It would appear that some nefarious folks have attacked prince.org and found a security hole through which they were able to determine some of the database structure, and then extract usernames, email addresses, and passwords. It's unclear to me how many they managed to actually extract (possibly zero, but we should assume they were able to extract ALL just to be on the safe side).

Hence why you'll need to get a new password to sign in, which will be mailed to your email address on file. You can of course change the password to somethign else, but please do NOT change it back to your original password, as you should assume another party now has that one.

Uncharacteristically sloppy coding on my part, so apologies. It's been remedied and I will do an audit of other similar vectors, it's certainly possible there's another one somewhere lurking. Sorry. Kind of amazing that we actually managed to go over 20 years without a similar successful attack though...

ben said:

It would appear that some nefarious folks have attacked prince.org and found a security hole through which they were able to determine some of the database structure, and then extract usernames, email addresses, and passwords. It's unclear to me how many they managed to actually extract (possibly zero, but we should assume they were able to extract ALL just to be on the safe side).

Hence why you'll need to get a new password to sign in, which will be mailed to your email address on file. You can of course change the password to somethign else, but please do NOT change it back to your original password, as you should assume another party now has that one.

Uncharacteristically sloppy coding on my part, so apologies. It's been remedied and I will do an audit of other similar vectors, it's certainly possible there's another one somewhere lurking. Sorry. Kind of amazing that we actually managed to go over 20 years without a similar successful attack though...

Just thought you should know, after I did the thing to reset my password, it sent me here...

http://prince.org/doc/page/login.asp

When I tried to login, it would not accept any password.

Thanks for the heads up Ben.

Site hackers

Ben, what about orgers who never updated their emails?? What then??

I had the thing happen that happened with Nikademus--that also happened once a while back, when I tried to come to the site. I don't remember when it was, but I'm thinking the site was down for awhile at the time, with people mentioning it elsewhere. I didn't enter anything (it looked odd to me), and I don't remember what I did because at first every time I tried to use my bookmark, it took me to that page. I think maybe I went to a specific thread that was still in my queue, and then back to the home page from within the site. And then I had to re-bookmark. Worked until just now. If I just type in prince.org, it still takes me there. I have to use the bookmark for it to work.

Now, as far emails--I tried to update mine once I was logged back in (I still have access to the other one, but it's not one I use for anything at this point), but when it sent a link to confirm, it wasn't a complete link. I'll probably try again some other time, but it was missing the whole domain, just having like the end of the link, starting with a "/ecv.x......." I thought about guessing at the beginning, but then thought I probably shouldn't, just in case I was wrong.

Site hacks are always reported in the plural, with the implication there were multiple bad people involved lol. It was probably one person and I have a good idea who. What, just because of one fun, innocuous, slightly daft remark? Stop holding a grudge man. And it's a free universe. I'll do what I want.

i think it's safe to blame Russia

It asked my username, then my fav movie. I couldn't remember that, but luckily it sent a PW change to the email address I used way back in 2004. What was great was it said which email account thank God LOL. Phew!

I was very lucky. I still don't know what I put as my fav movie though

[Edited 1/25/22 18:19pm]

Oh, I also got an orgnote saying it was sent on "Wed Jan 12 2022" from a thread I posted from 2004.

I cannot remember if I ever recieved it in 2004 or not, but it linked back to 2004 LOL. Crazy

It was unopened so nice to know it finally got delivered.

[Edited 1/25/22 18:24pm]

What to do when a user cannot reset their password?

A friend of mine has this issue since the hack.

Friend tries to create a new account but activation link is dead.

I cannot post in thread 'Please report any breakages since Jan 26 2021...'?

I wonder how many folks used the password "PRINCE3121"

Ben, is there any update on the users who are not able to get access to their account?

FragileUndertow said:

When you make a new account you have to wait a few days? or was it a week before you can post. So I kind of expect a few people to post here that they are locked out. But so far it doesn't seem to be much of an issue

Well it's an issue if they're locked out...and why would they have to create a new account? That's not cool.

Hello? Hello?

Some of the regular posters are not able to access their accounts. What else can they do to get this fixed?

just to be help out, BEN mentioned the following:

"yeah i need to figure out the best way to let people whose email addresses have died inaccessible, to get their new password for now if someone wants to email ben@prince.org their username and password and the new email address i can reset it.."

hopefully that helps out someone who doesn't have access to their email

I guess this is me now. Annoyed that I hadn't realised I was sitll using an old email address on this site. Ben, is there anything that can be done to recover my original TheEnglishGent account?

udo said:

Friend tries to create a new account but activation link is dead.

I cannot post in thread 'Please report any breakages since Jan 26 2021...'?

The link is just the end of the link. If your friend copies it and puts www.prince.org before it, then the activation link should work fine, I know because it's what I had to do. Obviously the links in the emails being sent do need fixing.

Ben, this is what's being sent out in activation emails.

Thanks for registering with prince.org! There's one step left
before you can use your account--you must visit the following page to
verify that you received this email:
/ecv.x?id=420907&c=a4c30cb0

EnglishGent2 said:

udo said:

Friend tries to create a new account but activation link is dead.

I cannot post in thread 'Please report any breakages since Jan 26 2021...'?

The link is just the end of the link. If your friend copies it and puts www.prince.org before it, then the activation link should work fine, I know because it's what I had to do. Obviously the links in the emails being sent do need fixing.

Ben, this is what's being sent out in activation emails.

Thanks for registering with prince.org! There's one step left
before you can use your account--you must visit the following page to
verify that you received this email:
/ecv.x?id=420907&c=a4c30cb0

It's coming back as a 404 error

Ben one other thing....

It told me to use my other email address which has never been associated with Prince.org in the 25 years I've been a member.

My friend is shown as online while he is not even logged in...

I had to create an entirely new account since I don't have access to the one I registered with. I was embmmusic, so feel free to delete that account. It took several attempts over several days to get the e-mail verification link for this new account though.

heymistermusic said:

I had to change my password too. Thankfully, the org is the only site I used my old one on.

Ben, can you please fix the rafael account? See email and orgnote about that.