3 ms·

Yes and no :-) What else could a user do once damage is done? (before they started investigating, but after the fix was pushed)

• sorbus 15y ago
  The important thing about this bug is that it allowed log-ins without passwords. No passwords were compromised. Therefor, asking users to change their passwords would have been FUD, as well as making it more difficult to identify which users were affected by the person exploiting the bug (if almost every user logs in during 4 hours, you're going to have a lot of trouble identifying the <100 accounts who were accessed by the attacker).