FurAffinity Bomb-Dropping

[magedragonfire]

I know at least a couple of people on my flist here do work on or have accounts with FA, so I figure this is worth passing on:

Turns out Dragoneer is a beastiality and rape apologist, and Zaush is an alleged multiple rapist, and your private messages are open to all admins who care to read them. There's been a whole saga brewing over the past week, so I hear, but all of the pertinent details are summed up over here with links to screengrabs highlighting all of the above. I'm too disgusted to say much more about it, frankly, but I will say that it's high time the community found another spot for arts.

Comments

[palmer-kun.livejournal.com]

Anyone with database access would be able to read PMs or anything else. It's just a simple database lookup.

However, this looks like the site code was designed expressly to go through PMs, which is a different issue altogether.

I would strongly suggest that anyone who is on FA change any passwords that are the same as their FA password.

If the code lets him check PMs... it just as easily could let him check passwords.

I know for a fact this is a simple matter - I've done it myself as a forum admin (as part of tracking down and banning socks).

Unless the forums were using a standard forum package (where the code prevents password snooping from the get go), it's quite likely you're exposed.

[magedragonfire.livejournal.com]

Apparently the foundations of the site were built on rather shaky and insecure ground as is. Hackerfolk have been poking all sorts of holes in it over the past few months, I guess.

Still, I think the security issues here are the least of anyone's worries.