Better safe than sorry: SourceForge pushes password reset

Site asks users to change up logins in security shakeup


Open Source software portal SourceForge is asking users to change their passwords following an update to the site's security systems.

The company said that it would require users to choose new passwords upon logging into their SourceForge user accounts.

The move comes as online retail giant eBay continues to wrestle with the fallout from a breach of its systems. That company admitted that it had been compromised, and that attackers were able to access database information that included encrypted passwords and physical address information.

More recently, eBay has moved to ward off claims that the attackers who perpetrated the breach were able to decrypt passwords and are now selling off the lifted data. Regardless, eBay users have been instructed to change their passwords as a precautionary measure.

According to SourceForge, no such breach is behind its decision to require users to change their passwords. Instead, the site said that it was implementing a new security system that will modify the way it handles and stores user credentials.

"To make sure we're following current best practices for security, we've made some changes to how we're storing user passwords," administrators said in a blog post announcing the move.

"As a result, the next time you go to login to your SourceForge.net account, you will be prompted to change your password. Once this is done, your password will be stored more securely."

When contacted, SourceForge said that the password updates were part of a previously plan, but announced security update rather than a reaction to eBay's recent trouble.

In the process of changing passwords, SourceForge is also asking users to choose a secure new password (as opposed to the incredibly weak ones users often select), and the site is reminding users of security best practices such as avoiding untrusted links and never sending password information in emails or entering them into suspicious recovery sites. ®

Similar topics

Broader topics


Other stories you might like

  • Cisco warns of security holes in its security appliances
    Bugs potentially useful for rogue insiders, admin account hijackers

    Cisco has alerted customers to another four vulnerabilities in its products, including a high-severity flaw in its email and web security appliances. 

    The networking giant has issued a patch for that bug, tracked as CVE-2022-20664. The flaw is present in the web management interface of Cisco's Secure Email and Web Manager and Email Security Appliance in both the virtual and hardware appliances. Some earlier versions of both products, we note, have reached end of life, and so the manufacturer won't release fixes; it instead told customers to migrate to a newer version and dump the old.

    This bug received a 7.7 out of 10 CVSS severity score, and Cisco noted that its security team is not aware of any in-the-wild exploitation, so far. That said, given the speed of reverse engineering, that day is likely to come. 

    Continue reading
  • Google battles bots, puts Workspace admins on alert
    No security alert fatigue here

    Google has added API security tools and Workspace (formerly G-Suite) admin alerts about potentially risky configuration changes such as super admin passwords resets.

    The API capabilities – aptly named "Advanced API Security" – are built on top of Apigee, the API management platform that the web giant bought for $625 million six years ago.

    As API data makes up an increasing amount of internet traffic – Cloudflare says more than 50 percent of all of the traffic it processes is API based, and it's growing twice as fast as traditional web traffic – API security becomes more important to enterprises. Malicious actors can use API calls to bypass network security measures and connect directly to backend systems or launch DDoS attacks.

    Continue reading
  • Zero Trust: What does it actually mean – and why would you want it?
    'Narrow and specific access rights after authentication' wasn't catchy enough

    Systems Approach Since publishing our article and video on APIs, I’ve talked with a few people on the API topic, and one aspect that keeps coming up is the importance of security for APIs.

    In particular, I hear the term “zero trust” increasingly being applied to APIs, which led to the idea for this post. At the same time, I’ve also noticed what might be called a zero trust backlash, as it becomes apparent that you can’t wave a zero trust wand and instantly solve all your security concerns.

    Zero trust has been on my radar for almost a decade, as it was part of the environment that enabled network virtualization to take off. We’ve told that story briefly in our SDN book – the rise of microsegmentation as a widespread use-case was arguably the critical step that took network virtualization from a niche technology to the mainstream.

    Continue reading

Biting the hand that feeds IT © 1998–2022