Linda King said:I’m changing my password and logging back in—the whole session is running over HTTP, while XenForo uses HTTPS. Besides, I searched Google for exploit lists targeting older versions of vBulletin, and frankly, it seems like this software is just child's play for anyone serious about hacking. Are they even releasing security patches for this version, or should we just update to the latest version immediately? I suspect you already know the answer. Newer software definitely provides regular patches. Plus, you mentioned two-factor authentication earlier; I just checked, and XenForo (2021) actually offers that option. It’s obvious you guys are in a tight spot, and it's not like you're the ones making the final call, so I get it. But there's no point in being foolish here; at least notify the users to beef up their passwords. It isn't a waste of time when we're dealing with a script like the one Jack Cook7 is talking about.
You make a valid point; they really ought to disable logins unless the password has been updated since this attack started.
The other day, I was greeted by a message on another local (much smaller) forum saying I couldn't log in until I changed my password. I suspect they are in the exact same situation we are. They use vBulletin too, specifically version 4.2.2, and they have the HTTP protocol issue as well. I'm not even a novice when it comes to cybersecurity, but honestly, I don't believe that little "s" is much of an obstacle for hackers. HTTPS is basically just there to make the job a tiny bit harder for amateur hackers. 🤷
As for how much more secure a monitor might be, I honestly can't say for sure, though it’s certainly more modern. But look, moving from one platform to another is entirely up to the owner. We users have zero influence over his decisions or how fast he pulls the trigger on a transition if he finally decides to make it happen.
Jack Cook7, I'll pass that info along.
coppersailor28 said:(it would be interesting to find out if user @Drelja1 was also one of those cases)
Yes. 😠
Alexander Diaz4 said:We don't, the forum is 100% secure.
Can we just Lock this, please?
Honestly, you are being exhausting. Your own bed in your bedroom isn't 100% secure, yet you expect absolute, guaranteed security on the internet? Anywhere on the web? Keep dreaming.
On a site like Reddit, getting your profile snatched back is an uphill battle. Once hackers swap out the verification email, you're basically locked out. You can't just magically reclaim a compromised email address.
I’ll say it again: you cannot simply revert a hijacked email. That is exactly why I emphasized securing your actual email account rather than obsessing over your forum handle and password.
For God's sake, even high-security servers holding critical data get breached constantly. Why is everyone acting so shocked that a random forum gets hit? The absolute worst a hacker can do here is grab some login credentials and go spamming elsewhere.
Apparently, this is a headache that a ton of other forums are dealing with too. Watch your email addresses. Use complex passwords, turn on two-factor authentication, and stay vigilant about all that.
Please, just tell me which browser you're using—are we talking desktop or mobile? Also, do you have any specific extensions for clearing cookies? Honestly, anything else you can think of wouldn't hurt at this point. And I'm assuming you didn't check that little box to stay logged in, right?
You’re asking for a change that simply isn't permitted, which was clearly emphasized in the opening post. Come up with something that actually resembles your current handle.
Full nickname changes aren't permitted here unless we're talking about those specific circumstances outlined in the very first post. That rule applies specifically to the two guys whose posts were deleted.
You could honestly bait Ariana Grande into a confrontation before the day after tomorrow—not even out of malice, just pure lack of information. Every single moderator on this sub needs to be in total agreement regarding her removal, just as they were when they decided to let her post in the first place.
Emily Myers8 said:Eeto, I'm just an idiot who doesn't get your desperate need for attention, which is why you keep posting totally random nonsense in different threads. No matter what topic you jump into, you immediately start venting your frustrations about the forum. Just chill out.[/I]
Having power is the one thing you shouldn't brag about. Again, you're saying that I'm just rambling. Give me an actual example of when I'm rambling; maybe I just don't get it and can explain myself.
The stuff about JPMorgan Chase was just a response to your specific post here
The Visa team is basically working two people for the price of one. The pay is so low that anyone who can leave does, and the new kids who fall for those sweet-sounding job ads end up quitting after just a few months. Yeah, be happy the app even works. Don't go asking for decent error messages yet.
That was your post, so my comment was just a reaction to it. Your message was basically "stay away from JPMorgan Chase," right? Or did I miss the point?
Pzec, trying to explain anything to you is a complete waste of breath. Your comments rarely touch on the actual subject at hand, serving instead as nothing more than vehicles for your own personal agenda. And naturally, in your eyes, I’m wrong and incapable of understanding you. Does anyone actually listen to your pathetic ramblings?
That’s a rhetorical question. You aren't the topic here, even though you go to extreme lengths to hijack it. Get lost.
pzec, here is your contribution to the mobile technology PDF regarding the topic of Visa mobile banking.
pzec said:It’s pretty obvious there is some decent cooperation going on between the Visa team and the crew running this forum. We should just be grateful we can even access the forum at all; if we start demanding more, they might start charging us a fee just like JPMorgan Chase does. For now, this place stays alive thanks to people who, out of pure gratitude that it even exists, donate their time and expertise to the owner—hoping they'll eventually get paid or not, which sounds like the exact situation with the interns over at JPMorgan Chase that Casey Bennett described. Regarding security on the forum https://support.microsoft.com/en-us/...d-28224a13a5d2
Look, I'm clearly the idiot here who doesn't grasp your massive craving for attention, which is so intense that you end up posting complete nonsense in totally unrelated threads. No matter which topic you stumble into, you immediately start ranting about your frustrations with this forum. Get it together and stop ruining discussions for everyone else. At least not in this space.
We’re making an effort to strip out all those digits when updating usernames, but honestly, it seems like every single combination I can think of is already taken. Come on, try to come up with something similar to your current handle—just without the numbers—that isn't already snagged by someone else. If you can't pull it off, we'll just stick with this 🙂
If we’re actually going to use analogies, this whole situation is like some lunatic breaking into a Home Depot every single day demanding a stuffed unicorn, taping pictures of stuffed unicorns all over the aisles, and picking fights with the managers and customers who try to tell him that a hardware store isn't where you find plush toys—all while stubbornly refusing to leave until everyone concedes that the stuffed unicorn absolutely belongs there and that anyone saying otherwise is lying.
So, after days of relentless arguing and explaining that a Home Depot is not a toy store, and that they don't carry unicorns and never will as long as the sign on the door says "Home Depot," the staff finally hit their breaking point. They essentially kicked that unicorn-obsessed maniac out the door, sent him straight to the nearest Toys "R" Us, and banned him from ever stepping foot near a hardware store again.