Ubuntu forums hacked

&gt;The passwords are not stored in plain text. However, if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP.<p>Translation: the passwords were stored using dumb MD5&#x2F;SHA1. Seriously, it&#x27;s 2013, why can&#x27;t 99% of the web get their act together when it comes to password hashing?

It&#x27;s an opportunity to finally kill it off and stop polluting google results.

This is how much effort it takes to have a BCrypt (strong, slow, salted hash) database user system in Spring (not that they used Spring):<p><pre><code> &lt;http auto-config=&#x27;true&#x27;&gt; &lt;intercept-url pattern=&quot;&#x2F;**&quot; access=&quot;ROLE_USER&quot; &#x2F;&gt; &lt;&#x2F;http&gt; &lt;beans:bean class=&quot;org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder&quot; id=&quot;passwordEncoder&quot; &#x2F;&gt; &lt;authentication-manager&gt; &lt;authentication-provider&gt; &lt;jdbc-user-service data-source-ref=&quot;dataSource&quot; &#x2F;&gt; &lt;password-encoder ref=&quot;passwordEncoder&quot; &#x2F;&gt; &lt;&#x2F;authentication-provider&gt; &lt;&#x2F;authentication-manager&gt; </code></pre> StackExchange&#x27;s AskUbuntu.com is pretty good, as you can use OpenId, and if someone (illegally) hacks Google we are all fucked anways.

That&#x27;d be the admin panel on their vbulletin installation which has been publicly facing for more than a year.

vBulletin is (and always has been) terribly insecure. Only way to beef up security is to lock down admin panels, e.g. IP-restrict them.

So far they are handling this better than Apple.

ubuntuforums.org timing out as of now but are we sure this is a malicious attack and not simply downtime?<p>If it is an attack, it just means a time bandit for the admins I suppose...

So are they going to email their user base to warn them to change their passwords? I thought I had an account at some point and I didn&#x27;t get an email.

aren&#x27;t ubuntu forums based on <a href="http://moinmo.in" rel="nofollow">http:&#x2F;&#x2F;moinmo.in</a>?