jefferey

Does this latest hash list hacking have anyone else worried? For those of you that don't know what I'm talking about, a hash list was released on [removed] that included peoples' usernames, passwords, pin, email, and birthday, and word got out and spread to the premium Neopets message boards.


I was told that this list could have been acquired by directly hacking into the neopets server. Because TNT refuses to use hashed passwords, anyone that has access to the database can see what our passwords are. The industry standard is to have passwords with a one-way encryption so that even if someone were to gain access to their servers, they would just see a bunch of mumbo jumbo where the passwords are stored. I was told that Neopets does not do this, and it makes sense because they tell you what your own password is when you request it. Out of the millions of websites out there, I don't know any other websites that tell you what your current password is, they only let you reset it if you have forgotten it. But neopets tells you directly what it is, which I always thought was a big security threat.

At any rate, does anyone know if we are safe from these hash lists, or how they work? I don't feel too safe with my account at the moment and would feel better if someone knew how these were obtained (if it was from hacking neopets.com or if people were just careless with their passwords or what..)




UPDATE: I was reading the hacking forums for some safety tips and came across a guide that "teaches how to protect yourself from fellow hackers." I thought I'd share it, since this information is especially useful. I only picked out the information that might not have been very obvious.


Credit goes to Sneakz on [removed].

Pick a VERY random password, one with a random combo of letters (both lower case and upper case), numbers, and symbols.
This may sounds very obvious, because most sites recommend this upon signup. [/size]
This is important mainly because of hash lists. If you have ever purchased a hash list, you have likely come across hashes that you cannot find in an online database. This is because they have not been decoded yet. The more unique your password is, the less likely it is that it will be easily cracked if you happen to end up on a hash list.[/size]
Do not even use a real word or name. Make it completely random. Like this: aer38yr&*3r [/size]
Keep it somewhere safe so you don't forget it.[/size]

Change your pin often
Let's say someone was able to get your password and you haven't had the chance to change it in a while. If your account is pinned, it is very likely that the hacker is working on cracking your pin. If he is doing it himself and he is not Demo, it will probably take him a while and he has probably been trying different combos. Keep changing your pin, this will throw them off. If the hacker paid Demo or another pin-cracking pro to crack it, you probably won't realize until it's too late.[/size]

Pin your email change
MAKE SURE IT IS PINNED. It may sound like a no brainer, but it's really surprising how many active players with millions do not think to pin their email change option, or they assume it's already pinned. You have to go to the pin preferences page and check the box. It is not automatically pinned for you. Double check this.[/size]

Use fake answers for secret questions
Go to your email account, find your account preferences, and review your password recovery options. If you are using secret questions, don't use questions like "What is my birthday?" or "What is my best friend's name?" These kinds of questions can be answered by doing a simple Google search. It is not uncommon for a hacker to look you up to find answers to your secret questions. It is extremely easy to find answers to these kinds of questions simply by finding your Facebook account.[/size]
My best suggestion is to use fake answers and write them down somewhere or keep them safe so you remember. That way other people won't be able to find these answers by stalking you.[/size]

Use a secondary email
Another option in addition to using secret questions is to use the secondary email feature that many email providers offer. Use a secondary email (WHICH HAS A DIFFERENT PASSWORD, REMEMBER?) to which you can email a reset link in the event you forget your password. Using this combined with the secret questions gives you max security for your email.[/size]

Don't sign up for other sites using the same email. << This one is especially important
Again, because of the possibility of ending up on a hash list, avoid signing up for other sites with your Neopets email. The best way to keep your Neopets account safe is to keep your email completely unknown, that way other people can't even ATTEMPT to get into it because they don't know what it is. Leave a false trail.[/size]



This post has been edited by a member of staff (hrtbrk) because of a violation of the forum rules.
Do not mention potentially dangerous sites. These have been removed.
Please check your user inbox to see if you have been contacted regarding this incident, then review our rules.

No offense or anything, but this really is pointless. TNT will make their own decisions based on what they think is going on, a petition wont make any difference to your case and may just end up annoying them.
 
I really hope you get your account back but you really should just wait patiently like everyone else who gets iced x