Canonical takes Ubuntu forums offline in wake of password breach

Canonical, makers of the Ubuntu Linux distribution, recently announced that its Ubuntu help forums suffered a security breach over the weekend. Attackers were able to harvest an estimated 1.82 million user names, email addresses, and passwords from the site. Canonical says it isn’t sure how hackers were able to breach its systems and the company has taken the forums at Ubuntuforums.org offline as a precaution.

Canonical is warning anyone with an Ubuntu Forums account about the hack via email. The company is also advising users to change their security credentials on other sites, especially email, if they used the same password and username/email for other online services.

Ubuntu.com services such as Ubuntu One are not believed to be affected by the hack since they do not share the same login account as the Ubuntu forums.

Fans of the Ubuntu forums began reporting that the site had been defaced on Saturday. The hacker or group of hackers who breached the site posted an image of a penguin (the Linux mascot is a penguin) holding an AK-47.

The message underneath the image suggested the hackers were more interested in exposing a poorly secured site than anything else. “None of this ‘[you got hacked] by albani4 c3bir 4rmy’ stuff,” the message on Ubuntu’s forums site said. “Straight up, you dun goofed. It's as simple as that.”

It’s not clear if the hackers plan on exposing the database of user names and passwords online. Nevertheless, there is a definite possibility these account credentials could begin circulating around the less reputable areas of the Internet.

For now, the hack doesn't appear malicious, but users should take caution.
Canonical says forum user passwords were not stored in plain text and were hashed and salted. A hash uses a mathematical algorithm to convert plain text passwords into a series of numbers and letters. A specific hash will create the same string of letters and numbers each time for the same input (in this case a password). To make hashes more secure they are further obscured by “salting,” a process that inserts random bits into the hash making it harder to guess the original password.

Canonical had not returned our request for comment at this writing, so it’s not clear which hashing algorithm the company was using. However, a report from Ars Technica says Canonical was using the md5 hash. MD5 is a popular hashing algorithm that is often used by software companies as a security check to let users ensure downloaded executable files were not tampered with or corrupted. But md5 is not considered to be a secure choice for hashing passwords.

Reports of password breaches are always a good time to reevaluate your own online security practices. Always make sure you are using unique passwords for every site you visit online. For tips on generating your own passwords check out PCWorld’s “Learn to use strong passwords” or “Passwords: You're doing it wrong. Here's how to make them uncrackable.”

Use a password manager such as LastPass or Password Safe to store all your various passwords for different online sites. These programs can also create new passwords for you and can automatically fill out login forms for you.

Finally, activate two-factor authentication for any services that support this security measure such as Battle.net, Dropbox, Evernote, Facebook, Gmail, Twitter, and Outlook.com. Two-factor authentication requires you to enter a second, shorter temporary password that is usually generated by a smartphone application or small key fob.

Many services that offer two-factor authentication allow you to set trusted PCs so that you only have to enter your credentials once on new PCs or browsers.

Canonical has not said when Ubuntu forums will be back up. In the meantime, any Ubuntu user looking for support can check out sites such as Stack Exchange’s Ask Ubuntu or Ubuntu Discourse.

Review: Dashlane is a robust password manager with a gorgeous interface

Dashlane With its simple interface and myriad of features, Dashlane is a powerful password manager anyone should consider.


A password manager is a must. Unless you're using the same password for everything (not recommended) or have a truly phenomenal memory, your productivity can benefit from a place to store all your passwords and easily use them whenever necessary. There are several strong players in this field, such as LastPass and KeePass. Dashlane (free for basic version, $20/year for Premium) aims to take on both.

Dashlane is a robust password manager with additional room for your various IDs, credit cards and other payment methods, receipts, and notes. It comes with an auto-fill feature for online forms to which you can add different addresses, phone numbers, and other personal information you're tired of typing repeatedly. There are two features that make Dashlane stand out when compared to both LastPass and KeePass: Its beautiful and easy-to-use interface, and its optional cloud syncing.

The Security Dashboard analyzes your database, alerting you of weak, recurring, or breached passwords
Setting up Dashlane is exceptionally easy. LastPass and KeePass are both fairly easy to use, but they have nothing on Dashlane. The installation process takes you step by step through setting up the program, with clear instructions and smooth guidance. After choosing your master password for Dashlane--unlike LastPass, there's no "password reminder" here, so you must remember it or lose access to your database--Dashlane will install itself on your browsers (Firefox, Chrome and Internet Explorer are supported), and will lead you through trying out its different features and interface elements.

If you're already using a different password manager, you can import your database into Dashlane pretty easily. The import tool supports databases from Firefox, Chrome, Internet Explorer, LastPass, 1Password, RoboForm, PasswordWallet, KeePess, and custom CSV files, but the tool is a little finicky. For example, my KeePass CSV did not contain a filled-in URL field, as this is not mandatory in KeePass. Dashlane ignored every password that did not come with a URL, leaving me with no way to import my large password database into Dashlane. Fortunately, Dashlane can automatically add new credentials upon logging in to websites, so after using it for several days, most of my oft-used passwords were transferred to Dashlane without much effort on my part.

On every new login, Dashlane will offer to automatically save your credentials
Dashlane's strong yet subtle browser integration makes logging in to websites a seamless operation, but doesn't add unnecessary clutter to your browsing experience. Once a password is stored in Dashlane, it can log you in automatically every time the website is loaded, or auto-fill the credentials without logging you in. If you're opening an account on a new website, Dashlane can generate a strong password for you right from your browser, and store it in your database in one fell swoop.

You can categorize passwords and other information for easy access, and a small blue impala icon in a browser text field will alert you to the fact that Dashlane can auto-fill this for you. If you have more than one account with a website, more than one email address you like to use, etc., clicking the blue impala will open a dropdown menu where you can choose the desired information.

One of the most important aspects of a password manager is security, and with Dashlane, you can select your level of paranoia. Your database is encrypted with AES-256 encryption, only you know the master password to decrypt it, and you can enable Google Authenticator for extra security. Unlike LastPass, where everything is in the cloud, automatic cloud syncing and backup is a Premium feature in Dashlane, so free users don't have to worry about it.

Even if you're a paid customer, however, you can easily opt out of cloud syncs, meaning your password database is only stored locally, just like with KeePass. Unlike KeePass, though, Dashlane's free mobile apps can be managed as separate databases, so you can access your passwords on the go without worrying about constant cloud syncs. When enabled, Dashlane syncs happen every 5 minutes, and there's no way to control or reduce this frequency.

The Premium version also includes Web access to your data from any browser, anywhere
Dashlane is an impressive password manager with some excellent features and a beautiful interface. It does require a certain amount of trust in the company, especially when using its syncing options, and for $20/year, its Premium version is expensive when compared to the alternatives. Nevertheless, it is the perfect password manager for the less tech-savvy, and even the experienced are sure to enjoy it, if only for the merits of its interface. It's available in Android, iOS, and Mac editions, in addition to the PC edition I reviewed.