Hello

Great to see we've helped haul some of you back into the liferaft; apologies to those who are still struggling.

It's still best to sort individual difficulties by mailing us at [email protected]. Our mail backlog, while still bigger than we'd like it to be, is reducing now and hopefully we'll be able to work with those of you who have thornier problems for whatever reason.

We can't merge accounts, but hopefully with a bit of elbow grease we can help people get back into their old ones.

Hi VeryStressedMum

Sorry for all the faff - just letting you know that we've mailed you a fresh password reset link now. Please email [email protected] if you don't receive it, we're determined to sort this out for you!

Hi folks

We've created a page explaining exactly how events unfolded: Mumsnet and Heartbleed as it happened

Tech's take on this is that the theft of rootsess cookies is practically quite difficult/rare (eg the hacker would have to be sharing an insecure wireless connection with a Mumsnet user in the act of exchanging information with the server), so it's outweighed by the very real effects sitewide https would have on user experience, especially slower browsing. It would also make it difficult for us to operate sub-domains like Mumsnet Local on the same server.

Hi MrsUggy - we've actually just introduced https on every page that requires you to enter your log in details.

Curiouser and curiouser - are you using the app or the site?

I hesitate to post because I'm not 100% on this, but I think it might mean you're safe - then again it's possible something (eg to do with cookies) means you're not. I will check with Tech, but want to reiterate that there's no evidence this hack was done with anything other than the intention to raise awareness at this stage.[/quote]

Hi again TigerSmoke,
As said, whilst it’s impossible to say how many usernames and passwords were accessed via Heartbleed, we have checked and we re-booted all our servers 57 days ago which would have wiped the memory, so we're confident that anyone who hasn't logged in since then wouldn't have been affected. Hope that helps.

Hiya,
NobleGiraffe has actually answered a lot of your questions very ably already but by way of further reassurance:

Our passwords are stored in encrypted form in the database, but like most other sites our login form sends the username and password in plain text, wrapped in an encrypted SSL envelope to avoid eavesdropping in transit. When they arrive at our server, the envelope is decrypted. The Heartbleed bug allowed access to this data as it arrived at our server.

The hackers did not copy passwords from the database, they obtained them from the web server’s RAM via Heartbleed - two very different scenarios.

It’s impossible to say how many usernames and passwords were accessed via Heartbleed, but what we can say is that we re-booted all our servers 57 days ago, so we're confident that anyone who hasn't logged in since then wouldn't have been affected by this.

The Heartbleed bug has in fact made us revisit our use of https (SSL) across the site. Previously we only used it on the login page. However we are now in the process of using https on all pages where the user’s password is entered.

We agree that this is best practice and improves the security of the site overall (but let's be clear, not following this practice had no bearing on this security breach).

To folks who can't reset, but are able to post here.

Anyone who hadn't reset their password before 13:49 (ish) yesterday would have been forcibly logged out, so you had to reset, else you wouldn't have been able to log in.

Sooo, if you're able to post here, you must have been able to reset your password, hurrah!

However, if you didn't reset your password before yesterday, and you haven't been forcibly logged out, and have just stayed logged in, something has gone wrong - so please shout!

Hm, the lady doth protest too much methinks

Things are all still a bit up in the air (understatement of the century), and we can't be sure whether people who appear to take credit for the hacking were genuine or not, so we're not making any hasty decision.

We do totally see what you mean though, and it does seem that it was done to highlight the problem, rather than to be overtly malicious.

Ah, sorry we've confused ourselves here. The forced log out would have only happened to those who hadn't done their password reset after the passwords were wiped. So we're guessing you must have done yours sunbathe!

Hullo TheDetective - we're afraid that since we've wiped everyone's password from our data base, we can't tell you what you password was. In any case, due to data protection, we can't send out people's passwords, and it would be the same even without Heartbleed.

We suggest that to be on the safe side, it might be an idea to change your password for the sites you're worried about.

We honestly don't know Viva! Sorry we're giving such vague answers, but anything we do find out we'll pass onto you guys.

The bug allowed people to see information that you submit via the log in page, which means your username or email, plus your password.

Beyond that, we really don't know what the hackers have done with this information. We realise that must be frustrating to hear, and if we knew any more we'd certainly tell you. But the fact is we can't be sure.
However, we have no reason to suspect, and no evidence to suggest that anyone's account has been used for anything other than to flag up the security breach.

We're afraid we can't definitely say what the hackers have or haven't got, which is why we're advising folks who use the same password for Mumsnet as other stuff to change them.

This should have happened, has it happened yet?

I hesitate to post because I'm not 100% on this, but I think it might mean you're safe - then again it's possible something (eg to do with cookies) means you're not. I will check with Tech, but want to reiterate that there's no evidence this hack was done with anything other than the intention to raise awareness at this stage.

No, it doesn't NTWM, we logged everyone out on Saturday to require everyone to reset their password. I'm afraid we have no way of knowing which users' accounts were hacked, if any, beyond the handful of names that were used to post on here/published on pastebin.

And we have no way of knowing whether any of that info was used to access pms, profiles etc. All we can say is that the hackers were keen to let us know about the breach and there is no evidence of any accounts being used maliciously, save really for mine and even that fake post from my account could be seen as more of a heads up than a malicious act.

No, sorry PuppysMum1, we can't help on that one - we encrypt the passwords so that not even MNHQ staff can find out what they are. Best bet is to change your password everywhere which has sensitive info.

No, that's not right, our passwords are encrypted but the heartbleed bug allowed access to live login pages (temporarily until we patched the site). We have no way of knowing how many login pages were accessed but obviously more than one was.

Hi CecyHall (how are you?).
You're right we did think things were ok because we'd seen the details of the heartbleed security risk soon after it was announced and had implemented the recommended patch/fix - so Tech was confident that we were secure. Unfortunately in the time between publication of the risk and implementing the fix - about a day - someone had been in and scraped some user data. This only became fully apparent when some accounts were hacked on Saturday in order to post a message about giving us a heads up about Heartbleed.

At that point, obviously, we became aware that we had a problem and decided the only sensible course of action was to force a password change and shout about the associated password risk as loudly as possible.

Hope that makes sense.

Hi all,

Tech have extended the amount of time you are allowed to click on the emailed link for. You now have 48 hours but only for links sent this afternoon onwards.

Please do click to resend.

We are still ploughing through your mails, apologies it is taking some time but if you have mailed in, please hang fire and we will get back to you.

Thanks all for being so patient.

Oh dear! Are you on the mobile site? Anyone else having trouble reading their PMs on there?

No you should be OK by the sounds of it

Poor Tech - this comes after a week of them struggling with poor broadband in the office as well (because of a third-party problem, not Tech's fault)