Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Ché Biko]

Hey people,

For those of you who've made edits on the Evelopedia; I think there's something you should know.

In case you were wondering what all my fuss in OOC was about last night: I was the one that stumbled upon the potential Evelopedia info leak, and I wanted to make sure this was handled ASAP, and I think you'll understand why if you know what I discovered. CCP says it's ok if I talk about it now, so...

While I was checking if another bug on Evelopedia had been fixed, I noticed that edits done under my character's name instead now were referred to my EVE account username.
I send a mail to CCP security, then asked Saede to confirm the issue, as I couldn't believe this was real, and thought I might have derped somehow, but she confirmed it, so I decided to make sure this was handled ASAP.
I got into contact with a CSM and basicly asked if he could check if CCP was watching the security inbox at the time. After I told him this was about an account info leak he rang some bells and CCP escalated and flagged the issue.

So long story short, if you've done any edits on the EVE wiki and your EVE account username is used in other places, you might want to consider changing that.

[Saede Riordan]

Fortunately the issue seems to already be fixed, and the wiki is back up and looks to be working fine again.

[Tiberious Thessalonia]

Good catch, Che. I hope you were well rewarded, because that could have been a serious issue.

[Lyn Farel]

One can change one's account name ?

[Mithfindel]

Nope. But you can probably increase entropy, i.e. the very least check that you haven't reused the account name/password pair, just in case something gets broken into.

[Nmaro Makari]

We should make an image series called "Good Guy Che"

Thanks for discovering this 

[Ché Biko]

I was rewarded well enough for my standards, but I was not filthy rich to begin with. The reward nearly doubles my EVE wealth.

What happily surprises me a bit, is that I made a similar thread like this on EVE GD, but it barely caused a ripple. It must have helped that I did not use a spectacular panic inducing thread title, and I guess there's not a lot of wiki editors out there.
I feel happy the way it played out. I did my "duty" trying to inform those that I thought needed to know, and it didn't cause a shitstorm for CCP.

[Graelyn]

We call that a Win-Win.

[Ché Biko]

Just an additional FYI: If I did not try to poke CCP through a back door, the mail would not have been read for like another 10 hours.
Contrary to what some believe, the CCP security mail is not being watched 24/7.