AO3 hit by security breach, site could stay down for up to four weeks
Archive of our own (AO3) hacked
The Organization for Transformative Works says it detected a security incident on AO3 and has taken the archive offline while it investigates. No works, bookmarks, or kudos were deleted, but the team cannot rule out that the user database was stolen, which could expose usernames, emails, IP addresses, and hashed passwords. AO3 collects no real names, and donor records sit in a separate system. Restoration is expected to take two to four weeks, possibly returning first in a degraded, read-only state.
Even so, no hashing method can fully protect a weak or reused password from being cracked.
- swyx
> Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far. However, we want to make some things clear:
First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.
Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.
AO3 does not collect real names, so none could be exposed. Additionally, our donor information is held in an entirely separate system and is never linked to AO3, so that data has also not been exposed.
We will update everyone as our investigation continues; we may be unable to respond to individual inquiries from users. Please keep an eye on our official outlets for updates. Our next update will be posted when we have further information available.
Our current expectation is that AO3 will be down for a minimum of two wee […]
- wmf
Discussion from yesterday: https://news.ycombinator.com/item?id=50293546
- tialaramex
> The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3
WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
- MattGaiser
I guess this is just going to be the next few months/years, as HN right now is just breach after breach.
- blurbleblurble
I wonder how many breaches are going undetected/unreported