Major LJ security bug

[lethargic_man]

kerrypolka posts:

Apparently there's a pretty spectacular LJ privacy bug that is allowing random users to log into other random users' accounts, including editing and deleting entries, seeing private entries, changing passwords, etc.

She has bailed completely out of LJ for the time being (all her posts being crossposts from DreamWidth anyway). I don't have time to do this, as I'm about to head off to visit aviva_m, and, annoyingly, LJ Archive has not been working for me—possibly a security issue to do with firewalls—so I'm just going to hope LJ get this sorted pretty damn fast, and that no one diddles with my journal; but you may wish to act otherwise.

If anyone wants DreamWidth invite codes from me, I've got more than I know what to do with, but you might have to wait until Monday for me to get a chance to act in response.

ETA: The problem has been fixed now.

Comments

[liv]

Have a good time visiting aviva_m. Although this is a very terrifying bug, odds are that you won't be affected; since people can only access your journal randomly, you'd have to be hit by the bug and have a malicious person happen to get in to your account to have any problems.

LJ Archive is broken for a different reason related to the recent LJ update; I don't think it's about firewalls, it's that LJ have changed their API to deal with spam, and LJArchive hasn't been under active development for about 5 years now so it's very unlikely to be updated to deal with this problem. I strongly suspect you're going to need a different backup solution. LJ have also locked Dreamwidth (NB no CamelCaps in the site name!) out of the site so DW can't run its importer. Not deliberately, it's just a consequence of the antispam measures, and since DW is being developed actively, it probably will be sorted out fairly quickly.

[lethargic-man.livejournal.com]

Although this is a very terrifying bug, odds are that you won't be affected; since people can only access your journal randomly, you'd have to be hit by the bug and have a malicious person happen to get in to your account to have any problems.

That's what I figured. I'm probably running more risk logging on using the unsecured (and temporarily free) wifi connection on the Stansted Express to reply to your comment.

LJ Archive is broken for a different reason related to the recent LJ update; I don't think it's about firewalls, it's that LJ have changed their API to deal with spam, and LJArchive hasn't been under active development for about 5 years now so it's very unlikely to be updated to deal with this problem. I strongly suspect you're going to need a different backup solution.

Do you have any suggestions? (I know you're not blogging to LJ any more, but it strikes me you're more likely to be discussing this with people who are actively archiving than I am.)

[curious-reader.livejournal.com]

So far nobody has changed anything only put advertisements as comment to posts completely irrelevant to my entry. I mostly blocked it but cannot be bothered to follow it up anytime. It did not do any harm.