11 replies to this topic

[HighwayStar]

Quote

04/26/2012 2:13pm ET: Forums closed for maintenanceOn April 26th at approximately 11:20 AM pacific time, the Two Plus Two Forums were closed as a result of a hacker who has displayed the ability to access e-mail addresses and encrypted passwords. He also indicated the ability to decrypt passwords.While it is unclear the extent of data to which he gained access, e-mail addresses and passwords on the Two Plus Two forums should be considered compromised. If you have used your 2+2 password on any other site, you are advised to change it.For your security we are closing the forums until the breach is patched.We hope to be back up as soon as possible.

Useful article by NoahSDhttp://www.nsdpoker....acked/#more-823

[FCP Bob]

What hackers really hope is that your e-mail password is the same as one that they've hacked since getting control of your e-mail opens up all your other accounts using the lost password feature. Your e-mail password should be your most secure one possible.The longer your password is the better. My e-mail password is over 20 characters and contains upper and lower case as well as numbers and symbols.

[FCP Bob]

Brian Balsbaugh‏@BalsbaughHow much is the @twoplustwoforum email database worth in a US regulated online poker market? Way more than the @BellagioLV bandit boosted.

[Lrgetrout]

It couldn't happen to a nicer site ...(Sorry, I'll go get the mop for all the sarcasm I spilled.)

[Tehtoe]

Lrgetrout, on Thursday, April 26th, 2012, 9:00 PM, said:

It couldn't happen to a nicer site ...(Sorry, I'll go get the mop for all the sarcasm I spilled.)

lol!yeah bro 2p2 and all its members totally deserved this

[Lrgetrout]

Tehtoe, on Thursday, April 26th, 2012, 9:34 PM, said:

lol!yeah bro 2p2 and all its members totally deserved this

Meh, maybe not its members. But the management ...Luckily, my password there is unique to that site.

[DiamondDixie]

Well call me stupid, I'm sure some of you have, but of course my email password was the same as my 2p2 password. I fixed it of course and thank's to Noah's article I remembered to fix some stuff I would of forgotten. This really blows, I had done a "money swapping" to get some money off Merge with this guy and I was afraid at first that I had PM'd him my bank account information on 2p2 but I had done it on Skype and Part Time Poker, had to change those passwords too. I only use that bank account for poker so it doesn't have much in it, what a mess! Guess this is what 2p2 gets for treating Daniel badly.

[Pot Odds RAC]

I hate hackers.

[aucu]

FCP Bob, on Thursday, April 26th, 2012, 3:02 PM, said:

My e-mail password is over 20 characters and contains upper and lower case as well as numbers and symbols.

You win, mine is only 12 mixed charters.

[DanielNegreanu]

Don't worry guys, I just had to give the site a temp ban for being naughty :-)

[Pot Odds RAC]

Latest update from 2+2...

Quote

Given that this happened in spite of having applied all current security patches from the companies that provide our forum software, we are in the process of employing additional security experts to ensure that we are in compliance with the highest security measures possible.At this point in time we anticipate forum downtime to be within 4-6 days.

What does this say about security of other Forums - including this one?

[FCP Bob]

Pot Odds RAC, on Saturday, April 28th, 2012, 11:07 AM, said:

Latest update from 2+2...What does this say about security of other Forums - including this one?

Their server database must have been hacked and I can't know what exact security they had on that. We have a few extra security layers on the server side of thing over and above what the forum software provides.We also next week are upgrading to a brand new server and also upgrading our forum software to the newest version. The upgrades that we're doing have nothing to do with what happened at 2+2 and have been in the works for a few months.Basically the only information somebody could get if they hacked our database would be e-mail addresses, user names and encrypted passwords so if your passwords are unique and not the same everywhere you really aren't at any risk personally.