Spammers still getting through registration

[Carlos]

You are wrong because this has nothing to do with XenForo, as per my examples above. There is no connection between the generic Q&As used by the XenForo registration process and the personal Q&As used to secure personal information.

......Scroll down..

XRumer will NOT get this personal information from your XenForo forum because XenForo does not collect this type of personal information about you.

Bascially like an AI?

No - XenForo does not use personal Q&As to secure any information. The only Q&As used are generic for registration (and some guests permissions).

The admin sets the questions. [insert facepalm image here]

Yes, the generic, useless Q&As like "what colour is the sky". They are all in XRumer's database. They are useless for anything but posting spam on forums.

Uh huh. And people are... smart to not make those questions on e-mail providers that allow them? We're talking about... 800 million people.

Using a movie for you prime example is not helping your case. It's a movie for a reason.

Ya know, you need to shut up. Movies were derivatived from real stories.

 

[Sheldon]

Ya know, you need to shut up. Movies were derivatived from real stories.

What real story was Avatar made from, or The Terminator, TRON, or....?

 

[Edrondol]

If that particular hacker knows the game well enough, he can get right in... just few seconds. Some hackers, use their intuition in the equation, too. I was watching this movie, and this character, who was is a hacker looks at the person's picture that was being stood right across from him. He goes "you filthy man." then types the password, lo and behold, he cracks the entry. My question at that time was "Is that even possible?"

Okay, a couple of things before I stop tilting at the proverbial windmill.

• It doesn't matter if a hacker WROTE the game you like so much. A bank is not going to have as your security question: "What is the movement bonus for ships by choosing England in Civ V?" It's just not going to happen. The two bits of information - forum Q&A and personal identification questions - are like comparing Asia and America. Sure, they are both land masses, but they just aren't the same thing.
• You are basing some of your arguments from a 5 minute read of a product on Wikipedia and a hacker from a movie? I...I have no words for this.

Look, man. You are coming across as extremely paranoid. People are telling you you are wrong because your arguments are nonsensical and have no basis in fact or reality. You are attempting to cobble together some higher-arching conspiracy that is held together by nothing more that the wildest of conjecture. There is no way someone could crack my bank information from my forum Q&A. It's just not a possibility. To think it could be is rather silly.
Now it's your turn to tell me how delusional I am and that some day I'll find out that the CIA already has this information because of a chip they have implanted in my skull.

 

[Carlos]

What real story was Avatar made from, or The Terminator, TRON, or....?

Those are fiction stories. Some stories are based on real life.

 

[Sim]

You should. Because if you run a niche traffic gaming website like my network does, then they already know exactly what your favorite video game is. If that particular hacker knows the game well enough, he can get right in... just few seconds. Some hackers, use their intuition in the equation, too. I was watching this movie, and this character, who was is a hacker looks at the person's picture that was being stood right across from him. He goes "you filthy man." then types the password, lo and behold, he cracks the entry. My question at that time was "Is that even possible?"

But that's just social engineering. Like I said before - most personal Q&A questions you get asked to supply by banks and such (mother's maiden name, father's middle name, favourite colour, etc) are all things you can easily find out about someone if you are determined enough - they are not secrets.

I don't use memorable passwords for any of the thousands of logins I have - I literally couldn't tell you what most of my passwords are, I wouldn't have a clue. They are all long, randomly generated passwords which I store in a secure datastore (1Password) protected by a very long passphrase, which is the only thing I make sure I do remember.

There is no reason you can't do the same for those personal Q&A questions asked by the banks and such.

Q. What is your mother's maiden name?
A. asdhkjaerkjhas83y9wkj3namsh23

Q. What is your father's middle name?
A. aiou90uasdkj3eqwejjdkasjq3awdsjaksd

... the only time this would potentially trip you up is if they insisted on asking you to answer those questions over the phone. It would be a pain to have to tell the person in the foreign call centre your long random password

At the end of the day - it's up to you to be secure. If you choose to use security answers that can be guessed or socially engineered out of someone to secure important information ... then you must be prepared for the consequences if someone does one day gain access to that information.

So no, I don't care. I'm more concerned with someone going through my letterbox or rubbish bin and getting personal information about me than I am about XRumer accessing my forum. But even then, they have these things called shredders, and I believe that fire does a pretty good job of destroying paper too.

 

[Alien]

 

[Sim]

The admin sets the questions. [insert facepalm image here]

Uh huh. And people are... smart to not make those questions on e-mail providers that allow them? We're talking about... 800 million people.

Umm ... is your password to your online banking site: 12345678?

How about: password? Passw0rd? 87654321?

If you are that stupid, then you deserve to get your account hacked. We can't protect people from themselves.

If I'm trying to hack someone's email account and the security question I get posed is "what colour is the sky" ... do you really think I'm going to get stuck on that?

If people are using stuff like this to secure important information, then there is nothing we can do to help them and this argument is pointless.

There's no need to get paranoid about it ... just make sure you take your own security measures and move on.

 

[Carlos]

You are basing some of your arguments from a 5 minute read of a product on Wikipedia and a hacker from a movie? I...I have no words for this.

Wikipedia is a reliable source. It was written by real people. And I'm not basing it on "hacker from movies." It's. just. an. example.

You're the one who's over dramatic. Assuming that I'm basing this on a few things. Like I'm stupid.

Look, man. You are coming across as extremely paranoid. People are telling you you are wrong because your arguments are nonsensical and have no basis in fact or reality. You are attempting to cobble together some higher-arching conspiracy that is held together by nothing more that the wildest of conjecture. There is no way someone could crack my bank information from my forum Q&A. It's just not a possibility. To think it could be is rather silly.

Look, man. I'm not paranoid. I'm wrong because people don't like me. Like Stewert over the last 3 posts alone, has been trolling me by sarcasm. I let his last post slide, but next one will be my first report. I'm not trying to cobble together some higher-arching conspiricy held together whatever...

"There is no way someone could crack my bank information from my forum Q&A. It's just not a possibility. To think it could be is rather silly." Sillier things have happened. Stranger things have happened. I didn't think that WiFi would be a security nightmare by itself, and I didn't think a hacker would go to hotspots and try to steal information. GUESS WHAT!? I WAS WRONG. It happens, and it hapened to me too. But I was quick to fix it. Because when you have intelligence like I do, and you're able to connect the dots just as quickly... You can protect yourself. However, people will always hate on me because they don't believe what I say. Fine with me, man.

Now it's your turn to tell me how delusional I am and that some day I'll find out that the CIA already has this information because of a chip they have implanted in my skull.

Nope. Not calling you delusional, just wrong. And that chip thing is a real thing.

Umm ... is your password to your online banking site: 12345678?

How about: password? Passw0rd? 87654321?

No, but those are popular passwords. That's been documented over the last year or so now.

If you are that stupid, then you deserve to get your account hacked. We can't protect people from themselves.

Tell that to the millions of FB account holders, man.

If I'm trying to hack someone's email account and the security question I get posed is "what colour is the sky" ... do you really think I'm going to get stuck on that?

Yeah. Maybe this account won't have it, but the next account may have it. You never know. Hackers have a mentality, man.

If people are using stuff like this to secure important information, then there is nothing we can do to help them and this argument is pointless.

Again, tell this to the 800 million account holders.

There's no need to get paranoid about it ... just make sure you take your own security measures and move on.

Don't judge me based on what I post. I'm not paranoid.

 

[EQnoble]

I'm only going to respond to EQnoble or people who are trying to be nice...

On paper, yes. That's true. This is typically done on forums, blogs, and other websites like it. Keyword: Typically.

Yes. Correct. But when you have xrumer on the market, whose database does not just cover forums and blogs.. And their flexibility to derivative from their original purpose, can go into larger scope of things.

Yes, but Q&A is not restricted to forums and blogs.

I'll go into detail next point...

A database of older, well known Q&A's [once again, index] is a security nightmare.

Because, nevermind that xrumer is originally designed for forums and blog spam. Nevermind that. Take that idea and throw it out for a second.

The list [database] of Q&A's is a list telling spammers what possible answers is to this question(s). Are we clear on that? Okay, moving on.

MATCH that database to whatever account [insert site here] retreivable account info. You now have access to the account in question. Then from there, you have access to the actual forum, social network, or website account. By large, websites require you to have an e-mail address.

Based on what I pointed out earlier:

That 850 million un-suspecting members that used generic answers to questions that should only be known to yourself... turns out to be a popular "Q&A* answer. Why? Because both the question, and the answer is in a database! Result: Many, many problems.

Yeah, this thread was about xenforo, but the thread got off topic, people assume I'm confused and the topic has to go off topic.

I will say this Carlos...

I am familiar with what I am saying...have you personally tried XRumor?

 

[Carlos]

I will say this Carlos...
View attachment 46997
I am familiar with what I am saying...have you personally tried XRumor?

Great, another hater that tries to debunk what I'm saying. Fantastic!

 

[Sheldon]

Question... has any of this been tied up into a singular point?

Other than movie references, what ifs, and could be's, I fail to see how this is any issue for anyone other than Carlos.

 

[Sheldon]

Great, another hater that tries to debunk what I'm saying. Fantastic!

He was asking if you were familiar with the product? How does that make him a hater?

 

[Carlos]

Other than movie references, what ifs, and could be's, I fail to see how this is any issue for anyone other than Carlos.

The more you insult me with your assumptions, the more I hate you. You think that I have a "problem" with this "issue." Wrong. So, since this post was actually a sarcasm post, you're reported. I warned you, man. I did.

He was asking if you were familiar with the product? How does that make him a hater?

Go on, defend him. He's assuming I'm dumb. Just because I'm not familiar with what it does [like, from the actual use of the program itself], doesn't mean I don't know what it is.

 

[Sheldon]

Go on, defend him. He's assuming I'm dumb. Just because I'm not familiar with what it does [like, from the actual use of the program itself], doesn't mean I don't know what it is.

If you don't know EXACTLY what it does, how are you able to assume this thing is going to break into my bank account, my paypal, find out my library card number, etc?

 

[Carlos]

If you don't know EXACTLY what it does, how are you able to assume this thing is going to break into my bank account, my paypal, find out my library card number, etc?

I think you're missing the whole reason, and I've been saying it this whole thread. I'll let you figure that one out.

It's not really that hard, man. Not really.

 

[Sheldon]

I think you're missing the whole reason, and I've been saying it this whole post. I'll let you figure that one out.

Honestly Carlos, at this stage, I don't think you know the whole reason.

 

[Carlos]

Honestly Carlos, at this stage, I don't think you know the whole reason.

It's my reason. Dumb@$$.

Let me spell it out for you, the answer would be:
xrumer has a database of Q&A's.

Based on the logic that the most popular passwords or PIN's. It's the same idea, and it's the same logic.

 

[Sheldon]

It's my reason. Dumb@$$.

Exactly, and yours alone. No one else sees an issue, and the ones you keep bringing up are ones you are creating in your head.

The final point is, YOUR FORUM Q/A WILL NOT GRANT HACKERS ACCESS TO YOUR OTHER DATA.

End of discussion.

 

[Sim]

If you don't know EXACTLY what it does, how are you able to assume this thing is going to break into my bank account, my paypal, find out my library card number, etc?

I believe his concern was that hackers would get access to the Q&A information in the XRumer database and be able to use that as an attack vector on any other site which uses Q&A for security.

Certainly, if the site in question has the ability for people to set their own questions as well as answers, AND if someone was silly enough to use a general Q&A like we would use to prevent bots registering on a XenForo forum, AND if XRumer also knew the username and password for that particular users account, then potentially, you could use XRumer to gain access via it's database of Q&As.

The username and password bit is generally a show-stopper though ... unless you already have that information because you have successfully hacked someone's database and used your rainbow tables to crack the password encryption ... but a little Q&A isn't going to stop you there anyway - especially since the person used a generic Q&A like that which XRumer collects and is thus human guessable by design.

... like I said, it's not really an issue.

 

[Carlos]

The final point is, YOUR FORUM Q/A WILL NOT GRANT HACKERS ACCESS TO YOUR OTHER DATA.

I will laugh so hard if you ever use the same Q&A's for forum and other services. Then hacker gets your own e-mails, your own bank info, your own FB account. I will laugh, hell even to your face.

What I said is: It. could. happen.

I will laugh so hard, that my next door neighbor will be scratching his head where that laughter is coming from. I WILL #@^&ING LAUGH.