Required Password Change Today

[RasJay]

Attempting to long in today I get an MFA challenge. After entering my code I was required to change my password. A message stated my password may have been compromised. Upon changing my password there is now a requirement of 10 characters minimum. Was there a TalkBass breach? Or is TalkBass checking our password hashes against an online database of compromised passwords? If so we need to be informed. I have a career in IT as well as managing Cyber Security products and policies.

I do not see any information about requiring password changes or the 10 character minimum in the "TalkBass.com News & Announcements".

 

[60bass]

Attempting to long in today I get an MFA challenge. After entering my code I was required to change my password. A message stated my password may have been compromised. Upon changing my password there is now a requirement of 10 characters minimum. Was there a TalkBass breach? Or is TalkBass checking our password hashes against an online database of compromised passwords? If so we need to be informed. I have a career in IT as well as managing Cyber Security products and policies.

I do not see any information about requiring password changes or the 10 character minimum in the "TalkBass.com News & Announcements".

No issues for me so far with logging in. Perhaps the site algorithm for attempted password hacks by bots detected something. Triggering a new PW required message. I saw another message posted by a member who was also having login issues. I'm sure Paul or another staff member will address your issue soon.

 

[paul]

Attempting to long in today I get an MFA challenge. After entering my code I was required to change my password. A message stated my password may have been compromised. Upon changing my password there is now a requirement of 10 characters minimum. Was there a TalkBass breach? Or is TalkBass checking our password hashes against an online database of compromised passwords? If so we need to be informed. I have a career in IT as well as managing Cyber Security products and policies.

I do not see any information about requiring password changes or the 10 character minimum in the "TalkBass.com News & Announcements".

Hi! First, there was no breach on our server. We do check passwords against the database at Have I Been Pwned: Pwned Passwords via this addon to our forum software: Password Tools

I'll see about changing the messaging ("your password may have been compromised...") to specify the above database matching.

 

[RasJay]

Thank you for the update. The message was not clear as to where the password may have been comprised from. We use Crowdstrike and quarantine and force resets if it detects they have been compromised as well.

I have active items for sale here on TB which was my first concern about access to my account.