TapaTalk hacked

[ke4est]

Maybe it is time to get rid of TapaTalk.

 

[Shawn Gossman]

Maybe it is time to get rid of TapaTalk.

Not for me. Some of my members expressed that they would be depressed if we ditched it and that they accept any security risk. So as long as Tapatalk doesn't risk my actual forum code...then I am leaving it as an option but still encouraging the use of IPBs mobile interface as well.

 

[bucket]

So as long as Tapatalk doesn't risk my actual forum code....

wrt a forum's code and database, would TT's access/power be comparable to a user, a moderator, an administrator, or an owner?

 

[BirdOPrey5]

Now they are saying you should change all your passwords, not just the forum password...

Latest email-

Dear Tapatalk Forum Owner,

On December 9th, we discovered that someone had used an exploit to compromise ourWordPress Blog and Tapatalk Support Forums, this lead to the disclosure of email addresses and passwords of some of our support forum users. All Tapatalk Support Forum account passwords were reset and all of our forum members were notified immediately.

As a precautionary measure for forum owners, on December 16th we also reset all passwords used to access the Tapatalk Forum Owner Admin Dashboard.

If you have not logged in since December 16th, please do so at your earliest convenience and choose a new password.


Next Steps to Take to Stay Secure:

• Please choose a strong password, containing a mix of upper and lower case letters, numbers and even symbols if possible.
• Refrain from using the same password on more than one site. Passwords should be unique to each site in order to comply with security best practices.
• If you are an admin or moderator of a forum, please consider resetting your Tapatalk ID password as well. You can do so by editing your profile from within the Tapatalk app, or logging in on our home page through the "App User Login In" link and select "Reset Password".
• Once logged into your Tapatalk admin console, please update your forum's Tapatalk API key. You may do so by selecting your forum and generating a new key to cut and paste into your forum system's admin CP.

The Tapatalk Support Forums have been restored, and as a precaution, rolled back approximately one week. As the situation develops we will keep you updated.

For your safety, Tapatalk emails will no longer contain links for password resets or any other tasks. If you receive any suspicious emails that appear to be sent by Tapatalk, do not follow any links and report the email to us as soon as possible.


We are sorry for this inconvenience and thank you for your patience,

The Tapatalk Team

For the record although they said on December 16 they reset all passwords to the Forum Owner Admin Dashboard, they did not reset mine- perhaps they could see I had changed it after the hack.

 

[cheat_master30]

The last email (and this topic) makes kind of glad I decided not to use Tapatalk after all.

 

[zappaDPJ]

I did wonder when they would wake up to the fact that a large proportion of their users would probably use the same details for both accounts. One sandwich short of a picnic seems an appropriate description.

 

[Amaury]

Note to self: Never use TapaTalk.

 

[Shawn Gossman]

I did wonder when they would wake up to the fact that a large proportion of their users would probably use the same details for both accounts. One sandwich short of a picnic seems an appropriate description.

I make it a general rule not to use a password more than once. I have so many of them that I have to write them down. I use traditional paper and pen, hack-proof and I don't see someone breaking in my house, risking getting shot, for my secret book of passwords lol

 

[zappaDPJ]

I make it a general rule not to use a password more than once.

That's good advice rarely followed by anyone including forum admins. I keep all my randomly generated passwords on a USB stick from which c&p whenever I need them. I sure this method would be frowned upon by security experts but it's not failed me yet and it does mean all of my passwords are unique.

 

[Rasty]

I just use password1 as my password everywhere.

 

[Shawn Gossman]

That's good advice rarely followed by anyone including forum admins. I keep all my randomly generated passwords on a USB stick from which c&p whenever I need them. I sure this method would be frowned upon by security experts but it's not failed me yet and it does mean all of my passwords are unique.

Yep, I am big into security. Now its the physical side of it but understanding the physical side of security gives you a basic understanding of the cyber side of things. I'm not going to use an easy passcode on a gate that I provide security to a client for and I'm not going to use that password on other clients sites as well, that would essentially make me look like an idiot lol

 

[BirdOPrey5]

Note to self: Never use TapaTalk.

Based on what?

If you never use a company that has been hacked you'll find yourself unable to do any business soon enough. Even the biggest places get hacked- it happens- that's why you need to do your part and use unique passwords. If you used a unique password the only damage potentially done was someone posted as you on Tapatalk forum (which was since deleted since they rolled back a week.)

There are plenty of reasons not to use Tapatalk, but the hack isn't one of them.

 

[Rasty]

Based on what?

If you never use a company that has been hacked you'll find yourself unable to do any business soon enough. Even the biggest places get hacked- it happens- that's why you need to do your part and use unique passwords. If you used a unique password the only damage potentially done was someone posted as you on Tapatalk forum (which was since deleted since they rolled back a week.)

There are plenty of reasons not to use Tapatalk, but the hack isn't one of them.

Based on multiple red flags I would not use Tapatalk. They keep having security issues, won't fix bugs, won't respond to emails or support requests. It's foolish to install any plugins made by tapatalk at this point. You have no idea what they will "update" which could create a vulnerability to your servers security. When trust is lost it's very difficult to regain.

With vbulletin 3 and 4 your stuck with tapatalk because your alternative doesn't work. I'm not using vbulletin so I'm not stuck

 

[BirdOPrey5]

With vbulletin 3 and 4 your stuck with tapatalk because your alternative doesn't work. I'm not using vbulletin so I'm not stuck

Oh- what do you use?

 

[Rasty]

Oh- what do you use?

WBB with email notification for pm's

 

[DudeThatsErin]

I use LastPass. Better than the old paper and pen cause I'd end up losing that password book. XD

EDIT: Though a password book would be fairly convenient.

 

[PoetJC]

UGH! This entire thread is truly making want to consider jumping off the "I'm a TT fan" bandwagon.

But I just really appreciate Tapatalk's functionality. I think it's a great app. And like has been said - We live in the online world.. Any modification/add-on or even main script has the possibility of being hacked and/or exploits found. It seems to me that Tapatalk has addressed the security issues though. So I don't necessarily see any huge problem. I realize I'm in the minority - but whatever

J.

 

[Sylvain]

I removed my Tapatalk few days ago.... No complaint from members so far...

 

[Mopar1973Man]

One reason I moved on from vBulletin products and over to IPB 3 because at least I didn't need a bunch of 3rd party plugin to make up for the lacking forum software. At least IPB comes with a mobile complaint skin and doesn't require 3rd party plugins. Also being IPB is a skin you have full control of what your members sees. Not like Forum Runner or Tapatalk that can modify what you members see.

 

[BirdOPrey5]

One reason I moved on from vBulletin products and over to IPB 3 because at least I didn't need a bunch of 3rd party plugin to make up for the lacking forum software. At least IPB comes with a mobile complaint skin and doesn't require 3rd party plugins. Also being IPB is a skin you have full control of what your members sees. Not like Forum Runner or Tapatalk that can modify what you members see.

VB4 has a mobile skin as well, which you can edit. Skins cannot provide the same functionality as apps however.