NodePoint (2016-07-20 13:50:24)

---

I have seen this being an issue for too long and so I decided to create this thread to make things brutally clear with this particular subject.

Most of this counts for those with very simple or leaked passwords so read on if you want if any of those might apply to you.

What is the beef here?
Too many users send their passwords to other users who claim that they can do their profile. While they might actually do what is said, some users do not.

What could they possibly do instead?
The users who may or may not do your profile when you hand over your password could either share the password to other users for them to use or get into your account and hijack it (use it for posting content [possibly impersonation], change your email, password, ...).

Any other reason why I should not share it?
First off, the chat rules explicitly states not to share your passwords at all. So really you would be punished for that anyway but in this case it would be dealing with getting things back to normal as possible which is not fun.
If you share passwords over places like PMs then they will be in plaintext. Whoever accesses your or the recipient's account are highly likely to use that information (attackers are no exception). You would end up getting around the security feature on 3DSPlaza which is to hash and salt your password in the first place (AKA to make it close to impossible to tell what the password originally was). If you use the password in other places, you will be in a challenging situation.
If it is noticed that you are linked to other accounts because someone else used your account or it is suspected that someone else is under your account, it is likely that the account will be banned. This would be either be due to technical ALTing (alternative accounts, the attacker might already have a usable account) or simply due to it being compromised. Either way, it will be permanently banned. Read further for more information in regards to this.

A ban? Ouch. How do I get the account back?
You do not. You will have to create a new account and you shall not get your compromised account back due to the risks involved with that. Unless a system administrator (Robdeprop or SomeLuigi) can copy your (hopefully different) protected password to the compromised account and notify a chat or profile moderator (if it is clear that they are not aware of the administrative actions like by not commenting or referring to it), that will always be the case.
Also, if the exception does not apply to you, you should also notify an active profile or chat moderator of what happened in order to avoid getting your newly created account banned and so that the other account can be dealt with if it has not already and so that that they are aware of what happened.

What if I had already shared my password before? No one used my account for anything apart from doing my profile.
If you still have access to your account, change your password before it all happens.
Also, inform a chat (very high recommended if they are online) or profile moderator of what you had done as soon as possible. If you are asked about it, answer without hiding any important details. This will help you avoid being banned without good reason.

I was banned due to something like this. I am stuck with creating a new account / I do not understand what happened / Would like to get my account accepted faster
To the victim: email me via my site[/link] (best) or [link=https://twitter.com/CoolApps45]DM me on Twitter (little more slower).
To the attacker: go here.

How could someone do my profile without sharing passwords then?
You can either:
• get them to send you the styles for you to add yourself;
• do it yourself;
• verify if the user has a 'profile_mod' privilege by querying them using the command '/query USERNAME_HERE' or check their privileges on their profile and request if it is listed there also -- if they are okay with doing so then provide them information about the profile theme you want or what you would like sorting

Note that privileges on profiles can be mocked -- report the user if the privileges on their profile does not appear to be related to the shorthand ones listed by '/query' in the chat.

Remember to not share any passwords even when asked. Not even the length of it. Profile moderators do not need passwords at all. Trust no one with it.

I have a question.
Post it in the comments below. [link=../members/send_pm.php?to=NodePoint]Private message me[/link] if it is not a good idea to post publicly.


Be aware that the bans are only done to stop attackers from using your account maliciously sooner or later. Please be very honest and understandable about these sort of situations as this will stop you from receiving a false-positive ban on an account that is in actual fact safe to use.

This post has been edited one or more times, the last time was:
2016-07-20 16:03:48

---

WiiUGuy (2016-07-20 14:38:42)

---

OK I'LL USE AN EXTREMLY MLG PASSWORD! (on this account.)

---

ObeyMercilia (2016-07-20 14:48:12)

---

^ shutcha ass up

---

SpriteMite (2016-07-23 05:02:28)

---

I think I should probably finish the PlazaCSS feature to do profiles without giving passwords.

---

TwilightWinter (2016-07-24 01:06:47)

---

hdsHDKshkjhasdhkah123sjkhasdkhkjhguighknm23xcnvn123fmnthisthreadislamesdfhhdj123868


Find my password in that.

---

BirdJesus (2016-08-11 18:42:02)

---

Make a Too Long; Did not Read! version of this thread and sticky it.

---

TwilightWinter (2016-08-17 22:01:55)

---

^ Ermahgerd, Ermahgerd, smarty pants.

---

PaRappa_Rappa (2016-08-19 22:17:15)

---

this is soooooo 2011/2012 anyway.

---