Account Security Reminders

Milennin said:
What I'm wondering is why are people going through the trouble to hack MAL accounts? What is there to gain?

sreimund said:
To all of those who ask why someone would hack MAL:


A vast majority of internet users use a password or similar passwords for other websites and services. If you don't do this then obviously you're already ahead of the program but you wouldn't be asking this question either.

Do you know what internet users also like? That's right, unique handles.

Once a hacker obtains one of your passwords that corresponds to your e-mail address or handle elsewhere his chances of being able to get into much more sensitive places increases a thousandfold. From there he could see emails from your bank, possible other websites you're registered to and so forth. Should your security really be lacking even more... Well you get the point.

The question isn't "Why would he want my MAL account", he doesn't want it. The real question is "Is he going to access more than just my MAL account"

Tiffanys said:
tbh if someone manages to bruteforce my password, they deserve the account. There's nothing on here except my anime/manga list. Like what the heck do they think they're going to do with my account? There's no incentive to even bother hacking into accounts on this site, it's nonsensical. What are you gonna do hacker-chan, edit/delete people's lists? Not a very good use of your time...

Vampire said:

In my opinion, they should at least:

• Use OAuth2 for API authorization
  
• Hash user passwords with a secure algorithm like argon2 or scrypt
  
• Add software and hardware 2FA support (ex. Authy, U2F, backup codes)
  
• Send users an email if someone logs in with an unusual IP and/or user agent
  

Tiffanys said:
tbh if someone manages to bruteforce my password, they deserve the account. There's nothing on here except my anime/manga list. Like what the heck do they think they're going to do with my account? There's no incentive to even bother hacking into accounts on this site, it's nonsensical. What are you gonna do hacker-chan, edit/delete people's lists? Not a very good use of your time...

KADAIMISE said:
1.) Apache can be as safe as any other server, I don't get why everyone is freaking out about Apache, they just have to secure it.

Maurits said:
I didn't really know what the problem could be with a password like Banana01!

KADAIMISE said:

TL;DR: Throw a bunch of random words in there and be done with it #ConfusedAbashedObceneBananaForLife2017

1. A common word can easily be cracked through a dictionary attack (the kind of brute forcing MAL was talking about in the first place)
   
2. Some numbers don't help too much, especially not an order like 01234 or a common birth year like 1997
   
3. A single punctuation mark, especially at the end, doesn't help too much either.
   

But I agree, MAL should give an explanation or some hints, check this demo and try some 'passwords' out yourself!
MAL seems to use the same password checking library.
Hit the "Break it down!" button to see a breakdown of what the password checker did, although some things might be cryptic to read.

Some tips that apply to that code library (I've used it myself and even expanded it with common Dutch words; the language in question for the website I was developing for at the time):

1. Avoid common words, or use multiple words, make a password like "ConfusedAbashedObceneBanana", it's safe and funny enough to remember!
   
2. Avoid common substitutions, all hackers know the simple i=1 tricks, so "Tr1ck" isn't a whole lot harder to crack, it is a whole lot harder to remember
   
3. This goes without saying for any website ever: Use a different password for each account, use a password manager (like KeePass2 for safe offline use or LastPass for easy multiple-device access)
   Like seriously, using a password manager and completely random passwords is the best way to go with passwords ever.
   

Fistric said:
Thanks for the information . But how to change the password

Kineta said:
We have noticed an increase in brute force hacking attempts on user accounts recently. While we have increased the strength of our login system, there are limits to what we can do to combat this when users are not taking basic account security precautions themselves. Thus, we are hoping to remind everyone of some things you should be doing (both on and off MAL) to help prevent your accounts from being compromised.


If you have a simple password, please update it immediately.
Within the last two years, MAL has considerably increased its password requirements in attempt to help you keep your account safe. However, if you have not changed your password since 2015 or before, you may still be using a very simple password. Please update this immediately. All passwords should consist of upper and lower case letters, numbers, and special characters for maximum security.

Change your passwords frequently.
Even a complex password can be brute forced: it simply requires more time than a simple one. By keeping your passwords complex and changing them often, you can greatly reduce the chances of having your account stolen from you.

Do not use the same passwords on many accounts across the internet.
Doing so increases your risk of losing access to all of your accounts, including email, Amazon, Paypal, Facebook, blogs, etc. By having them all the same, a potential hacker only needs to compromise one site to have all of your personal information.

Make sure your email address on your account is up-to-date.
This ensures you can receive password resets if you forget your complex password, and that we can contact you if need be. You can change your email address here: http://myanimelist.net/editprofile.php?go=myoptions Please note that the following domains often bounce MAL's emails: http://myanimelist.net/forum/?topicid=252840

Do not enter your personal details into any form on the internet that you are not 100% aware of.
In the last year or two, we've seen a dramatic increase in the rise of phishing sites, pretending to be MAL. Do not enter your login information to any site before checking your address bar to ensure you are on the correct website.

Consider backing-up your list from time to time.
You can use our list export feature any time from this link: http://myanimelist.net/panel.php?go=export or the "file" icon on your Anime/Manga list navigation.


We will continue to do everything we can to ensure your accounts are kept safe. However, we need you to be committed to performing basic account security precautions as well; otherwise, everything we do will only be partially effective.

And for those who already are aware of, and practising, the above—have yourself a cookie ;)

Tiffanys said:
tbh if someone manages to bruteforce my password, they deserve the account. There's nothing on here except my anime/manga list. Like what the heck do they think they're going to do with my account? There's no incentive to even bother hacking into accounts on this site, it's nonsensical. What are you gonna do hacker-chan, edit/delete people's lists? Not a very good use of your time...

Remrin said:
Hackers are just sad people with nothing better to do than ruin other people's lives because theirs is so crap. Mum probably didn't love them and give them hugs as a child.

Yuki_10 said:

Ah U don't know much about hackers, do u? There are many types of hackers the ones u're talking about are black hats. There are white hat hackers who hack for the good of humanking.

Remrin said:


Good hacking, like?

Yuki_10 said:

The white hats are the ones who work for companies and gvernments.
They hack the company's system and check for vunerablities. They tell the company how to improve their security and etc. This job is called Ethical hacking.

Orion_Gospel said:
Btw, what can we do if our account gets hacked?

Yuki_10 said:

Good question, Ask Mal. Normally we have to verify our identity.

GeneralEcchi said:
What exactly could someone gets by hacking a MAL account ?