Forced Password Reset

[kittyray]

(you need an account to see links).

Looks like TNT is forcing everybody to reset their passwords.

August 2022 Update: Neopets is becoming a safer place! All Neopians are required to rest their password to help keep their accounts secure.

Hopefully I have good records for the email addresses for some of my less-used alts, but godspeed everybody!

Honestly this is really good news, but I know it's going to cause some havoc for those of us who have a lot.


[edit]

Going great so far!


[edit2]
They made a statement on (you need an account to see links)/(you need an account to see links).

Neopians:
We wanted to take a moment to provide you with an update since our update on July 20th.
As we previously communicated, Neopets was alerted on July 20th to activity indicating unauthorized access by a third party to portions of our IT systems. Upon investigation, we took immediate steps to shut down further access to the affected systems and we have not seen any unauthorized activity since that time.
We reported the event to law enforcement, and began working with external cybersecurity experts to investigate the event and determine what happened and what data was impacted. As a matter of course, we do not collect or store payment information and do not have evidence that it was impacted. Once the investigation has concluded, we will share additional information, as appropriate.
Our team is working around the clock, deploying additional safeguards onto our systems, including enhancing monitoring of our systems, reinforcing our security practices, and actively reviewing systems to enhance security controls and all security protocols. As a reminder, neither Neopets or its employees will ever ask for your login information. As a precaution, we are taking steps to protect users’ accounts, so when you next visit Neopets, you will be prompted to change your password. We are also currently working on adding multi-factor authentication to better safeguard your account access.
We appreciate your understanding and patience during this event and are committed to supporting the Neopets community. We invite you to reach out to us through our normal support channels with any questions or concerns you might have regarding this incident or the security of your account.

[edit3]

If you were not logged in to an account at the time of the forced logout/reset, you may be able to log in still with your old password. I would quickly try to log in to as many of your accounts as you can with their current passwords and change them/note them down/make sure you know the email as soon as possible before TNT starts to force resets on every account, logged in or not!

I was able to log in to my sides just fine to change them without being told my password is incorrect. My main account I was logged in to was logged out and forced to reset the password, though.

This has worked for me so far. If you're logged into an account you are unsure if you have the email for, try opening a private window and logging in again. This can give you a chance to make note of emails/update it.

[edit3B] I just tried to update the email on an account and I got redirected to to the password reset, if you try this, approach with caution.

[edit4]
It seems in general this whole system is super buggy. I've seen a lot of reports of people being unable to reset, being forced to reset multiple times, getting wrong passwords, et cetera. I think at this point all we can do is wait it out a bit and hope for the best, for all of our accounts legit or not.


[edit5]
(you need an account to see links)

UPDATE, 4:00 PM NST: Forced password updates have been paused. No official announcement by TNT yet, so it's unknown why they paused the forced resets, or if they'll bring them back. If you haven't visited Neopets yet today, you won't need to reset your password to get in. If you already tried resetting (and ran into issues), give your old password a shot.

[edit6]
This situation is still ongoing but I'm not going to be able to constantly update this, so I do suggest keeping an eye on (you need an account to see links). Obviously it won't have any specific details/advice as it pertains to those of us with many accounts/alts/shells, but it's still all good information. I'll try to keep this updated with anything big and feel free to ping me if there's something you think I should add.

I will copy their warning about password resetting as I feel it's pretty important.

WARNING: Neopets passwords are limited to 20 characters. If you set a password longer than 20 characters, you'll become locked out of your account as the coding can't handle more than 20.

WARNING: The password reset box will also ask you to type in your username. Do NOT use any capital letters in your username, as the username field is case sensitive and any capital letters will fail the reset.

WARNING: You may want to use special characters in your password—don't. We've seen issue after issue with users who decide to use special characters in their passwords. In fact, TNT support is on record as saying that these characters should not be used and cause issues: & # @

tl;dr neopets is a functioning website

[Charmander]

Ooof yeah this booted me our right away as I was in the middle of playing! Just a heads up for those who are running programs.

[Ghast]

If you were not logged in to an account at the time of the forced logout/reset, you may be able to log in still with your old password. I would quickly try to log in to as many of your accounts as you can with their current passwords and change them/note them down/make sure you know the email as soon as possible before TNT starts to force resets on every account, logged in or not!

I was able to log in to my sides just fine to change them without being told my password is incorrect. My main account I was logged in to was logged out and forced to reset the password, though.

[Jackalope]

(you need an account to see links)

Honestly thank fuck they're actually doing something. Small silver lining to all of this is it forced their hand I guess.

[kittyray]

@(you need an account to see links) that seems to be working for me, guess I'll be making some email addresses?

[Alister]

Multi-factor authentication? it would be cruel to tease us, TNT

[Charmander]

If you were not logged in to an account at the time of the forced logout/reset, you may be able to log in still with your old password. I would quickly try to log in to as many of your accounts as you can with their current passwords and change them/note them down/make sure you know the email as soon as possible before TNT starts to force resets on every account, logged in or not!

I was able to log in to my sides just fine to change them without being told my password is incorrect. My main account I was logged in to was logged out and forced to reset the password, though.

I had the exact same experience when it came to being booted from my main. I was able to log into my sides no problem with my old passwords and avoid the forced reset. Is it worth while with all of this also changing the password associated with the email?

[Ice]

Maybe I am a skeptic but despite what they claim in their announcement, why do I feel like the people who had access to the db or backend still do?

Either way some people are getting stuck in password reset loops and honestly I am far too lazy to fight against that right now - gonna probably wait for the system to stabilize maybe before resetting my stuff. =/

[Ghast]

I had the exact same experience when it came to being booted from my main. I was able to log into my sides no problem with my old passwords and avoid the forced reset. Is it worth while with all of this also changing the password associated with the email?

I think it is safe to change your email passwords often regardless, but your email password will not be compromised as a result of the Neo leak unless your account shares a password with it (which you should never do )

------

As a different note I would like to state that even if you reset your passwords, it may prompt it again... I was just logged out of my account a second time and made to reset my password again

[DrSloth]

Still seem really vague their statements but happy to have all my e-mails saved, feeling bad for those who weren't so careful and i feel like many things are going to get lost because of this, but i think it was the best move on tnt's end.

Hope everyone is able to gett access to their accounts again o/ be safe everyone