I've just logged into someone else's account, using my own details?

[WorraLiberty]

I have no idea how this happened?

I logged in using my usual email address and password, went to TIO and realised I hadn't been on any of the threads in question and the account settings were completely different

Then I realised it was someone else's account? Needless to say I logged straight out. I entered the same details again and now I'm back as me.

For the record, I'm not a name changer and have never heard of the person who I logged in as (see attached pic).

You're welcome amicissamma

But just to clarify, I didn't accidentally impersonate you. Luckily enough I realised immediately I was in someone else's account and logged straight out.

If your OP's posts weren't highlighted in green...as opposed to my pink, or if I hadn't have gone straight to TIO, it would've been another matter and your reputation as a sensible poster, would've been shot to shit

Having logged out twice and logged back in again twice, I am now showing as myself and not PorkPatrol. I’m a really infrequent poster here, so I’m not really au fait with the messaging functionality, but I’m assuming that I could have accessed PorkPatrol’s private messages and personal settings and data, had I wanted to? Wow, as an adoptive parent, I am phenomenally phobic about sharing my private/personal information online (I have no social networking accounts whatsoever, for this reason), so I would be beyond horrified if anyone had been able to access my personal information because of a MN security lapse. MNHQ, please can you reassure me that my account has not been compromised?

PorkPatrol, I’m so sorry that I was given access to your account in this data breach, but I would like to reassure you that I logged out as soon as I was aware and that I did not attempt to access any private messages or other personal information linked to your account.

This might be completely unrelated but during previous security breaches other sites also had a problem, one being Ebay at the same time as one on MN.

I had an e.mail a few days ago to tell me that Houzz had been hacked. It might be a similar thing, and may not be the only site affected.

Wow. This is really very serious.

No such problems, but something has definitely changed on MN. The account settings pages look different. I also noticed that I had to fully log in with my password, when previously it was saved. I wonder if MNHQ have been tinkering with another fresh look for the site, and these problems are related to that?

So it's an error that occurs when logging in?

This is very worrying

BBInGinDrinking, MNHQ rolled out a new bit of tinkering on Tuesday www.mumsnet.com/Talk/site_stuff/3499990-New-settings-menu?msgid=84717647, it looks as though the current problems may well be related to that.

Fortunately when I logged in this morning I am me!!

Can you confirm that my privacy has not been compromised?

I logged in today under a different name that I sometimes use, and went to change back to this one. It seems like user names are no longer password-protected?

They're not, Water; this is what MNHQ said on the thread that I linked to, above :

"You no longer need to enter your Mumsnet password when changing your username. We did this so people who sign up to Mumsnet via social (e.g Google or Facebook) can change their usernames. Previously they weren't able to, as they don't have a Mumsnet password (they log in to Mumsnet via their Google or Facebook account instead). Also on the Mumsnet app you dont need to enter your password to change your username and we'd like to keep the experience consistent where possible."

Um. How do we know if our data is safe.

Yes I changed my password on Monday on my work laptop

I expected to be logged out on Mumsnet on my home laptop as a result, as I think this has happened before, but I wasn't

In addition, I have previously logged out of Mumsnet on one device (e.g.) my phone, and found that I was logged out anywhere else I was using Mumsnet. This did not happen on Monday either

How do we know if our data is safe

You don't know and it plainly isn't safe.

I'm honestly surprised that login has not been temporarily suspended which this problem is running. It smacks of not understanding the importance of the issue, particularly on a site which encourages sharing of often quite personal information.

Its plain that it wasn't just a one off incident and it was reported more than 8hrs ago.

It may or may not be related to the changes a couple of days back but those changes are an obvious candidate to investigate. Its bad practice to allow account changes of any material kind without a password and you should also be logged out of all devices when you do change password.

Not sure if this is related but I keep being logged out and when I go to put my password in , says not recognised. I'm still me , same user name for the past think 2 years. iPhone if that helps. Sorry to crash thread

This is a data breach which should be reported to the Information Commissioner I’m afraid.

Crazy stuff! Anyone who got my username would be sadly disappointed that I don't post anything interesting confidential. I made it my policy years ago that I'd never post anything that I wouldn't want anyone I knew to read over my shoulder in RL.

But people can, and do, use this forum as a place to share their thoughts that they wouldn't tell a soul in RL, because they feel protected by the anonymity of name-changes. It must feel awful if that has been compromised.

This clearly isn't a one off and maybe MNHQ need to consider shutting the site while it's investigated.

At the very least login and changes should be suspended.

One gets the impression that @MNHQ see it as a bit of a tech glitch rather than a sodding great hole in security exposing their entire user base.

Happened to me on Tuesday when I logged in on the site, I usually use the app. Logged out and back in again and it was correct.

Test

Ok Namechangedtest was me, trying out this no-password name change thing.

I am a software tester and this sort of thing is the stuff of nightmares

MN will have had to take the decision to shut the site down, or continue as normal whilst behind the scenes they are trying to fix this

I imagine their dev team are on it, but fixing something as complex as this may take some time (the FB/google login systems add complications)

IMO this is not an uncommon thing to happen, as websites have become more complex, they are harder to monitor/test (and companies don't like to pay too much on boring old testing )

Holy mackerel!

I don't understand the casual tone of HQ's replies???

And now you don't need to use your password to make name changes? Is this some sort of joke?

I'm off until this gets sorted.

I can't believe this is still going on. Terrible data breach implications