Guild Wars Guru Security Notice

About the wartower.de incident:

I'm german and I skimmed through the thread on their forums, the admin mentioned that their passwords are md5/salt protected, so their message that passwords were stolen might be a bit over the top. It seems the attackers merely aquired the encrypted password file.

I'd still recomend changing your password of course. All vBulletin forums will md5 passwords, and anyone on the ball with security will have them salted too. That said, I think it's a mistake to imply that 'things might be ok'. Anything that is encrypted can be cracked, it's just a matter of time and resources.

It is our (fansite admins) responsibility to ensure people change their passwords, and talking down the risk (however insignificant it is) is not the way to do that.

Character names were wiped from the forum two months or so ago, when the change to remove them was first implemented. While the Character names were wiped from the forum database, they are a required part of the Auction database to facilitate in game communication between buyers and sellers.

Since the Auction database was also hit, it is that much more necessary that people change passwords, and keep unique email addresses for each fansite.

While the Character names were wiped from the forum database, they are a required part of the Auction database to facilitate in game communication between buyers and sellers. Character names are part of the Auction House user table, yes. In the post you quoted I was responding to a concern about them having been listed on the forum.

If I dealt more with the Auction House it probably would have been instinctive to add that clarification.

Both, sadly. Gotcha, thanks for the reply

If I dealt more with the Auction House it probably would have been instinctive to add that clarification. It's ok JR, and trust me, you don't want to have to deal with the Auction .

I just wanted to make sure people knew that while we were able to remove character names from the forum database, it's just not possible with the auction and still have it as a functional thing.

Again, if users are following the often repeated security recommendations of using unique emails, usernames, and passwords for each area/site, having character names available really does not pose that much of a threat, however, if people have not followed those recommendations, things like this can be more problematic.