All OzBargain users — make sure your email address here on OzBargain is valid and you are able to receive emails, as we will enforce email-based 2 factor authentication on all accounts that do not have 2FA turned on.
Over the last couple of weeks we have noticed an increasing number of OzBargain accounts got "hacked" by bots brute forcing username/password (that got leaked from other compromised sites). Here is an example of their operation:
- Bots trying to compromise OzBargain accounts by testing out username / password from VPN / random IP addresses
- Once an account has been compromised, someone will take over the account from an Australian VPN
- Spammer will use that compromised account to post spams
Those can be difficult to detect and block (as their breaching method kept on changing), until the spam has been posted.
In order to reduce old accounts getting compromised, we will be enforcing email-based two factor authentication, to all the accounts that do not have token-based 2FA turned on in their account security settings. This change will be rolled out later this month or early April. Basically, after you have put in correct username and password on the login form,
- If your account has token-based two-factor authentication turned on, 6-digit token will be requested
- Otherwise, an email may be sent to your registered email address in your profile. You will need to click on the link in the email or enter the 6 digit code to successfully log in.
This should hopefully reduce account getting brute forced, provided that your email inbox is valid and secure. Note that this does not apply to log in through Google or Facebook Sign-in, as we assume your accounts on those services are already secured.
If your email address is no longer valid, that means you will not be able to receive the 2FA email, which means you'll not be able to log into OzBargain.
I imagine this is more a consequence of people using ridiculously insecure passwords on their OzBargain accounts because they're considered expendable and don't contain much, if any, personal/confidential information; than there being any sort of dramatic increase in the volume or sophistication of brute-force botnet attacks.
OzBargain probably flew under the radar of a lot of these bots until the site's popularity started growing dramatically in recent years.
If people started being forced to use actual passwords/passphrases instead of Password123, that would solve the issue.
I've had the same password on OzBargain for over 5 years now.
But it's a 20+ character real password.
If legitimate, non-sock puppet/throwaway accounts from users who've been members for years are getting brute-forced than their passwords must be absolute garbage.