[Discussion] Downtime and Server Compromise

[poyntesm]

Hope I can ask a question. As a user who has logged in since the phpBB3 conversion I know my current password is in the newer format. However normally a conversion uses a different DB as its source. Does this copy of the phpBB2 DB still exist on the phpBB Database server?

[ChrisRLG]

Hope I can ask a question. As a user who has logged in since the phpBB3 conversion I know my current password is in the newer format. However normally a conversion uses a different DB as its source. Does this copy of the phpBB2 DB still exist on the phpBB Database server?

No.

When converting from v2 to v3 the passwords are not converted, the system is aware that the password is stored, not in the newer salted version of the password hash, so then prompts for the user then to change the password when first entering the forum after a conversion to v3.

Those members who have never visited since the conversion, are still in that 'state' where only a MD5 and not a salted hash has been used.

[poyntesm]

Can you confirm the No was to the question "Does this copy of the phpBB2 DB still exist on the phpBB Database server?"

I do understand what happens to the password from a phpBB3 point of view. My question was related to the fact that the password is left in an unchanged state in the original phpBB2 DB which is the source of the actual conversion to phpBB3. I am keen to know if this database still exists for phpBB.com or once the v3 conversion was completed was a dump taken and the actual DB removed from the server.

EDit: sorry for re-ask but your explaination threw me .. as I did not ask anything about that.. so thats why I just wanted to re-confirm.

[Kellanved]

No, the data of the old 2.0 installation was not present in the same database. The database solely held the 3.0 data.

[ToonArmy]

No, the data of the old 2.0 installation was not present in the same database. The database solely held the 3.0 data.

Nor was it on the server.

[Brandon07]

Any updates on how phpbb.com is doing?

[Erik Frèrejean]

No not really we have a list with things we have to do first. So the only answer we can give right now is that it will be done as soon as possible.

[Acyd Burn]

At this time different team members are doing different tasks. The most time consuming part at the moment is sanitizing the database dumps.

[KeithR]

I really appreciate all the hard work that is going in to making sure that phpBB.com is not only brought back on-line, but done so in a manner that ensures the phpBB product it is using is as secure as it was before this unfortunate incident, as I know mine has been throughout the entire time I have been using it; ( I only started at 3.0.0 and I'm running 3.0.4, but you get the drift). At no point have I felt that my board would be compromised or that I needed to do anything extra to ensure security.

........ is that it will be done as soon as possible.

I know that this answer gets trotted out in regards to a lot of questions about phpBB regarding time-scales, but in this case it couldn't be more apt or appropriate.

However having posted all that:

All I know is that I'm going through withdrawls...someone is going to pay!!

is about the same as I feel and all I do is read and try to learn

My best regards to all the phpBB.com team.

[madtay]

Sorry to ask this, ive read the whole thread and i think its been answered but want to be sure to put my mind at rest....

Since ive logged in after the conversion to PHPBB3 my password has been converted and therefore cannot be compromised? Is that correct?

Thanks