6 ms·

Come check out https://hackerforums.co https://hackerforums.co ! We have a nice old fashioned phpbb forum for ya

by dchuk 8y ago

oliwarner 8y ago
After the tenth email from haveibeenpwned.com, I swore to never hand over a username and password to another forum system. Even one run by "hackers" (in the positive sense). This holds especially true for phpBB. Let me log in through an external service where I can control my credentials and factor count. Ideally a pile of established OAuth providers and an open OpenID box.
- aembleton 8y ago
  Use a different password for each phpBB and other forums. Manage them all using LastPass or some other password manager. If they get hacked and you lose that password, so what? They can only impersonate you on that forum.
  - oliwarner 8y ago
    Great until the password manager has security issues. They're still passwords so even after they fix up shop, you still have to [very manually] go from site to site replacing your passwords. Until you do that, you, your data and your online persona may be vulnerable somewhere. If an identity provider has issues, the window of opportunity ends with the rollout of a fix. Not to mention that I trust the security of my identity provider a lot more thorough than Mr Bobbins phpBB instance. Audits automatically instigated by changes in country, ISP, device, browser. Logs kept. Dynamic secondary and tertiary factors. It's toxic and unnecessary data. Let somebody else handle it.
    - dwild 8y ago
      Then only use that password manager for PhpBB forum... You care way too much for an account that you currently don't even have... is is really necessary? Worse case, you lose it and you are back a your current state, doesn't seems so bad to me.
      - oliwarner 8y ago
        > currently don't even have And won't have with the current login method. I'm not trying to convince you to follow my path here, I've just been trying to explain why I do what I do, in an effort that the guy advertising a forum I'm interested in might improve things enough to let me (and those like me) in. I understand that there are ways to do this, and that my way is an active choice. If it comes to it, I'd rather go without.
- prepend 8y ago
  That’s funny, I would never trust an unknown site like this with my real OAuth or OpenID account. Too much risk of compromise or marketing or whatnot. I use a system of unique ids for these sites.

Come check out https://hackerforums.co https://hackerforums.co ! We have a nice old fashioned phpbb forum for ya

by dchuk 8y ago

Come check out https://hackerforums.co https://hackerforums.co ! We have a nice old fashioned phpbb forum for ya

After the tenth email from haveibeenpwned.com, I swore to never hand over a username and password to another forum system. Even one run by "hackers" (in the positive sense). This holds especially true for phpBB. Let me log in through an external service where I can control my credentials and factor count. Ideally a pile of established OAuth providers and an open OpenID box.

aembleton 8y ago
Use a different password for each phpBB and other forums. Manage them all using LastPass or some other password manager. If they get hacked and you lose that password, so what? They can only impersonate you on that forum.
- oliwarner 8y ago
  Great until the password manager has security issues. They're still passwords so even after they fix up shop, you still have to [very manually] go from site to site replacing your passwords. Until you do that, you, your data and your online persona may be vulnerable somewhere. If an identity provider has issues, the window of opportunity ends with the rollout of a fix. Not to mention that I trust the security of my identity provider a lot more thorough than Mr Bobbins phpBB instance. Audits automatically instigated by changes in country, ISP, device, browser. Logs kept. Dynamic secondary and tertiary factors. It's toxic and unnecessary data. Let somebody else handle it.
  - dwild 8y ago
    Then only use that password manager for PhpBB forum... You care way too much for an account that you currently don't even have... is is really necessary? Worse case, you lose it and you are back a your current state, doesn't seems so bad to me.
    - oliwarner 8y ago
      > currently don't even have And won't have with the current login method. I'm not trying to convince you to follow my path here, I've just been trying to explain why I do what I do, in an effort that the guy advertising a forum I'm interested in might improve things enough to let me (and those like me) in. I understand that there are ways to do this, and that my way is an active choice. If it comes to it, I'd rather go without.
prepend 8y ago
That’s funny, I would never trust an unknown site like this with my real OAuth or OpenID account. Too much risk of compromise or marketing or whatnot. I use a system of unique ids for these sites.