AnimeSuki Forum - View Single Post

***GHDpro*** · 2016-09-10, 13:58

Yes it is essential to never reuse passwords used on forums elsewhere.

The AnimeSuki Forums were hacked in 2014; another site I own was hacked in 2015.

The forum software we're running (vBulletin 3) is quite old but unfortunately upgrading isn't trivial due to the amount of modifications we've made.

I think they finally improved things in vBulletin 5, but older versions (so that includes this forum) use pathetically simple password hashing (MD5 with salt). This means that if somebody gets hold of the forum database and really wants to crack your password it's quite possible they may be able to pull it off (unless your password is insanely long gibberish).

So once again, never reuse passwords, especially the passwords you use on forums.

Also think about the complexity a bit: don't use very common passwords like "hello" or "12345". Also don't use anything that matches anything from your profile (if your username is "AnimeLover" don't pick a password that is "AnimeLover123").

2016-09-10, 13:58	Link #6
*GHDpro* Administrator Administrator Join Date: Jan 2001 Location: Netherlands Age: 45	Yes it is essential to never reuse passwords used on forums elsewhere. The AnimeSuki Forums were hacked in 2014; another site I own was hacked in 2015. The forum software we're running (vBulletin 3) is quite old but unfortunately upgrading isn't trivial due to the amount of modifications we've made. I think they finally improved things in vBulletin 5, but older versions (so that includes this forum) use pathetically simple password hashing (MD5 with salt). This means that if somebody gets hold of the forum database and really wants to crack your password it's quite possible they may be able to pull it off (unless your password is insanely long gibberish). So once again, never reuse passwords, especially the passwords you use on forums. Also think about the complexity a bit: don't use very common passwords like "hello" or "12345". Also don't use anything that matches anything from your profile (if your username is "AnimeLover" don't pick a password that is "AnimeLover123").