Active discussions

Please or to access all these features

Talk

Back to thread
MNHQ

Due to a security breach we are resetting all passwords across Mumsnet

83 replies

RebeccaMumsnet · 12/04/2014 17:32

Following the recent security breach related to Heartbleed we are reseting the passwords of all users.

On Saturday 12 April, we will remove all passwords from our system and to use the site, you'll need to reset your password by clicking on the password reset link.

Type in your email address and click the 'Request reset' button and you will receive a mail to your Mumsnet registered email account. (You will need to click on the link in the mail within 30 minutes of receiving it, without changing the device you're using i.e swapping from phone to laptop, or you'll need to request a further reset).

If you do not receive a mail, please check you spam folder. The password reset mail will come to the email you used when you first registered with Mumsnet.

If you don't receive or can't access your reset mail, please [email protected] for help.

We are very sorry for all the fuss. We want to assure you that we followed all the published steps to protect members' security as soon as we became aware of the heartbleed security risk, but it seems that the breach occurred prior to that risk becoming known.

Most importantly, if you use the same password here as elsewhere, we strongly recommend you change your password on the other sites too.

Thanks,

Justine & the MNHQ team

Go to post
MNHQ

RowanMumsnet · 12/04/2014 21:20

sorry x-post Inspiration - can you email in to [email protected]?

MNHQ

RowanMumsnet · 12/04/2014 21:19

@InspirationFailed

I can't change my password.

I clicked the link to reset

Change the password

Try to log in and get the 'unverified account' message and it tells me to click a link in the confirmation email.

But there is no link in it, so I click to resend the confirmation email and get this message (on the photo)

I'm assuming I'm logged in now under my old password (I clicked to log in with google and it logged me in without me having to put any password in)

Hmm that's odd - anyone else finding that the Google log-in is allowing you to circumvent the password reset?

Sorry Inspiration, your photo didn't upload

MNHQ

RowanMumsnet · 12/04/2014 21:17

@trace2

We need to know if mumsnet has been patched because if not then the new password will be as vulnerable as the one it replaces.

Yes we did the patch last week trace2 - our best guess is that the breach occurred before then

MNHQ

RowanMumsnet · 12/04/2014 21:14

Aw don't worry, we get looked after Grin

MNHQ

RowanMumsnet · 12/04/2014 21:08

@Maryz

Poor Rowan.

She is missing BGT.

Actually lucky Rowan Grin

Nooo it's worse than that, I'd promised DS1 a trip to Pizza Express somewhere posh for dinner and now he's looking at me like Hmm while playing on the Xbox

MNHQ

RowanMumsnet · 12/04/2014 21:00

@firstchoice

hmm. have tried twice. firstly got 'page not available'. now not got an email to my email addy re password re-set.

so do ALL passwords on all site (ie personal banking / paypal etc) need re-setting????

Apologies and please keep trying - it's being a bit glitchy because of the sheer numbers doing it. (Assuming that the email address you're checking is definitely the one that's registered with us?)

MNHQ

RowanMumsnet · 12/04/2014 20:57

@SwedishEdith

Ok, I changed password when I logged on at about 17.30- 18:00?? this evening (all as per the instructions and via the mn email link etc) Then I got another email again about an hour later from mn. Is this just a precaution that's been sent to everyone or....??

Sorry, this isn't deliberate - it did the same thing to me!

MNHQ

RowanMumsnet · 12/04/2014 20:53

@ItsAllGoingToBeFine

If you use login with google/login with Facebook do you need to change your google/Facebook passwords too?

We'll try to find out for sure, but tbh the current best advice is to change everything

MNHQ

RowanMumsnet · 12/04/2014 20:35

@Sirzy

I don't have access to the email address I registered with anymore (well I can't remember the password or it!) does that mean I need to set up a new account or can i somehow change the email it is linked to?

If you email [email protected] we will take a look, but given the volume of mail we're getting tonight it may not be as quick as response as we would ideally like - sorry. Obvs if we're going to manually change people's email addresses we want to be sure we're definitely dealing with the genuine account holder so it will take some back-and-forth and checking and we may not be able to do it all tonight.

MNHQ

RowanMumsnet · 12/04/2014 20:34

@Lucked

Sorry HQ I am not getting this to works.

When I click on link in email it says link expired despite being within 5 mins of requesting it.

Sorry, a few people are saying this - it may just be sheer load on the system so we're advising people to wait an hour or so and then request a fresh link. Apologies

MNHQ

RowanMumsnet · 12/04/2014 20:13

@SheherazadeSchadenfreude

I am confused. I changed my password last night - do I need to change it again? And it wouldn't let me log in using this username. I tried using another one I've used recently, that didn't work either, but an older name did?

If you log out, and then try to log back in, you'll be forced to change password again - sorry

MNHQ

RowanMumsnet · 12/04/2014 20:11

Those being told you can't use special characters - what devices/OSs/browsers are you using? Just seeing if we can spot a pattern.

MNHQ

RowanMumsnet · 12/04/2014 20:05

@Maryz

Don't go pm'ing links to people.

There was a very short list of names and passwords which was online for about 20 minutes. It was found by googling, so anyone who is worried (and I only recognised one name on the list, who isn't on this thread) should google.

Rowan - I know MNHQ have that link (it was a post withdrawn on the other thread, but I'm sure you have it) - maybe email those dozen or so names directly rather than people pm'ing each other.

Yes, we're on it

MNHQ

RowanMumsnet · 12/04/2014 20:01

@doobedoobedoo

Changed my password, but I tried to use a number of symbols in it such as $%@_#+ and I wasn't allowed to. I could only use letters and numbers.

Letters and numbers alone make for very weak passwords. Upper & lower case help (assuming MN software recognises the difference? - I haven't tested that out), but they are still weak if people use real words.

Any chance that Tech could do something to allow other characters in passwords?

Pretty sure you can use special characters because I did - did it explicitly tell you you couldn't?

MNHQ

RowanMumsnet · 12/04/2014 20:00

@ItsAllGoingToBeFine

We are sending a message to everyone on our database with the exception of those who've specifically asked to receive no email from us; that will go out soon, probably before the end of today

TBH I think you should send to everybody, opt out or not.

If we do that and lots of people report us for deliberate spamming we could end up getting all our MNHQ emails to our users blacklisted, so it seemed best not to tbh - we're hoping any active users will see the stickies or hear other users talking about it. And of course eventually they'll be forced to reset their passwords anyway.

MNHQ

RowanMumsnet · 12/04/2014 19:56

@RandallFloyd

Just realised I only have virtual gin I'm afraid. If you want actual booze I have a bottle of cider and some honeycomb baileys

Do I look fussy?

Honeycomb Baileys, mmmmm

MNHQ

RowanMumsnet · 12/04/2014 19:46

@LocalEditorMerton

Any value in posting thread across all the Local sites too HQ?

That's a good point but sadly it's not something we can easily do I don't think - we'll take a look

MNHQ

RowanMumsnet · 12/04/2014 19:41

@RandallFloyd

More Rowan?

About four pints please

MNHQ

RowanMumsnet · 12/04/2014 19:39

@StolenStollen

HQ, I've emailed you on [email protected] email.

Thank you - we're afraid we're absolutely drowning in mail from people at the moment so it may be a while before we get back, but we'll be as quick as we can.

MNHQ

RowanMumsnet · 12/04/2014 19:35

Sorry all - obvs there are thousands of people changing passwords right now so there's a big load on the system. Plus (human error and all that) it may be that the password you set on the reset page isn't exactly the same as what you're trying to log in with.

So it may be you have to do the reset process more than once - not ideal we know but it's worth a try.

App users - unfortunately we're limited in what we can do on the app, particularly over a weekend - it's one reason we're making our own new one. App users will hopefully see the sticky - if not they will (so long as they haven't opted out of all email) be getting our mass email at some point later on today.

MNHQ

RowanMumsnet · 12/04/2014 19:03

@StolenStollen

I've clicked the link and submitted my email but I haven't got an email from HQ yet. Do I try again or email hq?

Hello - are you checking the email address you used when you registered with MN?

If so, might be worth checking in the spam folder.

If that doesn't work, try asking for a new one - loads of people are re-setting at the moment so there may be a few glitches.

MNHQ

RowanMumsnet · 12/04/2014 18:44

Hello

You won't be forced out of a session - ie if you were already logged in and posting when the forced password reset occurred, you won't have been forcibly logged out. You will be forced to change your password next time you need to log in though.

We are sending a message to everyone on our database with the exception of those who've specifically asked to receive no email from us; that will go out soon, probably before the end of today.

MNHQ

ShamTech · 12/04/2014 18:09

The info that was gathered was the info that is submitted via the login form which is the username, password and whether or not you ticked the 'keep me logged in' checkbox. They would only gain access to your other information if they subsequently logged in as you. If you reset your password to the same password as before your information won't be secure, so please make sure to use a new password.

MNHQ

RebeccaMumsnet · 12/04/2014 18:08

@LEMmingaround

When you say strongly recommend for other sites, do you mean strongly recommend or to be on the safeside recommend, i have lots of sites to change!! :(

Stressed nown - what sort of threat are we talking about here?

Strongly recommend especially if you use the same password across lots of sites.

It is not just MN that has been 'exposed'. The advice from the media as a whole is to be extra vigilant and reset your passwords.

MNHQ

RebeccaMumsnet · 12/04/2014 18:04

@BeerTricksPotter

It doesn't have to be the original email. It was sent to my new one, when I put that one in.

Does that mean it's still open to nefarious behaviour , or did it allow it because the new email address was on the system?

Mail in Beer, I'll take a look

Watch this thread for updates

Tap "Watch" to get all the latest updates