved to get everyone immediate responses but that's simply not possible. We absolutely understand that waiting sucks. There should be something of an upper limit for how long the wait times get, as the number of incoming messages slows down to equal or less than the number of outgoing messages, so anyone being kept waiting for a month is an unlikely scenario, but I can't give you an estimate for how long people may be kept waiting.
I can't speak for everyone, but I don't have twitter myself, so an update to this journal with the link you've just sent me might be helpful to other people as well~
Anyway, thanks again for the hard work~
I am curious about IMVU's role in this. I'd assume a company of that size should have cyber insurance and would have had the ability to have a team of people hit the ground running to help with this (As well as to handle notifications properly and do PR), how are we still relying upon a handful of staff and volunteers to handle what might be 10's of thousands or 100 thousand requests if the published number of 1.2 million addresses on haveibeenpwned.com is accurate. I'd imagine the majority are not even aware of the issue yet. Is the relationship with IMVU one where they can't lend a hand at this key time, or is their assistance seen as not being needed?
In the end, best of luck with it all, we know you're doing the best that you can with the resources that you currently have on hand.
We appreciate the well wishes, and will continue working until we've got things straightened out.
It's a bit tiresome to type that captcha everytime I want to browse the site, I've deleted the cookies prior to the attack to create new ones.
I also can't believe how many users are mad at people who aren't happy with this and have decided to use other sites that, again, don't go down for days or weeks at a time and leak user information on the regular.
The password reset form can now be used as an avenue of information disclosure in contravention of the Terms of Service, section 4.4. Specifically, an individual can now check if particular user is using a particular email address due to the fact that the password reset feature requires two pieces of information (Username and Email) and provides success or fail confirmation. This is classified as an information disclosure to a third-party and completely flies in the face of well accepted best practice in the information security community and is inconsistent with any competently run web service.
Please address this mind numbing oversight and lapse of security promptly.
I can't get access to my old account. :/
5 days and no response
I owe art! People are going to assume I'm ignoring them! I live off the money I get from my art and I can't even view my notes to get some of the extra refs I need to do commissions.
Can you please get to responding to emails?? It's been 5 days, that is ridiculous. A day or two I understood but it seems like you truly couldn't care less at this point...
There's simply a whole lot of users needing help and only so many people to answer emails.
Mail already sent, nothing i can do...
Only want to say, don't be discouraged.
We are still keep waiting (At least i am still keep waiting).
Try hard, FA staff.......
Might be a good time to hire some temporary volunteers...or permanent ones
since people attack FA a lot and this wont be the last time this happens, because the people who want to take FA down for shits n gigs are getting smarter, clearly :c
Why did you take down my comment?
Keep up the good work, and hope all this gets cleaned up so you all can relax.
I've checked my spam-folder obviously. Should I send a new email? Should I just keep waiting?
You'll get a reply as soon as they reach you in line.
Question, would it help if I sent a follow up mail with some account information (last sent PM, other accounts, that sort of stuff) or is it better if I just wait for you to contact me with the particular questions?
I didn't really include any such information in my mail, just pointed out that I don't longer have access to my email.
IF YOU ARE LOCKED OUT SEND AN EMAIL TO THE ADDRESS GIVEN IN THE JOURNAL ABOVE (accounts[at]furaffinity.net) WITH YOUR INFORMATION AND WAIT IT OUT. IT CAN TAKE FROM 3 DAYS TO A WEEK TO WHO KNOWS BUT THEY WILL GET TO YOU EVENTUALLY AS THEY'RE GOING BY THE ORDER IT WAS GIVEN IN THEIR INBOXES.
SENDING MULTIPLE EMAILS WILL NOT HELP YOUR CASE BUT ACTUALLY SLOW DOWN THE PROCESS FOR YOU AND OTHER PEOPLE.
That being said, go on other sites, go play some games, go outside for gods sake. it's May and it's the time for beautiful weather. Just make sure you have your email open and have whitelisted FA's support email as some email carriers might see it as spam and wait for it to come in.
You'll get a reply as soon as they reach you in line.
You'll get a reply as soon as they reach you in line.
and no I ain't discussing the 'should have done' because the fact of the matter is, it wasn't, and saying "well this should have happened" isn't doing shit productive. It is what it is.
You guys are just going to have to WAIT. It sucks ass, I know, some of you are hurting for income in a place where you get it mainly. And I know the lot of you probably use more than one outlet so i won't come at you weird like "well don't keep all your eggs in one basket" because for a lot of ya'll I know it's a case of "my eggs are scattered as much as they can, but this basket still has the most eggs".
But you're going to have to suck it up and wait. Coming here to constantly complain about an issue that's being worked on is counter productive and takes the admins from where they should be TO HERE. On top of the fact poor
Even better, a daily update of "we have answered x number of emails, reconnected y number of accounts, and we currently have z emails in the queue" would help: People would see the queues being worked on, and gauge how long to wait before assuming their email didn't make it/is being ignored. At the moment, the "A Lot" answer isn't helpful without seeing how quick they are dealt with, and how many are coming in.
If you send a trouble ticket or an email to steam talking about an issue you need help with, there is no send back for an accurate gauge of how many people above you are. So to ask FA staff to keep further track of needless information, you're further putting a burden on the process.
They aren't going to go through and literally count and put people on a queue and organize it that way for you to gauge. Again, it's unrealistic to expect anything other than "industry standard" and industry standard dictates all that's needed is a "there are a lot of emails coming in about this topic, we have a team looking at the emails and responding in a reasonable manner. Sorry for the inconvenience."
In a business standpoint, putting a timeline of events on things like this typically goes poorly. You have to now put people on a schedule you have to maintain WHILE a massive amount of work is constantly coming in. So now your attention is divided. Not only that, but the people on the list would expect, obviously, to be helped according to that timeline and that's not always doable.
Hell even working at an AMUSEMENT park when a ride shut down for whatever reason, we weren't allowed to give specifics. All it does is put limitations and actually provides MORE of a reason for people to be upset and not LESS. The only thing we were allowed to do is reassure them the ride would be back up momnetarily. We weren't' allowed to give a time or an estimate even if one is known.
And in response to twitter, okay, nix twitter completely, the simple number of people in THIS JOURNAL alone having the same issue, common sense would dictate that there are a lot MORE folks out there with the same problem if this amount of folks are already here having issue. So by this journal ALONE you can already see there are a number of people already waiting and maybe there is a big enough volume. That's enough in and of itself to realize maybe I should consider this when asking for a ETA.
People SHOULD just realize there are only SO MANY people working on it and use common sense to judge the fact, maybe their email would take a little extra time to get noticed. Not have FA admins dedicate more time to tallies, a VERY VERY tentative ETA, and a daily update to say the same thing everyone has been saying over and over again in the journal. That's inefficient and unnecessary extra work when all hands are already probably busy.
We appreciate your patience!
Please... help me get it back
My account: http://www.furaffinity.net/user/nig.....hubbygiratina/
You'll get a reply as soon as they reach you in line.
IE:
account name changes
Ability to hide all comments posted, or at least find them.
ability to remove all their shouts, or at least find them.
You'll get a reply as soon as they reach you in line.
Is there an autoreply set up for these users so that they see that their message reached the proper destination and is being worked on, or do they just have to wonder for a week or more if the mail actually reached the staff? If there isn't one, I'd say that one might help ease their concern.
There is also a concern that large numbers of identical emails reaching a mail server from the same address may result in the sender email being flagged as a spam source by that mail server, which would be a complication that we (naturally) wish to avoid.
I currently have 13 non-existent notifications and that number grows every time someone adds a new submission. To be honest I can't help but think FA's counter has always been broken.
Personally, I still have not received one notifying me (Not that I haven't seen it here), yet I have almost daily come across people that didn't realize this happened. A simple gesture such as that (And one that might be legally necessary to do) might help thousands of people protect their other accounts that might have the same passwords and names associated with them. Moreover, it would quickly show you how many accounts don't have a valid email address.
This is a very small task that could prevent further financial losses and personal exposure of the user base. It is something that likely should have happened in the first days that we were aware of a data loss.
As always, continued luck with the work you're doing.
It's almost as if you guys should have I don't know... been fucking fixing stuff from the begging and not just sit complacent because "they always come back" instead of letting huge fuck ups like this get this bad?
Is this something you're able to do? I understand if it may take some more time to get back to me officially via e-mail or the ticket I sent, but would like to know if my problem is resolvable.
I put in my password and it said username and password is invalid, and I can't recover it with my email so It made me redo a new account. -__-
Im trying to get back my primary account and made this one for the sole purpose of accessing the site till i do.
He's said he's seriously considering leaving this site, and as much as i enjoy the site I'm starting to wonder if staying is the best to do, just hesitant to lose friends. Im not real big on social media so I avoid it, this is as social as i get online lol
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. You will get a reply as soon as they reach you in line.
It's going to be almost a week and a half since i send you guys the e-mail for my password reset, I really need to get back to it, im losing business :(
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. You will get a reply as soon as they reach you in line.
Not sure if you were busy or if Hotmail was throwing away emails from FA I tried to sign up with this account (fwopdejay2) using my same Hotmail account. I got to the part where FA emails me an activation link that I have to click, but I never receive that email either! It's like my Hotmail is completely blocking all FA email. I *AM* able to send and receive emails from other art websites just fine, it's only FA that I can't receive any email from.
Something is severely broken with Hotmail and FA. I've sent an email from my Hotmail to both FA and my Gmail. Can you please just change my registered email for fwopdejay to Gmail? I'm fed up with Hotmail.
I have sent an email to the accoutn thing a while ago and I have yet to recieve anything..
I even forgot what I was actually going to write.
...
Oh well!
Honestly, why didn't you all implement a 'security question(s)' feature?! That would have seriously saved what looks like TONS of us the hassle!
Please do not send multiple emails, as that will only serve to slow down the overall process of the account recoveries.
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. You will get a reply as soon as they reach you in line.
Maybe.
I mean : If i send a mail to accounts[at]furaffinity.net , will i using Gmail better than Hotmail?
damn yo
I SENT TWO EMAILS NOTHING >U
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. You will get a reply as soon as they reach you in line.
FA cannot be trusted as the custodian of my art.
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. You will get a reply as soon as they reach you in line.
I'm sorry we can't give you a more precise answer than that, but due to the uneven inflow of emails, it's really not possible to make any estimates at this time.
This will probably get lost as well in the mountain of requests and complaints, but I cannot sit and watch as my mate continues to be kept from making an income. He has taken commissions here since 2011 and this has become his main audience. He sent an email to the address listed above on May 23 and has since continued to try the reset password feature dozens of times. No response from you all, no way to access his following, and no way for him to pay rent. Thanks to you all I just used my entire paycheck to pay for our rent and we will be eating ramen noodles and crackers every day three times a day for the next two weeks.
Please, for the love of god, make this right. I cannot support us both financially with my income. A week and a half response time is too long and you know it. Thank you in advance for your time and consideration in reinstating my boyfriend's account.
He is
Sincerely,
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. He will get a reply as soon as they reach him in line.
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. You will get a reply as soon as they reach you in line.
That's odd I managed to get mine back within 5 minutes of requesting it.
Ahh well it seems at least not much harm was done. Could have sabotaged the whole site but decided not to for some reason.
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. He will get a reply as soon as they reach him in line.
Fired off an E-mail a week ago, then a few days later, and again not too long ago.
Hope someone's checking their inbox,
I get they must be swamped, but damn.
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. You will get a reply as soon as they reach you in line.
For you who are still waiting: They will contact you ASAP, they just have truckload of email right now.
For me it took 9 days.
They are working through and will get to you eventually.
Hopefully that means I get a reply sometime in the next couple of days.. x.x
Many people probably ask; "why in the hell, you registered, a new account and not use old account, with the new password"? Well, I do this for a reason, and it is very serious. You see, my old account, was registered on a very old e-mail. And I cannot see my emails, because, a year ago this old e-mail, has been stolen by hackers (reason: weak password). I thought about to change the e-mail to my old account, but I could not have imagined that this website will crash so suddenly, so I really missed this moment. And this really...really sucks =(.
I'll try not to get upset because of this loss, and move on, but it's still unpleasant and awful.
I had to create a new acount using the same e-mail
this its my acount
http://www.furaffinity.net/user/raush/
So I finally got access to my account again, but I can't submit any art.
Staff is currently working hard to respond to emails as soon as possible, but due to the very large amount of account recovery requests received, they've still got quite a few to get through. You will get a reply as soon as they reach you in line.
I can wait for weeks well understand there are just really a lot of inquiries and unfortunately some many write more than one.
Thanks again
I was able to get my account back due to the help of the admins. I'm really thankful for this ^^
But I'd like to make a suggestion: I personally think that the logon process should be changed to a not Username/Password based authentication. The best thing would be an email and password authentication. The problem is, that the E-Mail isn't used anywhere for the whole Site except for the password recovery. It's a good thing that you're not using it for Newsletters or daily notifications or similiar things. But with the time, you simply forget that you even have an email assigned to this account. An other option would be, to show a notification on the page every 1-3 months, but I think it should be easier to change the authentication process.
Now I got nowhere to send a password change request and there's no way I can update my password.