change your password !

I just received a message from someone saying their password was used to buy $300 worth of Lindens. She is getting a refund and Linden's advice is to change your password daily or every week. I wanted to warn everyone

If you have to change your password once a week, SL is not secure. If SL is not secure, LL better do something about it fast.

my password gives cracker software a headache with several months cpu time to break it, changing it a week will give me a headache (and 1000 password recovery attempts a week)

Agreed.. If your info gets stolen, it's your own fault. Don't log into fake websites and don't give it out.

I've never had an account stolen.

I'm surprised she is getting a refund if it was her own fault.

Daily?

ummm.... right.

If you've changed your password since the most recent Beta Grid update, isn't it a problem to log into it? Or has LL fixed that?

Some time ago there was a problem where passwords were being hacked in cases where the user had checked the "remember password" box on login. This was very quickly fixed at the time, but I hope the problem hasn't come back! Best not use the remember password function just in case.

changing my password weekly (not daily) until SL has this problem fixed

Never had a problem with passwords.....I've never shared my account..never logged into SL from anywhere but my own PC....and never checked 'remember my password'. Actually....I've never had any kind of issues with passowrds or info being stolen. Of course....now that I say this....I'll probably have my identity stolen. LOL

But, it leads me to believe it's not LL's fault......and if a hacker does manage to get account info....well.....unfortunately there's hackers out there who DO get into all kinds of data bases. So....doesn't surprise me. But there again....it's random. If someone other than a hacker gets password info, then I would assume that the user wasn't being careful enough...or shared personal info when they shouldn't have.

That... wasn't the problem at all. LL's servers themselves were compromised and data gleaned right from the SQL.

There is no difference between leaving it hashed with the checkbox clicked and typing it and then sending it.

Jorus, I believe you're referring to a different problem. Deira's correct about the remember-password problem from last fall.