If you have not logged into your account since Friday, be sure to do so and get your password changed immediately. In addition to the advisory, Evernote users will be asked to reset their passwords immediately–a heavy-handed but fitting precaution to keep their users safe from potential harm. They were most likely cryptographically hashed with salt added beforehand.Evernote, the popular Internet-based note-taking service, has posted an advisory that it has been subject to a security breach that they believe allowed hackers to infiltrate and take usernames, associated e-mail addresses and encrypted passwords of the 50 million users who are registered. The stolen hashed passwords were most certainly being subjected to brute force and dictionary attacks. That said, it was the right move to invalidate all existing passwords. I can only imagine the deluge of support requests they must have gotten from the 90% of their users who couldn't work this out on their own. The point of this story is that it was handled in a very user-unfriendly manner. Then, it took several attempts to actually change my password - their servers must have been slammed over this. Totally puzzled, I Googled a bit and found the news. Still looks like a hack attempt on my account." Next move was to look for the usual email one gets when requesting a password reset. Someone who had my email address asked for a reset. It took my password and went to a "reset your password" page.
I was like "WTF? Has someone stolen my account? My password is strong, how can this be?" So I tried to login to the website. I first learned of this when a not so friendly message popped up on my Mac's Evernote app saying something like "your password has been changed" and it wouldn't sync any more. They don't recommend changing passwords, they are forcing all users to change their passwords.
0 kommentar(er)
