Ubuntu Forums Hacked - Do you have an account there!

[Zill]

...sometimes you just can't beat a pen and paper

Except that good passwords should consist of a random mix of upper and lower case letters, numbers and other characters. These are very difficult to write accurately by hand on paper and then to transcribe into a computer. A paper notebook can also be lost or damaged. Copy/paste from a secure password manager that is also backed up regularly is, IMHO, a far better solution.

[colyn]

Ubuntu forums, the most unfriendly place on the internet.
No sympathy.

I take it you haven't been on many forums. I find Ubuntu Forums one of the most friendly places on the 'net.

~nilla

I would have to disagree with you. I've had an account on Ubuntu forums for several years and find it to be the most unfriendly of all the forums I am a member of..

[emperor_aniseed]

Funnily enough my account here and there had the same password (now changed).

Note to the mods: Haven't posted anything here in the last couple of months.

The Ubuntuforums are ok but as part of Canonical's marketing are excessively "managed". For example, why does a recurring topic have to be put to one side? All of life's best themes are recurring: love, sex, food, sunshine, music, dancing, smiles etc. And do posts of the kind "I really like Ubuntu and it's the best" get moved to recurring topics?

But anyway, let Ubuntu decide what's best for Ubuntu.

Shame about people's data.

[Condorman]

I have an account there, but I use a random password generator (KeePassX 0.4.3) and the password is only for that forum. I guess they still have my email though right?

I haven't received anything nasty yet, but I imagine there's time.

[KBD47]

Just curious, is there any damage they could do with our emails beyond sending spam?

[Spearmint2]

http://ubuntuforums.org/announce.html

Ubuntu Forums is down for maintenance

There has been a security breach on the Ubuntu Forums. The Canonical IS team is working hard as we speak to restore normal operations. This page will be updated with progress reports.
What we know

Unfortunately the attackers have gotten every user's local username, password, and email address from the Ubuntu Forums database.
The passwords are not stored in plain text, they are stored as salted hashes. However, if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP.
Ubuntu One, Launchpad and other Ubuntu/Canonical services are NOT affected by the breach.

Progress report

2013-07-20 2011UTC: Reports of defacement
2013-07-20 2015UTC: Site taken down, this splash page put in place while investigation continues.
2013-07-21: we believe the root cause of the breach has been identified. We are currently reinstalling the forums software from scratch. No data (posts, private messages etc.) will be lost as part of this process.
2013-07-22: work on reinstalling the forums continues.

If you're using Ubuntu and need technical support please see the following page for support:

Finding Help.

If you're looking for a place to discuss Ubuntu, in the meantime we encourage you to check out these sites:

The Ubuntu subreddit
The Ubuntu Community on Google+
Ubuntu Discourse

[Lin Jones]

I am a member there but I can't remember the last time I visited there. I use Lastpass to store my passwords and I usually pick something different for every forum, so I am good.

[Simtech68]

I usually have a separate email that I use for forums/online orders/etc so I really don't care if my *crappy*( I have a more colorful name for it though ) yahoo acct. gets spammed or hacked, I'll just close it down and start another. I usually keep a good password for most things but I have been lazy too. People just have to remember what they are passwording, it's like buying a lock. If it's valuable buy a good lock, i.e. online banking/credit card accts, you better think about a good password. An online forum that you are just checking out maybe not so much.

[MALsPa]

Ubuntu Discourse

This looks kinda nice. Just joined up today. Anybody else have an account over there? http://ubuntu-discourse.org/

[Bolle1961]

And they're back online

[KBD47]

Be careful or you will lose all your old account connection:
http://ubuntuforums.org/showthread.php?t=2164051
I logged in with my Ubuntu One account, not realizing my emails were different from the old forum one--wiped out Old account is gone.

[sammiev]

Did not lose a thing.

[KBD47]

Even after changing my Ubuntu One email to my old Forum email I can't get the old account back. Seems others having this issue as well. The Ubuntu Forum gave me a new ID and seems can't be changed, is greyed out on the settings. Probably has to be done manually as appears to be the case with a number of posters.

[Zill]

Did not lose a thing.

Same here - but I do use the same email address for Ubuntu Forums and Ubuntu One.

[craig10x]

Yeah...i think that was the "key"....if you used the same e-mail on ubuntu one as you did in ubuntu forums, then you retained your original information in the forums...

I registered with ubuntu one right before re-logging into the new security at the forums and used the SAME e-mail and once i was in the forums, all information was retained...I even changed my password before going into the forum (i used the "forgot your password" to reset it) and it didn't affect it at all...

So, as i said, seems the key was using the same e-mail on ubuntu one as you had in the forum...

[karlchen]

Hello, KBD47.

I logged in with my Ubuntu One account, not realizing my emails were different from the old forum one--wiped out Old account is gone.

No, calm down. You have not lost anything.
The original account, its profile and all posts are still there. Just search for them.
The problem is simply this:

Provided you logon to UbuntuOne using the same e-mail address that had been stored in your Ubuntu forum userprofile, then UbuntuOne and the forum software will recognize the e-mail address and (re-)associate your old forum account name with your current UbuntuOne logon name (e-mail address) and you will be logged on to the Ubuntu forum with your old account.

In case, however, you logon to UbuntuOne using the an e-mail address that is different from the e-mail address that had been stored in your Ubuntu forum userprofile, the forum will not recognize you and create a new forum user account and assign it an unpronounceable nickname. Yet the old account is still present.

In order to solve this problem and re-gain access to your old forum account, you will have to explain the situation to the moderators and ask them to associate your old account with the new UbuntuOne account.

As they may have received hundreds of such requests you may have to be patient. Also I cannot tell which steps you may have to take in order to convince them that your request is legitimate and that you are not trying to hijack someone else's account.

Kind regards,
Karl

[craig10x]

@Karl: Couldn't he just change his ubuntu one account e-mail to the same one as he used in the ubuntu forums, and then log on to the forums?
That would seem to be the easiest way to go...

I never had an ubuntu one account, so going in i kind of figured i should use the same e-mail as i had on the forums to insure that the forums would recognize my old account and it's information...and it worked...

[MALsPa]

Did not lose a thing.

Same here - but I do use the same email address for Ubuntu Forums and Ubuntu One.

I didn't lose anything, either, but I feel like I got lucky. I didn't realize that I already had a Ubuntu One account until I got the message saying that I couldn't use "this email address" when I was trying to create a new account. I guess it was because I used to use ShipIt -- now I've found an old note of mine about "Launchpad (for ShipIt)". Anyway, so I did the password reset thing. In the end, everything worked out.

What a mess.

The cool thing is that because of the Ubuntu forums being down, I now have an account at Discourse. Another place to pop in at.

[KBD47]

Thanks guys. Appears it has to be changed manually by the mods if the emails are not aligned on the first go around. Changing the email won't work after first login because by then they have tied a new user ID to you and it's greyed out and can't be changed, except manually, after the fact. I'm thinking there was an easier way for them to do this, but it appears vbulletin is easy to hack so they had to use Ubuntu SSO. Hopefully that one stays secure because with Ubuntu One many people, including me, having credit card info tied to their Ubuntu One account.

[mike acker]

Did not lose a thing.

Same here - but I do use the same email address for Ubuntu Forums and Ubuntu One.

I didn't lose anything, either, but I feel like I got lucky. I didn't realize that I already had a Ubuntu One account until I got the message saying that I couldn't use "this email address" when I was trying to create a new account. I guess it was because I used to use ShipIt -- now I've found an old note of mine about "Launchpad (for ShipIt)". Anyway, so I did the password reset thing. In the end, everything worked out.

What a mess.

The cool thing is that because of the Ubuntu forums being down, I now have an account at Discourse. Another place to pop in at.

2d the mess. they forced me to accept Single Signon, using the same signon for Ubuntu1 and for the BBS. This is poor practice as we know so I told them to deactivate my accounts.