Also curious to know how the security breach happened.
Every site should at the very least store hashed passwords. Salted hashes are much better but just hashed is maybe borderline acceptable.
If they’re plaintext or encoded it would be severe malpractice IMO.
The MU data breach did!! It’s just they hashed them in unsalted md5.
discourse uses one-way-encrypted passwords that are considered impossible to decrypt, so the odds that someone a) got to the database and b) was able to decrypt the passwords would be very small
but we decided it was better to assume either that happened or somebody found some other vulnerability with our discourse version and later be proven wrong than to not act and have it turn out somebody did do one of those things
maybe this is all part of orange’s big plan to make everybody use better passwords (for evil reasons)
bro i am so chill with that possibility
i have a unique fol password that still isn’t listed as breached, and another non-unique that could feasibly have been breached outside of fol but woulda had to been relatively recently (past month or so)
yeah
im starting to come around to the idea that ash just had somebody else use his password on some other website, and that rando and you both got breached elsewhere
but we’re still looking into things
These days, using the same password on multiple accounts is asking for trouble.
Amogus
If theres any update, please update the announcement in the discord too. Cause like I check that way more ty for informing us though. TBH don’t even remember which password this one is
yeah once we have everything sorted we’ll re-ping and also prolly send out an e-mail if that seems helpful
as of right now our hosting provider is pretty sure that we just got hit by a funny coincidence
but I’m going to give it the weekend to see if anybody else starts getting “password compromised” notifications before officially announcing it as a false alarm
can we have a new one for april 
Social Security # leak next!!!
please do not put your SSN anywhere near our site
we don’t want it
Rip whoever has been keeping notes by dming themselves (definitely not me)
Am I allowed to put your SSN near this site?
I’m a bit late, but the link is using the fortressoftruth.net domain, which doesn’t load for me (and might not for others)
You can also click the original link and manually change it to fortressoflies.com