Database Breach - An Update

[deathdragon8547]

"but right now we're leaning towards Google Authenticator that will allow you to generate secure codes from your smart phones)"

 

I don't have a cell phone, let alone a smart phone....

[VoidsShadow]

http://i.imgur.com/NY5OPT1.gif Edited December 9, 2015 by VoidsShadow

[AndrewBlane]

In response to post #31737390.

deathdragon8547 wrote: "but right now we're leaning towards Google Authenticator that will allow you to generate secure codes from your smart phones)"

I don't have a cell phone, let alone a smart phone....

A very good point. For a long time, niether did I (untill teh jobcentre told me that it was essential for getting a job)

I hate it when places do this.

[SirSalami]

In response to post #31726705. #31727240 is also a reply to the same post.

lcars84 wrote:

I tried to change my password multiple times but when I submit the new password, it sends me to a login form while I'm stilled logged in and doesn't let me change the password.

 

I'm also redirected between secure and unsecure connections and those don't share the session cookie so I end up being logged out.

 

I don't have this problem with any other site but this one so I'm gonna assume that you have more problems than "just" a stolen database.

ZedLeppelin wrote: I had zero problems changing my password. If you can't manage it via your account profile, then log out, and instead of logging back in, use the "Forgotten your password?" link to reset it that way. Good luck!

Are you using any sort of cookie manager by chance?

[NeoH4x0r]

 

In response to post #31709715.

 

 

 

slakmoh wrote: So what if people who have had their information taken don't see this post? Why did I have to hear about this on another site instead of receiving an email saying I should change my password??

Because sending an email to 10 million people would take us about 6-12 months, and have us flagged in every SPAM database on the planet. It's likely by the time the script got around to your email being sent, you wouldn't have even received it.

 

 

I was watching TheTech Guy on Twit.tv with Leo Laporte

He suggested using Mail Chimp for sending out mass emails to users (http://mailchimp.com/).

The problem -- that the caller had --

Was how do they send out newsletters to multiple users (without getting flagged as a spammer)? He was using Gmail to do it.

 

-- this might be something to take a look at if you have to email a lot of people on the site.

 

PS: they have a free service: Up to 2,000 subscribers and 12,000 emails per month

If you wanted to send more than that -- you could look at their pricing.

 

However, for the purpose of emailing users to recommend a password reset -- you might be able to try the free service for emailing every once in a while

[DamianWayne]

In response to post #31737390. #31742135 is also a reply to the same post.

deathdragon8547 wrote: "but right now we're leaning towards Google Authenticator that will allow you to generate secure codes from your smart phones)"

I don't have a cell phone, let alone a smart phone....

AndrewBlane wrote: A very good point. For a long time, niether did I (untill teh jobcentre told me that it was essential for getting a job)

I hate it when places do this.

Then you have bigger problems than worrying about your Nexus account. It's 2015, and even if you're a luddite, having a phone has become a social and workplace necessity. Maybe get on that.

[Dark0ne]

In response to post #31737390. #31742135, #31743025 are all replies on the same post.

deathdragon8547 wrote: "but right now we're leaning towards Google Authenticator that will allow you to generate secure codes from your smart phones)"

I don't have a cell phone, let alone a smart phone....

AndrewBlane wrote: A very good point. For a long time, niether did I (untill teh jobcentre told me that it was essential for getting a job)

I hate it when places do this.

DamianWayne wrote: Then you have bigger problems than worrying about your Nexus account. It's 2015, and even if you're a luddite, having a phone has become a social and workplace necessity. Maybe get on that.

2FA is completely optional anyway.

[EntropyAdept]

Thank you for your swift actions in both tracking down the facts and notifying your users even when the matter was still uncertain. An open and honest admission of the known facts and what you were doing and considering to address the potential breach is the best way to maintain customer confidence. I wish more companies would follow examples like yours in dealing with security breaches.

[xenonblade]

In response to post #31699195. #31709590, #31710865, #31717215, #31727420, #31727725, #31727755, #31735675, #31736475, #31737125 are all replies on the same post.

rickman wrote: If you are reading this Robin, know this: the community is supportive BECAUSE you share this stuff outright, clearly, and with incredible haste. If you treated us like Sony did in December of 2012, knowing the problem and denying it for two weeks or more, we'd probably be a lot less kind. There is also this to consider: You told us EXACTLY what, who, when, and how, as soon as you could, and in plain, simple terminology. I (and most likely about 10,000,000 others) appreciate a straightforward answer when there is an issue. But MOST IMPORTANTLY, you are kind and humble about it. If someone was mad at the employees of Nexus after your immaculate behavior, They are clearly not the kind of individual that we should be associated with as a user base. I personally love this site for a myriad of reasons, to explain it would take a ten+ page essay to enumerate all of the reasons why. To be clear though, the biggest reason, THE STAFF TREATS THE USER BASE LIKE PEOPLE. Despite there being 10,000,000 of us, we don't feel like faceless numbers. And that is because you seem to CARE. Don't stop doing that, and this awesome community will probably never devolve.

Thank you for being the best you can be.
Richard.

JZSquared wrote: ^This sums up my feelings exactly. I couldn't have said it better myself.

Lokie7 wrote: I second this, entirely. Well said.

Netsplite wrote: ^ +1

ZedLeppelin wrote: A wee bit verbose, (and I know verbose!), but rather well said and pretty damn accurate. The Nexus staff treats people like people, not numbers.

Inboundwhisper wrote: +1

Inboundwhisper wrote: +1

Aricole wrote: +1

lordmanticore wrote: +1

btgbullseye wrote: +1

+1

[AlexZander40]

In response to post #31699195. #31709590, #31710865, #31717215, #31727420, #31727725, #31727755, #31735675, #31736475, #31737125, #31745975 are all replies on the same post.

rickman wrote: If you are reading this Robin, know this: the community is supportive BECAUSE you share this stuff outright, clearly, and with incredible haste. If you treated us like Sony did in December of 2012, knowing the problem and denying it for two weeks or more, we'd probably be a lot less kind. There is also this to consider: You told us EXACTLY what, who, when, and how, as soon as you could, and in plain, simple terminology. I (and most likely about 10,000,000 others) appreciate a straightforward answer when there is an issue. But MOST IMPORTANTLY, you are kind and humble about it. If someone was mad at the employees of Nexus after your immaculate behavior, They are clearly not the kind of individual that we should be associated with as a user base. I personally love this site for a myriad of reasons, to explain it would take a ten+ page essay to enumerate all of the reasons why. To be clear though, the biggest reason, THE STAFF TREATS THE USER BASE LIKE PEOPLE. Despite there being 10,000,000 of us, we don't feel like faceless numbers. And that is because you seem to CARE. Don't stop doing that, and this awesome community will probably never devolve.

Thank you for being the best you can be.
Richard.

JZSquared wrote: ^This sums up my feelings exactly. I couldn't have said it better myself.

Lokie7 wrote: I second this, entirely. Well said.

Netsplite wrote: ^ +1

ZedLeppelin wrote: A wee bit verbose, (and I know verbose!), but rather well said and pretty damn accurate. The Nexus staff treats people like people, not numbers.

Inboundwhisper wrote: +1

Inboundwhisper wrote: +1

Aricole wrote: +1

lordmanticore wrote: +1

btgbullseye wrote: +1

xenonblade wrote: +1

Well said. May the modding goodness continue.