Thor

About security


So in February, TruckersMP was pwned, first time a service I’ve been fully or partially responsible for has been pwned. The pwn was attacking a bad password usage practice used by one of the upper team members and affected the forums (password re-use).

Late Sunday/early monday morning, the list of affected users where added to HIBP, submitted by us. Why you may ask? We value the security of our users above anything else, so we reached out to Troy Hunt, and became the first self submitted site, and the 100th breach to be added.

The response from the security community has been generally quite positive, it’s sad to have a breach, but it’s nice to see recognition that we made the right decision on making a list of users available so that they can be notified as well as help them in the future to know what has leaked and when.

What did we learn from the breach and from submitting ourselves instead of waiting for the perpetrator to float the DB?

Be open about it, skip the “We care about our users”-jargon and show that you care, by being transparent, treat your users like they where a corporate customer, even if it’s embarrassing to be pwned, by having your users change their passwords, you will also devalue the value of your database because it’ll become dated much more quickly.

What we could have done better:
We could have been more transparent to our users about self-submission to HIBP, we recieved some flak for not informing our users that we would be doing that, both Kat_PW and I have taken this to heart, and should we ever have to do it again, we will of course notify our users about this prior.

Finally we should have emailed our users, it wasn’t done because we didn’t have the infrastructure, though it would have been costy to get that sorted, but the value of doing that would have shown to our users a lot quicker that we care.

If you have any questions or comments, you can reach me on twitter or by mail: tuxy [at] truckersmp.com