CGs out in full force again?

[Meer]

Has anyone heard any more about this?

Cranberry is in touch with a TNT programmer, isn't she? Cranberry, if you read this, could you possibly talk to you contact, see what's going on with this? Are they working on it? Are they gonna tell us when they've fixed it? Or can they at least tell you so you can tell us?

I really want to be able to shop again!

[UsernameTwo]

Just bumping this up - is there any word yet if the problem has been dealt with and fixed, preferably in a permanent way? This having to only use the trading post and auctions is really irritating!

[Cranberry]

It's been way too long and I'm not bugging a programmer now. But considering Mr. Insane was working on it on the very first day people reported problems, I'm sure he fixed it... I mean, once TNT knows there's a security problem, they're not going to let it go on. They probably don't report it in the news because by the time they have the next news update ready to go, the problem is gone... and announcing that there was a cookie-grabbing problem but they fixed it would just scare all those thousands of people who don't properly understand what cookie grabbers even are.

Also, people tend to blow these things WAY out of proportion. One or two people get cookie grabbed and post about it on the neoboards, everyone else starts thinking hundreds of accounts are getting stolen, and it turns into this huge deal where everyone's terrified to do anything for days and days afterwards.

[bone garden]

I accidentally went on to someone's user look-up last night.
I've lost my account.
I filled out the form, do you have any idea how long it will take for them to get back to me?

Edit: Oh jeez I'm an idiot; I changed my password right after going to the user look-up and forgot. Is their a way to unsend the form? Man I feel horrible now.

[Rachel]

I accidentally went on to someone's user look-up last night.
I've lost my account.
I filled out the form, do you have any idea how long it will take for them to get back to me?

Edit: Oh jeez I'm an idiot; I changed my password right after going to the user look-up and forgot. Is their a way to unsend the form? Man I feel horrible now.

Just out of curiosity... how do you forget you changed your password?

[bone garden]

Just out of curiosity... how do you forget you changed your password?

I paniced when I realised I went to someone's user look-up after all this talk of cookie grabbers. I haven't changed my password in over a year, so I paniced again when my old one didn't work.
Yes, I'm stupid. I know. I feel horrible.

[JCMidore]

I thought that didn't sound right after seeing no visible uproar in the neoboards.

[littlemac]

I'm not concerned about my accounts, I'm concerned about my cookies from other sites.. possibly containing personal information.. etc... *bites lip*

A "Cookie Grabber" can't get your cookies from other sites, I promise you.

[Katherine]

I'm not concerned about my accounts, I'm concerned about my cookies from other sites.. possibly containing personal information.. etc... *bites lip*

A "Cookie Grabber" can't get your cookies from other sites, I promise you.

Some kinds can.

[littlemac]

Mm, I dunno. I'm guessing it's the degree to which they allow us to personalise our pages. I think anywhere where a user is able to insert something into an HTML page is vulnerable, and it'd be so difficult to filter through all the HTML and CSS and pick out whether something's dodgy or not.

That is basically the issue, yes. There are so many ways to insert Javascript (and therefore bad code) into a page, that it's very hard to filter.

I wonder if sites like MySpace or LJ have similar security issues? (since they allow personalisation of pages too) I know LJ had one a few months back ... I guess it's nowhere near as tempting for people to hack into accounts on those sites though.

Well, MySpace had a very famous exploit a while back. Ironically enough, Neopets had the exact same hole. (They eventually fixed it)

[littlemac]

I'm not concerned about my accounts, I'm concerned about my cookies from other sites.. possibly containing personal information.. etc... *bites lip*

A "Cookie Grabber" can't get your cookies from other sites, I promise you.

Some kinds can.

I'm speaking strictly about Javascript cookie grabbers, as those are the only ones you will find on Neopets.

So, to clarify, a javascript cookie grabber you find on neopets cannot access your other cookies.

[littlemac]

I'm always paranoid about cookie grabbers. I rarely visit pet/lookup pages and only visit user shops when I need something (restocking/quests). Plus my passwords/PIN#'s are very hard to guess.... even for people that know me well.

At least that way I feel safe when there are CG scares. You can never be completely protected, but you can at least be prepared.

Your password's strength is basically irrelevant to cookie grabbers, as they are not trying to guess your password.

[Katherine]

I'm not concerned about my accounts, I'm concerned about my cookies from other sites.. possibly containing personal information.. etc... *bites lip*

A "Cookie Grabber" can't get your cookies from other sites, I promise you.

Some kinds can.

I'm speaking strictly about Javascript cookie grabbers, as those are the only ones you will find on Neopets.

So, to clarify, a javascript cookie grabber you find on neopets cannot access your other cookies.

Sorry.But that is true,java cookie grabers can only get your Neo cookies.

[littlemac]

My main question is, is there any obvious smptoms of being 'Grabbed?

Short Answer: No.
Long Answer: No. Not until you lose your neopoints at least.

I heard that if you're 'Grabbed you're automatically logged out, is this true?

No, it's not true, unless the script writer did something horribly wrong.

Is it just Neopian Cookies or all Cookies? I think all of the Cookies my Computer has would crash someones if they all appeared at once ...and my Mum would kill me.

Just Neopet's cookies. Furthermore, regardless of how many are taken, your computer will not crash.

Would a Windows 98 crashed if it was 'Grabbed?

No.

[littlemac]

I'm not concerned about my accounts, I'm concerned about my cookies from other sites.. possibly containing personal information.. etc... *bites lip*

A "Cookie Grabber" can't get your cookies from other sites, I promise you.

Some kinds can.

I'm speaking strictly about Javascript cookie grabbers, as those are the only ones you will find on Neopets.

So, to clarify, a javascript cookie grabber you find on neopets cannot access your other cookies.

Sorry.But that is true,java cookie grabers can only get your Neo cookies.

Do you mean Java or Javascript? (They are two VERY different languages.)