Quote from: Zyl on September 17, 2013, 12:16:10 AM

Quote from: smoothie on September 17, 2013, 12:04:32 AM

Have any screenshots of that?

I didn't think of it at the time. Go on chat and ask other users, they will remember.

"Realsolid: Soandso, what other sites have you used password garbanzobunk on?"

Almost identical words to that, I don't remember their exact password though.

As someone who was there lurking when this happened, I'd like to offer a bit of context (though I have no screenshots).

The question was posed, "What site did the leaked passswords come from?"

The answer from RS was something to the effect of, "We're not sure, so check your security log and it will say something like 'Failed attempt to login using Garb******' " (using your example as I don't recall it verbatim either)

The conversation then went back and forth and it was mentioned multiple times that the passwords being attempted could be seen by the admin and consequently by users logging in (but only the first 4 letters and ****s). The group was making an effort using the passwords to try and determine which site the leaked database may have come from. These were NOT mcxNOW passwords, rather they were the passwords which were tried against mcxNOW.

I agree 110% that having unsalted plain text passwords on ANY site with $$ involved is MORONIC. However, I also agree that if you're dim enough to use a password that's not unique on ANY site with $$ involved you're asking for trouble. I'm not condoning nor defending RS or mcxNOW's site, I just thought for vitriol's sake I'd share. I don't see how its anyone but the user's fault if their passwords are the same; then again the troll box isn't really the best place to ctrl+v any passwords whatsoever.