Ready to be published? LXer is read by around 350,000 individuals each month, and is an excellent place for you to publish your ideas, thoughts, reviews, complaints, etc. Do you have something to say to the Linux community?
Jeremy White, Codeweavers Founder has announced that access to the WineHQ database has been compromised.
Jeremy White, Codeweavers Founder has announced that access to the WineHQ database has been compromised. "On the one hand, we saw no evidence of harm to any database. We saw no evidence of any attempt to change the database (and candidly, using the real appdb or bugzilla is the easy way to change the database). Unfortunately, the attackers were able to download the full login database for both the appdb and bugzilla. This means that they have all of those emails, as well as the passwords. The passwords are stored encrypted, but with enough effort and depending on the quality of the password, they can be cracked." Anybody who has reused a password stored there probably wants to make some changes fairly soon.
Attackers have used phpMyAdmin, an open source database administration tool, to access the WineHQ project's database and harvest users' appdb and bugzilla access credentials. Wine (Wine Is Not an Emulator) is free open source software that allows users to run Windows applications on Linux and Unix by providing its own native replacements for Windows DLLs. Hosted on SourceForge, Wine source code is licensed under the LGPL. The Wine Project is sponsored by CodeWeavers, which also shares its own code updates with the Project.
The difference is that on a Linux system, hacking into it requires a conscious effort to attack that system. Plus, it's usually discovered quickly. On Windoze, it's likely to catch a case of malware in normal day-to-day operations. I'm glad they caught this intrusion quickly, & I'm glad I don't use Wine much (drink wine, yes,... run Wine on my systems, no...).
And unlike other companies might do, they notified the users fairly quickly.
Also, the title of this article really bugs me.
A database compromise is NOT a "project fail", it's a hosting security fail.
All my passwords are different on different sites. I also generate them with mkpasswd on Slackware so they are pretty strong. However I don't change them often enough, there are too many for that.
@moopst: What do you do when you want to visit these sites from different computers? For instance, I have a primary desktop PC, and also a work laptop. I normally use the desktop, but occasionally I'll use the laptop if I take a trip somewhere.
I have several of them in kwallet and some in a plain text file, but /home is on an encrypted partition. My work doesn't let me visit several sites so I just check the news. There are a couple financial sites where I keep the pw in my wallet on paper in case I need to get my money out of Europe before the banks crash.
You see, that's why I dislike password managers, in browsers or otherwise. They don't allow me to remember my passwords. So I turn them on only for passwords *I* already remember, if at all. The only problem is with sites I visit once a year, or so, but, well, resetting your password once a year is a good practice anyway ;)
I don't usually need to remember my passwords -- I just remember how I created then. (Mind you, this may take a while. A couple of months ago I needed my email password, and it took me half the day to remember how I came up with it in the first place. But once I had a place to start, I recalled the actual password in less than 30 seconds.)
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
