Compromised LJ & DW Accounts
I'm not sure why this wasn't in my emails, but I just logged into Dreamwidth and there were a bunch of messages that may be relevant for some of you. I haven't seen a post about it on my Friends Feed yet, so I figured it was worth signal boosting.
So here's the deal: at least one flistie in the last month or two (and I'm really sorry, I can't recall who had the issue) posted about an attempted extortion with threats to their Dreamwidth account. DW themselves sent out mails to the effect in March that many accounts had apparently been compromised, and they strongly encouraged users to change their passwords. (If you haven't, why not do so now?) There's been another wave of them this month, both that and the cracking of accounts to use for spam. I know I've spotted traces of it in my comm and various journals. (Can you give me an example? Sure. Accounts that were essentially inactive suddenly liking things or joining communities is a probable sign. (LJ has already banned a bunch of them.) It's an attempt to legitimise these accounts, and also a reasonably popular move in social media manipulation. It's an election year in the U.S.; I expect this will get a lot worse in the months to come.)
In the time since DW's mails, HaveIBeenPwned (they're a notification service for password breach incidents) has loaded a file of 26 million accounts containing usernames, email addresses, and passwords that allegedly were taken from LiveJournal at some point or another. (There's varying info as to when; it's better to err on the side of caution.)
DW has made an effort to track down the source of their breach, and have so far determined that all individuals who had problems on DW had used the same password on DW as on LJ, and the belief is the problem lies here on LJ.
So a couple of things, since they can't tell when the breach happened:
1) IF YOU HAVE USED YOUR LJ PASSWORD ELSEWHERE, YOU SHOULD CONSIDER IT COMPROMISED AND CHANGE THE PASSWORD. especially if that account is referenced from your journal, or you are using the same username (on reddit, tumblr, instagram, twitter, AO3, etc.)
2) if you haven't recently, you should change passwords on both LJ and DW.
3) PLEASE don't use the same password on both sites. even small differences are a big help.
4) backing up your journals if they are only on one of the two sites would be a great idea. (If you aren't sure how, I'll try to make a 'how to' for that in a couple of days.)
5) it's also a good idea to check HaveIBeenPwned to see if your email is linked to a compromised account. <- that isn't just LJ / DW relevant.
If for whatever reason you don't feel like doing any of that now, be aware that DW is working their way through accounts they consider most at risk. If you get an email from them about this, you should change your password as soon as possible on Dreamwidth and on any other sites you used it on (including LiveJournal).
Be safe, guys. 😊
So here's the deal: at least one flistie in the last month or two (and I'm really sorry, I can't recall who had the issue) posted about an attempted extortion with threats to their Dreamwidth account. DW themselves sent out mails to the effect in March that many accounts had apparently been compromised, and they strongly encouraged users to change their passwords. (If you haven't, why not do so now?) There's been another wave of them this month, both that and the cracking of accounts to use for spam. I know I've spotted traces of it in my comm and various journals. (Can you give me an example? Sure. Accounts that were essentially inactive suddenly liking things or joining communities is a probable sign. (LJ has already banned a bunch of them.) It's an attempt to legitimise these accounts, and also a reasonably popular move in social media manipulation. It's an election year in the U.S.; I expect this will get a lot worse in the months to come.)
In the time since DW's mails, HaveIBeenPwned (they're a notification service for password breach incidents) has loaded a file of 26 million accounts containing usernames, email addresses, and passwords that allegedly were taken from LiveJournal at some point or another. (There's varying info as to when; it's better to err on the side of caution.)
DW has made an effort to track down the source of their breach, and have so far determined that all individuals who had problems on DW had used the same password on DW as on LJ, and the belief is the problem lies here on LJ.
So a couple of things, since they can't tell when the breach happened:
1) IF YOU HAVE USED YOUR LJ PASSWORD ELSEWHERE, YOU SHOULD CONSIDER IT COMPROMISED AND CHANGE THE PASSWORD. especially if that account is referenced from your journal, or you are using the same username (on reddit, tumblr, instagram, twitter, AO3, etc.)
2) if you haven't recently, you should change passwords on both LJ and DW.
3) PLEASE don't use the same password on both sites. even small differences are a big help.
4) backing up your journals if they are only on one of the two sites would be a great idea. (If you aren't sure how, I'll try to make a 'how to' for that in a couple of days.)
5) it's also a good idea to check HaveIBeenPwned to see if your email is linked to a compromised account. <- that isn't just LJ / DW relevant.
If for whatever reason you don't feel like doing any of that now, be aware that DW is working their way through accounts they consider most at risk. If you get an email from them about this, you should change your password as soon as possible on Dreamwidth and on any other sites you used it on (including LiveJournal).
Be safe, guys. 😊