Neopets security breach

[LittlePunker]

Interestingly enough, for those who were talking about neo_truths (whom I don't know too much about, other than from this thread), it looks like they potentially made an account on that other forum and posted on the DB selling thread asking if it included the pins of users.

Though that was an interesting move, since it seems there are a lot of eyes pointed at neo_truths at the moment as well to do with this debacle, etc.

Whether or not it's actually him is another question though.

[Jackalope]

Interestingly enough, for those who were talking about neo_truths (whom I don't know too much about, other than from this thread), it looks like they potentially made an account on that other forum and posted on the DB selling thread asking if it included the pins of users.

Though that was an interesting move, since it seems there are a lot of eyes pointed at neo_truths at the moment as well to do with this debacle, etc.

Whether or not it's actually him is another question though.

Call me paranoid but oldest lamest trick in the book imo. "They'll never know it's me if I talk to myself as if I'm a totally different guy". Neo_Truths has DB access, wouldn't they know if that includes the effing PINS? Like how dumb do they think we are?

[Shawn]

IF they were 2 truly different people, my guess is that n_t wanted to figure out more about what the seller has access to. Perhaps having access to pins would mean something different if he didn't have access to the pins.
Quite the stretch, but i agree, might just be a very dumb question.

[DarkSkies]

I was so tempted to use the spiderman meme here haha

Anyway, back to the topic, it seems to me it may be same person since guy loves attention and obviously wanna make easy cash. I don't know the selling forum tho.

It could also be one of his buyers, I don't know if by selling access you can avoid your buyers to go and spread info/share access to whoever they want.

[Jackalope]

IF they were 2 truly different people, my guess is that n_t wanted to figure out more about what the seller has access to. Perhaps having access to pins would mean something different if he didn't have access to the pins.
Quite the stretch, but i agree, might just be a very dumb question.

Yeah seems like a stretch when they claim it's write access. Occam's Razor is telling me n_t is trying poorly to cover their ass to maintain their weird delusional fanbase.

[GetJinxed]

I'm more surprised they finally stopped using plain-text passwords

[Fiore]

So it's been about a week already since Neo has been transparent with the issue. They haven't said anything in regards to fixing the problem. The only thing they've been posting lately (via Instagram) is BUY OUR NEW NC ITEMS AND PINS!

Guess we're still vulnerable. :/

[RealisticError]

Jeezy creezy criminy christmas.

I swear every time I take a break some nonsense goes down. I've just read 30 hecking pages.

I do have a question though - I work for a company who run a 20+ year old website which has user accounts and message boards etc. Thing of the most ancient creaky form of ancient social media.

Updating it to 2020+ has been a challenge, especially trying to make it work for an app, but stuff like - adding OTP at logins, adding 2FA for members who want it... that's not hard.

Our dev team is three people and our site has never been hacked - the biggest problem with hackers we have comes through people's emails getting compromised. We don't need to use nonsense like stackpath to disrupt user experience.

There are a LOT of creaky bits and a lot of the site is held together by string, but account security is the biggest priority.

So why *haven't* TNT enabled 2FA? It seems like it would be the easiest way to help secure accounts at least from casual users with access to any previous data breach, and it's not hard to do. So it's just money?

You'd think they'd save money by not having to bring in lawyers and forensic teams when this happens, but hey.

Also, considering Neo_Truths contacted them ages ago to say he had DB access, and that site that was unconverting pets also had DB access, have neo not broken a few laws by not clearly informing us their DB wasn't secure before now?

Honestly, I'll change a few emails and passwords but mainly I'm going to screenshot a bunch of stuff on my accounts because I feel like this dude won't be able to sell and may just put the database up somewhere as pay to access.

The stackpath thing is an attempt to block out scripts and stuff, if the script runs as soon as the page loads it'll error out because the content hasn't come through yet...obviously this is super easy to fix though

[EnderTheory]

So it's been about a week already since Neo has been transparent with the issue. They haven't said anything in regards to fixing the problem. The only thing they've been posting lately (via Instagram) is BUY OUR NEW NC ITEMS AND PINS!

Guess we're still vulnerable. :/

(you need an account to see links)

(If the joke has been made already, I apologize)

[♥ Munna ♥]

The first thing I did when I saw this news was pop on here. LOL. This is so horrendous.