Important Security Update

Post Header

Published:

2014-11-26 18:51:33 UTC

Translations:

Tags:

We've recently upgraded our password encryption in response to a possible security issue affecting a number of accounts. Your account will be automatically upgraded to use the stronger encryption next time you log in. If you usually stay logged in all the time, please log out and then back in to ensure your account is upgraded.

What was the issue?

We maintain a virtual development environment which coders who want to work on the Archive can download: this is a copy of everything needed to run the Archive so that our coders can easily develop and test. This comes with a partial copy of Archive data, so that coders can see how changes in the code will affect the site, with identifying information such as email addresses stripped out. However, we were alerted to the fact that the way we previously encrypted passwords meant someone with access to this data could theoretically use it to figure out passwords associated with some accounts.

Our new encryption system will make it much harder for anyone who accesses our data in any way to guess passwords. In addition, we will review how we put together the sample data we use for development. Only known coders have accessed the old data (we keep a record of downloads) and we have no reason to think that users' accounts were compromised. However, account security is a priority and we're asking our users to change their passwords as a precautionary measure.

How to change your password

Affected account holders will shortly receive an email with a link to the "Change My Password" page. To change your password without the link:

Log into your account with your current password.
Visit your Profile.
Follow the "Edit My Profile" link at the bottom of the page.
Follow the "Change Password" link at the top.

We strongly recommend you pick at least a combination of letters and numbers, and avoid easily guessable passwords like 'password' or '123456'. You may wish to use a service like How Secure is my Password? to help you create a strong password.

Actions

Comments

Sorry, this news post doesn't allow comments.

Green Wed 26 Nov 2014 07:35PM UTC

Thank you for letting us know. :)

Comment Actions
- Thread
ChristyCorr Wed 26 Nov 2014 07:39PM UTC

Thank you for being so cautious ♥

Comment Actions
- Thread
ladygray99 Wed 26 Nov 2014 07:45PM UTC

When non profit fanfic site is smarter about development and security than a lot of governments and corporations. Thank you.

Comment Actions
- Thread
StormDragon Wed 26 Nov 2014 08:15PM UTC

Will do and thanks for the heads up

Comment Actions
- Thread
cynatnite Wed 26 Nov 2014 08:18PM UTC

Thanks :)

Comment Actions
- Thread
mariska_lee Wed 26 Nov 2014 08:28PM UTC

Thank you for letting us know and for opting for integrity and caution in handling this discovery. Much appreciated!

Comment Actions
- Thread
anatsuno Wed 26 Nov 2014 10:05PM UTC

Done and done! Thank you for your caution.

Comment Actions
- Thread
Orchid Wed 26 Nov 2014 10:15PM UTC

Thanks for the transparency about what's going on, and for clearly outlining the situation and what we (users and creators) can do to make it better!

Comment Actions
- Thread
InevitableShipper Wed 26 Nov 2014 10:45PM UTC

I don't know if it's related to the password issue (by the way, I logged out , logged in again and change password with a more difficult one ) , but today I updated one of my works and I can't see it anywhere... I mean, if I check it it's there and there's the last chapter , but it doesn't show on the list of the newly updated ones ... :(

Comment Actions
- Thread
1. Account Deleted Thu 27 Nov 2014 06:11AM UTC
  
  The same thing happened to me.
  
  Comment Actions
  - Thread
  - Parent Thread
2. 1. InevitableShipper Thu 27 Nov 2014 08:41AM UTC
    
    Hi Yamiga, well , I tried to delete the chaoter and update it again once I had logged in with the new password. I didn't try with the same work yet, but another one and now at least the second work shows up as newly updated, I'll try to do the same with the other work later ..
    
    Comment Actions
    - Thread
    - Parent Thread
  2. 1. mumble (AO3_ADT) (Official) Thu 27 Nov 2014 12:22PM UTC
      
      Thank you for updating your password!
      I'm afraid this issue with works was entirely unrelated to password changes, however. We tweeted when we noticed the problem and then again when we were able to solve it. I'm sorry you ran into this issue, it should be all taken care of now.
      Best,
      mumble
      Accessibility, Design, & Technology committee
      
      Comment Actions
      - Thread
      - Parent Thread
    2. 1. InevitableShipper Thu 27 Nov 2014 12:43PM UTC
        
        thank you so much, also for your quickness!! ;)
        
        Comment Actions
        
        Thread
        
        Parent Thread
  3. mumble (AO3_ADT) (Official) Thu 27 Nov 2014 12:22PM UTC
    
    Hi! I'm afraid this issue with works was entirely unrelated to password changes. We tweeted when we noticed the problem and then again when we were able to solve it. I'm sorry you ran into this issue, it should be all taken care of now.
    Best,
    mumble
    Accessibility, Design, & Technology committee
    
    Last Edited Thu 27 Nov 2014 12:23PM UTC
    
    Comment Actions
    - Thread
    - Parent Thread
Nixill (NixillUmbreon) Wed 26 Nov 2014 11:39PM UTC

I think if you're offering passwords as part of Archive data, they should just be falsified passwords.

Comment Actions
- Thread
1. mumble (AO3_ADT) (Official) Thu 27 Nov 2014 12:35PM UTC
  
  That is indeed what we are planning to do. Sadly, in the care we took to remove other kinds of sensitive data from the development package (users' reading histories, subscriptions, email addresses), we missed a rather crucial piece of information. We can all but guarantee that no accounts on the AO3 were in any way compromised, but it served as a reminder of what we can do better going forward.
  Thank you for the comment!
  Best,
  mumble
  Accessibility, Design, & Technology committee
  
  Comment Actions
  - Thread
  - Parent Thread
akuma_river Thu 27 Nov 2014 12:05AM UTC

I use LastPass for all my password management and had a pretty pw to begin with but I changed it anyway.

Comment Actions
- Thread
rootbeer Thu 27 Nov 2014 01:23AM UTC

Right then. Thanks for informing!

Comment Actions
- Thread
Account Deleted Thu 27 Nov 2014 03:59AM UTC

Done. Thanks!

Comment Actions
- Thread
pinetreelady Thu 27 Nov 2014 04:51PM UTC

Thanks so much for your conscientiousness. You do great work!

Comment Actions
- Thread
Wondering (Guest) Thu 27 Nov 2014 06:50PM UTC

Why was none of this in your email?
The email made it sound like there was not really an issue and this is just a standard upgrade and we can stay with the passwords we had, instead of you creating a security breach and we needing to change our passwords asap?

Comment Actions
- Thread
1. LadyOscar (AO3_ADT) (Official) Thu 27 Nov 2014 10:32PM UTC
  
  Hi, Wondering,
  We included a summary of the problem in the email with a link to the more detailed (and translated) post here. We wanted to keep the email itself short and simple in order to make it easier for all users, especially those who may be relying on machine translation, to understand our request that they change their password.
  We’re sorry if that gave the impression of hiding the problem; we hope that users looking for more information have found it in this post.
  Best,
  Lady Oscar
  Accessibility, Design & Technology
  
  Comment Actions
  - Thread
  - Parent Thread
2. 1. Wondering (Guest) Thu 27 Nov 2014 11:06PM UTC
    
    The email didn't make it sound like there was a real issue or reason to go to the more detailed description.
    If you had wanted to make it short and simple for everyone to understand, it'd have been: "We had a security issue. It's fixed. Change your password now. Here's how" and not all that palaver about 'possible security issue', 'no accounts comprised' and 'we strongly recommend that you change your password as a precaution'.
    I'm also not finding the summary you are speaking off. That first sentences sounds like a standard upgrade message send to everybody on AO3. Companies with lesser security breaches than plain handing out their user's data have less weaselly statements about what's happened and what should be done.
    
    Comment Actions
    - Thread
    - Parent Thread
  2. 1. scribblemyname Fri 28 Nov 2014 09:04PM UTC
      
      I got the same email and it was very clear that data may have been breached, my account was probably not compromised but to change my password anyway, which is also what this notice says.
      
      Comment Actions
      - Thread
      - Parent Thread
Thrawn Fri 28 Nov 2014 03:13AM UTC

Thanks for explaining.

Comment Actions
- Thread
arawnannwn Sun 30 Nov 2014 09:50AM UTC

When you say the passwords are encrypted, do you mean you are using a reversible function or are you now using a properly slow theoretically one way hash function with salt, if so which one? Or is checking github the best option? ie is this a change from sha-1 or md5 to bcrypt scrypt or pbkdf?

Comment Actions
- Thread
1. zz9pzza Sun 30 Nov 2014 05:19PM UTC
  
  Here is the pull request , we have moved from Sha512 to BCrypt with a cost of 14.
  
  Comment Actions
  - Thread
  - Parent Thread
Account Deleted Tue 02 Dec 2014 07:36PM UTC

thank you for all your hard work.

Comment Actions
- Thread
king_juniper Sun 01 Nov 2020 03:32AM UTC

What do I do if I forgot my password? Now I can’t change it.

Comment Actions
- Thread

AO3 News

Post Header

What was the issue?

How to change your password

Actions

Comments

Green Wed 26 Nov 2014 07:35PM UTC

Comment Actions

ChristyCorr Wed 26 Nov 2014 07:39PM UTC

Comment Actions

ladygray99 Wed 26 Nov 2014 07:45PM UTC

Comment Actions

StormDragon Wed 26 Nov 2014 08:15PM UTC

Comment Actions

cynatnite Wed 26 Nov 2014 08:18PM UTC

Comment Actions

mariska_lee Wed 26 Nov 2014 08:28PM UTC

Comment Actions

anatsuno Wed 26 Nov 2014 10:05PM UTC

Comment Actions

Orchid Wed 26 Nov 2014 10:15PM UTC

Comment Actions

InevitableShipper Wed 26 Nov 2014 10:45PM UTC

Comment Actions

Account Deleted Thu 27 Nov 2014 06:11AM UTC

Comment Actions

InevitableShipper Thu 27 Nov 2014 08:41AM UTC

Comment Actions

mumble (AO3_ADT) (Official) Thu 27 Nov 2014 12:22PM UTC

Comment Actions

InevitableShipper Thu 27 Nov 2014 12:43PM UTC

Comment Actions

mumble (AO3_ADT) (Official) Thu 27 Nov 2014 12:22PM UTC

Comment Actions

Nixill (NixillUmbreon) Wed 26 Nov 2014 11:39PM UTC

Comment Actions

mumble (AO3_ADT) (Official) Thu 27 Nov 2014 12:35PM UTC

Comment Actions

akuma_river Thu 27 Nov 2014 12:05AM UTC

Comment Actions

rootbeer Thu 27 Nov 2014 01:23AM UTC

Comment Actions

Account Deleted Thu 27 Nov 2014 03:59AM UTC

Comment Actions

pinetreelady Thu 27 Nov 2014 04:51PM UTC

Comment Actions

Wondering (Guest) Thu 27 Nov 2014 06:50PM UTC

Comment Actions

LadyOscar (AO3_ADT) (Official) Thu 27 Nov 2014 10:32PM UTC

Comment Actions

Wondering (Guest) Thu 27 Nov 2014 11:06PM UTC

Comment Actions

scribblemyname Fri 28 Nov 2014 09:04PM UTC

Comment Actions

Thrawn Fri 28 Nov 2014 03:13AM UTC

Comment Actions

arawnannwn Sun 30 Nov 2014 09:50AM UTC

Comment Actions

zz9pzza Sun 30 Nov 2014 05:19PM UTC

Comment Actions

Account Deleted Tue 02 Dec 2014 07:36PM UTC

Comment Actions

king_juniper Sun 01 Nov 2020 03:32AM UTC

Comment Actions