Friendster hacked?

[#1]

Looks like friendster.com may have suffered a security breach. More info here.
Found that site after receiving a spam email yesterday containing a password that I commonly use!

[#2]

never been on friendster... thankfully because after the m&s, play and psn issues would have been the final straw..

[#3]

http://www.theregister.co.uk/2011/06/02/friendster_password_hack_fears/
Lessons:
a) Don't use the same password for important sites as unimportant.
b) Be wary of what data you put into a system/site.
c) Trust no one.
I guess Bob might now see why people like me have been questioning of PN's own storage/access of details (Eg. the whole "why do the CS people need to ask me my password" debate).

[#4]

Quote from: phil4

a) Don't use the same password for important sites as unimportant.

Which I don't thankfully, but I'll admit to using the Friendster password for a lot of eCommerce sites etc. that may/may not store my payment information depending on who they are. I've been compiling a list of passwords I need to change and it's becoming pretty lengthy!
Storing passwords in plain text is a far cry from our support agents having access to your Plusnet credentials (which are fully encrypted and stored in a database that resides on a fully PCI-compliant network).

[#5]

Bob - is it the full password that is requested when customers ring up?
If so, then that is wrong and should be stopped.
You should only ask for certain characters (similar to online banking logins, my mobile phone provider when I ring them up).  That can still be validated against the customer and removes the need for the password to be transmitted "in the clear".

[#6]

Plusnet have only ever asked me for 2 characters from my password when I've contacted them.
Phil

[#7]

I've only been asked for the last two characters when I've phoned PN.

[#8]

Quote from: geofftswin

Bob - is it the full password that is requested when customers ring up?

No, it will typically be two characters as others have alluded to.

[#9]

two characters is probably ok, but I am slightly concerned by Mav's post that suggest they're always the last 2 characters.

[#10]

Nope, when I rang them recently it was some other random combination.

[#11]

Quote from: Bob

I've been compiling a list of passwords I need to change and it's becoming pretty lengthy!

I've been using http://keepass.info/ for some time now and use it to generate passwords. I don't even try to use passwords I can remember for anything except those I have to key regularly (e.g. Windows password for unlocking the work PC when the screen saver has kicked in).

[#12]

Quote from: Bob

Quote from: geofftswin Bob - is it the full password that is requested when customers ring up? No, it will typically be two characters as others have alluded to.

As mentioned, a couple of times now I've been asked for the full password.