<story><title>Urgent security warning that may affect all internet users</title><url>http://community.namecheap.com/blog/2014/09/01/urgent-security-warning-may-affect-internet-users/</url></story><parent_chain></parent_chain><comment><author>orofino</author><text>The question for us, as technologists, is what are we doing about this?&lt;p&gt;2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web.&lt;p&gt;Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can&amp;#x27;t expect people to use password managers (they&amp;#x27;re complicated and then centralize everything into a single point of failure). Forcing people to use crazy passwords just results in weaker passwords.&lt;p&gt;I was hopeful that something like persona from Mozilla would catch on, but that has failed. Where are we with replacing the password? It is flawed technology.&lt;p&gt;On top of this we have the compounding factor that our systems are more complicated than ever and it appears that they&amp;#x27;re simply impossible to secure. Too many layers exist with too much code. Many sites just don&amp;#x27;t both with even hashing password, meaning those of us that care, are just kind of throwing our hands up and saying &amp;quot;well it wasn&amp;#x27;t my site that was compromised, so it isn&amp;#x27;t my fault&amp;quot;. All the while, bad guys walk in the front door because we&amp;#x27;ve decided to ignore the reality of the situation.&lt;p&gt;I know I&amp;#x27;m not providing a constructive alternative here, but I&amp;#x27;m a bit ashamed that we&amp;#x27;ve even let it get this far. We&amp;#x27;re failing those that rely on our systems. I don&amp;#x27;t have the answer, but would love to hear some ideas about what can be done.</text></comment>
<story><title>Urgent security warning that may affect all internet users</title><url>http://community.namecheap.com/blog/2014/09/01/urgent-security-warning-may-affect-internet-users/</url></story><parent_chain></parent_chain><comment><author>Negitivefrags</author><text>As someone who runs an online game we find that a huge percentage of our users arrive pre-compromised.&lt;p&gt;Vast quantities of people wander around from site to site using the same email&amp;#x2F;password combo that has been compromised a long time ago.&lt;p&gt;We do a GeoIP check now and send an email with an unlock code any time someone logs in from a different city than last time. This reduced the account compromise problem significantly. Most of these pre-compromised people have a different password on their email at least.</text></comment>