Quote from: sherbyspark on June 29, 2015, 09:06:20 AM

Just read the article. Can't the same exploits be made on almost all the sites ?

The article didn't really say what the exploit was:

Quote

we found a handful of accounts sharing the same server seed.

Quote

Hufflepuff found a way to confuse our server, and made it give out a decrypted server seed that was also an active seed. This was done by sending it more requests than it could handle in a small time period, think hundreds of requests in under a second.

The first quote makes it sound like the seed generator either generated the same seed for two different accounts, or was only called once for two different accounts.

The second quote makes it sound as if the "reveal old seed" behaviour could be made to happen without the "replace old seed by new seed" action having been done first. Maybe sending too many requests at once could trigger that. But it doesn't fit in with the first quote.

So I think we're really left guess about what really happened, and why.

I think it's unlikely the same exploit exists on other sites. I don't see how multiple accounts would share the same server seed accidentally, or why a server would reveal its server seed without first invalidating that seed. But there's no guarantee that other sites didn't make the same obscure mistake(s).