WARNING: Compromised Accounts

[EEVblog]

There has been a recent spate of existing forum accounts being compromised by spam bots.
Presumably they had their details stolen and reused passwords?
So just a reminder to make your password unique and/or use the 2FA security feature.

[xrunner]

Yea I have seen a lot of them recently. Therefore I just set up 2FA here and the process was painless and worked. 

[KE5FX]

How does one brute-force a password?  Don't you lock the account out for X hours after Y unsuccessful attempts?

Usually, "brute forcing" a password involves a stolen password database file, potentially from some other site where the user with the same name used the same password.

[coppercone2]

the meat of our dead crew members is being turned into spammer-advertiser cyborgs

can the morgue be locked?

[MLXXXp]

and/or use the 2FA security feature.

Any chance support for FIDO hardware security keys for 2FA (Yubico, Google Titan, etc.) could be added?

[EEVblog]

How does one brute-force a password?  Don't you lock the account out for X hours after Y unsuccessful attempts?
Usually, "brute forcing" a password involves a stolen password database file, potentially from some other site where the user with the same name used the same password.

Yes, probably more likely to be the owner had their account compromised and shared a password.

[EEVblog]

and/or use the 2FA security feature.

Any chance support for FIDO hardware security keys for 2FA (Yubico, Google Titan, etc.) could be added?

If there is an SMF plugin that does that then I'm happy to install it, I use hardware keys myself. But last I looked there wasn't.

[coppercone2]

arent all these accounts long dormant?

[EEVblog]

arent all these accounts long dormant?

Haven't checked them all, but from what I've seen, not recent posters. But they were still active accounts with legit posts.

[CatalinaWOW]

Do you send notifications to those who have been compromised?

[Zoli]

I've checked(other forum, so is a widespread issue) some of the compromised e-mails: typically pawned in 10+ data breaches; add bad password hygiene in the mix, and you have the current situation.
Edit: since I've seen the spam posts(similar to the other location), I recommend to Dave, to use the forum censorship to change the *.site advertisement to something else(spam would be an idea).

[magic]

How does one brute-force a password?  Don't you lock the account out for X hours after Y unsuccessful attempts?

Usually, "brute forcing" a password involves a stolen password database file, potentially from some other site where the user with the same name used the same password.

"Brute forcing" means repeatedly trying random passwords without any idea which one could be right.

I tested this forum during the last wave of compromised account spam. A few failed login attempts lock the account for a few minutes and during this time even the correct password doesn't work. So true brute forcing is slow and unlikely to succeed.

These compromises are caused by using "well known" login/pw combinations, usually obtained from other hacked websites. If you know that some login had a particular password on another site, it's a no brainer to check if the same password also works here.

[jvmartins]

Can someone explain how to set 2FA in this forum?
My account was hacked, I managed to reset the password but now I want to include 2FA.

[Kean]

Can someone explain how to set 2FA in this forum?
My account was hacked, I managed to reset the password but now I want to include 2FA.

Visit https://www.eevblog.com/forum/profile/
Then go to menu Modify Profile, then Two-Step Authentication
I have it enabled already so I cannot tell you what you will see there, but it should be pretty straightforward to set up using an Authenticator app or email codes.

[EEVblog]

Can someone explain how to set 2FA in this forum?
My account was hacked, I managed to reset the password but now I want to include 2FA.

Visit https://www.eevblog.com/forum/profile/
Then go to menu Modify Profile, then Two-Step Authentication
I have it enabled already so I cannot tell you what you will see there, but it should be pretty straightforward to set up using an Authenticator app or email codes.

I've been using 2FA for years since I installed it, and it works great. Slightly annoying to enter the code every 30 days, but well worth the extra security.

[EEVblog]

Do you send notifications to those who have been compromised?

FYI
gnif has written a custom script that tries to detect compromised accounts and automatically locks them with a notice to the user to email me direct to get their account back.
I get a few emails a month from existing users that have had thier computer hacked or password compromised in some other way and it's been auto-detected.

For those unsure how this happens, rest assured the passwords are NOT being stolen from this forum, but they have had their data stolen from some other site or hack on their own computer, and people often reuse passwords on different sites.
They can often find out using:
https://haveibeenpwned.com/

[Halcyon]

I banned two manually today as well. Seems like another wave coming through.

[voltsandjolts]

For anyone who isn't sure how this 2FA works, here is my understanding:

When you sign-up for 2FA, a random seed code is generated by this forum and shared to your chosen authenticator app, via a QR code scan or manual entry. Thereafter, when you want to login, the authenticator app will generate a one-time-code based on that seed and the current time, using the math described in RFC 6238. The forum verifies the one-time-code using your seed and the current time.

You can use any authenticator app that supports RFC 6238. I already used the microsoft authenticator app for work stuff and found it works fine with 2FA on this forum. There are other options, such as Google Authenticator or Authy.

When you setup 2FA, you're given a 'backup code' that you can use to gain access if, say, you lose your phone. If that fails, contact the sys admins through email.

I was unsure at first, but now recommend it, it's super easy!

[EEVblog]

For anyone who isn't sure how this 2FA works, here is my understanding:

When you sign-up for 2FA, a random seed code is generated by this forum and shared to your chosen authenticator app, via a QR code scan or manual entry. Thereafter, when you want to login, the authenticator app will generate a one-time-code based on that seed and the current time, using the math described in RFC 6238. The forum verifies the one-time-code using your seed and the current time.

It should be noted that the forum can remember your login for 30 days before you have to use the authenticator app again.
I use Google Authenticator for the forum.

[MLXXXp]

There are other options, such as Google Authenticator or Authy.

When on a PC, I use KeePassXC.

I still wish that FIDO hardware security keys were supported. 

[Halcyon]

There are other options, such as Google Authenticator or Authy.

When on a PC, I use KeePassXC.

I still wish that FIDO hardware security keys were supported. 

You might want to consider Bitwarden. I was a Keepass user for many years, I now prefer Bitwarden as it's cross-platform and supports FIDO2 keys even on the free tier. (I pay for it, that's how much I like it.)

[MLXXXp]

I now prefer Bitwarden as it's cross-platform

KeePassXC is cross platform, as well.

and supports FIDO2 keys even on the free tier.

I meant I wish that the EEVblog forum supported FIDO keys, so I didn't even have to use KeePassXC, Google Authenticator, or any other TOTP generator for 2FA.