Suspicious

[unixronin]

So now cymrullewes has got the "We advise you to change your password now!" message I got the other day.  Seems like a hell of a LOT of people are getting it.

This leads me to wonder:  Is there something we should know, that LiveJournal isn't telling us...?  Did their registration database maybe get hacked, or something like that?

Comments

[ttocs.livejournal.com]

if you find out followup? I got one, but ignored it.

Password Standards

[adriang.livejournal.com]

I read a post in one of their announcement communities. They are trying to encourage people to use stronger passwords. In particular, passwords are not considered strong enough if they do not contain at least one number or symbol.

They say that, at some point, they will require that passwords which are not strong enough be changed. For the moment, they are only warning users.

I imagine they've always had occasional reports of people breaking into other people's accounts. I don't think they've had minimum password standards before, and I think they've decided it's time to start encouraging better passwords.

Adrian

Re: Password Standards

[yndy.livejournal.com]

Awhile back, they stopped allowing "new account" passwords to be based on dictionary words - even if numeric equivalents were used... like, say "b1cycl3" would trip the 'choose another password' script.

BUUUUT... there wasn't any mechanism at the time iirc, to alert users already using iffy passwords.

Still, I highly doubt that unixronin and cymrullewes are the type o' folks to use easily broken passwords...

I know I don't - but then, I haven't gotten an email yet.

Re: Password Standards

[cymrullewes.livejournal.com]

Wasn't an e-mail. I went to make a post with LogJam yesterday and a dialog popped up saying my password is too weak.

[jilara.livejournal.com]

LJ has been telling me my passwords suck for a long time Even with a number or two. It's because there is usually a real word in there, somewhere, even if it's unintentional.

Our system at work enforces "strong passwords" so my elaborite hard-to-decode passwords are no longer allowed. I've taken to using very easy to break, brain-dead algorythms, because for some reason the encryption system thinks those are just fine. (I was shocked, the first time it allowed me to use one, and I think I keep doing this out of horrified fascination.)

[olafthunderfoot.livejournal.com]

great point, i just changed my password!