FFXI Wiki.. hacked?

[Amele]

Re: FFXI Wiki.. hacked?

Well yes I suppose that is true.. However I personally believe it didn't take that much work to get Ganaiman's passwords. In fact, I think he looked at Ganaiman's own account on BG Forums, grabbed the password, and plugged it in.

phpBB3 is more secure than gmail is currently. (do a google search on gmail exploit or gmail vulnerability and see how much comes up.)

And here's why I think this - as good as a coder as he might be, Gmail and Paypal use RSA 128-bit or better encryption and you'd have to be MIT or NSA material to break through that kind of thing (he probably is, but still..) - It's much easier to use information that you already have, or can get much easier, and see if it will work elsewhere.

Taj doesn't have access to BGforums admin panel, or to the password hash. in both cases where he's apparently 'hacked' someone else's BG forum account, he's done it via gmail access first (public dataterm someone left in? *shrugs*)

And let this be a quick lesson to everyone else.. don't use the same password everywhere you go folks.

yes, in fact, never use the same password anywhere that personal information is kept.

[Mhurron]

Re: FFXI Wiki.. hacked?

what attempt? I suppose you consider corporate whistle-blowers villians too? there's a rather wide continuum between "villian" and "hero" and honestly, that you quoted from the tl;dr summary (hell, that you didn't even quote the -entire- tl;dr) and not from the relevant section of the actual post says to me that you didn't bother to actually read what I had to say and just reflex posted.

A - You compared him to Jefferson
B - He wasn't a corporate whistle blower. A corporate whistle blower comes across their information by being privy to that information, not illegally fishing for it.
C - The quote was not out of context.

Taj isn't my hero. He does, however, have my respect.

some of the most important things to ever happen in the history of this country came about because uncompromising men were willing to do what they felt was necessary, despite the possible legal ramifications of their actions.

is Taj Thomas Jefferson? no. but then again, he doesn't have to be.

tl;dr: Taj isn't a villian, BG didn't make some huge conspiracy to usurp the wiki, you should've read the whole post.

Ya, not putting him on a pedestal at all. Nope, not here.

anyone with the capability to set up a wiki and a forum knows enough about internet security to know that you use at least a couple different passwords

Ya you go on living in that dream world where people need to know things to make services available on the internet, or is setting up a Wiki more difficult then managing TD- Ameritrade's backup's?

[Amele]

Re: FFXI Wiki.. hacked?

What do you call someone who posts his illegal activities on a public forum in a manner that is easilly traceable back to themselves? He's no more clever then a thief walking home in the snow from his latest heist and wondering how he got caught.

there's a cute little rhyme I heard back in college from a very good computer science professor.

"If the IP doesn't trace, you ain't got no case". and IP masking is cracking 101. (hell, I do it myself routinely for privacy reasons.)

in this example, you've got a thief walking home in the snow from his latest heist across international borders to a nation that requires no identification papers and has no extradition treaties with the nation that said heist was committed in, and moreover considers it an act of war to pursue across their borders, since they don't recognize the right of hot pursuit.

[Sevv]

Re: FFXI Wiki.. hacked?

What do you call someone who posts his illegal activities on a public forum in a manner that is easilly traceable back to themselves? He's no more clever then a thief walking home in the snow from his latest heist and wondering how he got caught.

Now saying Taj did do this on his own, and everything he is credited with. You really think he is dumb enough to leave this huge trail back to him? Come on mhurron I know your not that dumb.

He has the information, yet he never once admits to everything. Just because your own a pic of a skeleton in a closet doesn't mean it is yours.

Again for people who aren't bright enough to understand my point. I thank Taj for the information, tho do not agree with hacking as the means to acquire it.

[Olorin401]

Re: FFXI Wiki.. hacked?

script kiddies can't code. script kiddies also can't find and utilize previously unknown exploits
Taj has proven he can do both, quite well actually. (see: primary dev of 3.3 windower, doing things in a day that it took prior devs several weeks, deconstructing the packet to get onto Atomos, finding demonstrating and explaining how to fix the area DC bug. etc)
whatever else you consider him; you have to give him that he's competent at what he chooses to do.

Well yes I suppose that is true.. However I personally believe it didn't take that much work to get Ganaiman's passwords. In fact, I think he looked at Ganaiman's own account on BG Forums, grabbed the password, and plugged it in.

And here's why I think this - as good as a coder as he might be, Gmail and Paypal use RSA 128-bit or better encryption and you'd have to be MIT or NSA material to break through that kind of thing (he probably is, but still..) - It's much easier to use information that you already have, or can get much easier, and see if it will work elsewhere.

And let this be a quick lesson to everyone else.. don't use the same password everywhere you go folks.

[Amele]

Re: FFXI Wiki.. hacked?

No I cought the attempt to make Taj look like something he's not.

what attempt? I suppose you consider corporate whistle-blowers villians too? there's a rather wide continuum between "villian" and "hero" and honestly, that you quoted from the tl;dr summary (hell, that you didn't even quote the -entire- tl;dr) and not from the relevant section of the actual post says to me that you didn't bother to actually read what I had to say and just reflex posted.

face;ganiman;balls;etc.

They don't usually call a sure thing a gamble.

anyone with the capability to set up a wiki and a forum knows enough about internet security to know that you use at least a couple different passwords (if not every one unique) so yes, it's a gamble to assume that the wiki admin password would be the same as the gmail password.

considering the gmail was leaked first, I'd say the intrusion was there (since that's the "sure thing" to get both locations.)

[Mhurron]

Re: FFXI Wiki.. hacked?

Where was the thing you are labeling stupidity just so we are on the same page.

What do you call someone who posts his illegal activities on a public forum in a manner that is easilly traceable back to themselves? He's no more clever then a thief walking home in the snow from his latest heist and wondering how he got caught.

[Sevv]

Re: FFXI Wiki.. hacked?

[Olorin401]

Re: FFXI Wiki.. hacked?

1) BG is a pit of conceited self-interest that does just as much harm as good by trying to dictate how everyone should play the game. Figuring out how the game works and providing the masses with the info is one thing; lambasting any and everyone that dares to blaspheme against the "Almighty" BG way of doing things is pathetic to the extreme. Spending this much time and effort over something that's ultimately completely unimportant is more or less proof itself (also, the number of Tajwagoners that lined up to stroke and do other things to his e-peen is sickening in its epicness).

Well yes, but the actions of these conceited self-interested individuals, in particular Taj, seem to have brought to light a entire different realm of scumbaggery. The best comparison I can think of is Nash's Equilibrium - There's more than one method to show someone is dishonest, and being dishonest in your own methods is one way to do it.

[Sevv]

Re: FFXI Wiki.. hacked?

Nope, just a common criminal. A stupid one at that.

Where was the thing you are labeling stupidity just so we are on the same page.

BG as a linkshell, maybe, the forum is a different matter. I've heard the complaint a few times now.

Really know, and how often are you on BG? Contributing to the site where. Now it could be easily said you are biased against Bg.

I still find the "upstart" BGWiki's timing incredibly convienient.

After the second thread when more info came out about the deal etc, most people were not going to wiki. So now common sense says if your community used wiki and they are free to make, and you can manage your own there could be reason to make one.

again to your idea:


protip: Don't try and call an conspiracy on someone then keep posting one of your own.

The problem here is that people like you and (more annoyingly) SevIfrit seem to think we still haven't. We've all read it and we've all formed our own opinions.

Wait so it is ok to debate of my opinion but when it continues its a problem? So you want to blow holes in one side and have no one talk back? Nice. Everyone is entitled to an opinion, yet I get shit for mine right.

Some of us clearly side with BG.
Some see FFXIC's side.

If you are decided then its over, for each person.

Some of us clearly don't care.

Exit is that way =>

Some of us want more evidence.

If you are not decided this would be what you should want.

Some of us think what FFXIC did was bad, but will use the site anyway because its is a good community resource.

If that is groups feelings then again it is fine but even the mention in the first place, was people bitching there is a right to allow the information. You can chose to use it and I can chose to boycott it, very simple.

If you're so up in arms about this, fine, but stop acting like no one here as read it. The entire FFXI community has beaten the issue to death, there have been loldebates in Whitegate about it and the person with the biggest "lawls" to gain over it are the people who don't browse forums at all.

When their is something posted by a person that proves they did not read the op, it is safe to say that they didn't read it.

Now, I know that a lot here are trying to make a day go faster, but damned if I'm going to read 40 pages of anything from BG's forums. I'd go stand in traffic if I wanted to mess my head up that bad.

First off its ten pages, and people said BG wasn't mad about the hacking at first.

[Murphie]

Re: FFXI Wiki.. hacked?

While I don't think that Taj is a hero, I am glad that he brought this information to light (although I don't approve of how he did it). It's obvious that the FFXIWiki people weren't ever going to come clean.

I mean, it's not as though I would have cared if I didn't know, because, hello. But now I do, and I have the option of no longer using the Wiki. Which I probably won't. Which, again, not a big deal. They have tons of regular users that aren't going anywhere.

[Mhurron]

Re: FFXI Wiki.. hacked?

and you entirely missed the point of that post, apparently.

No I cought the attempt to make Taj look like something he's not.

you could push through the wiki and then gamble that the gmail password was the same

They don't usually call a sure thing a gamble.

[Omni]

Re: FFXI Wiki.. hacked?

ya, sorry. wasnt really caring much for the drama.

just when i hear admin account getting hacked, i auto-think of weak user/pass followed by weak admin.

[Amele]

Re: FFXI Wiki.. hacked?

Probably just had a script guess passwords against an admin account. It doesn't sound like he had any control beyond the wiki software.

wow people posting fast.

if I were to do it, this is how I would do it: 1) gain access to gmail (it's been quite vulnerable lately.) 2) gain access to wiki via 'forgot my password'/ force reset password

alt. you could push through the wiki and then gamble that the gmail password was the same (keep your passwords different folks) the password for the wiki in question was a standard dictionary word (one that I could've written a perl script to guess in less than 5 minutes)

if you didn't bother to -read- the post on Taj's blog, maybe you didn't realize that someone got gmail access too.

[Omni]

Re: FFXI Wiki.. hacked?

he hacked the gibson with zero cool, cereal killer and acid burn

Probably just had a script guess passwords against an admin account. It doesn't sound like he had any control beyond the wiki software.

ah yes, lemme guess... the administrator account was actually named administrator and the password was all 4 letters.

serves him right.