So is everything ok at Beehaw now?

hedge@beehaw.org to Beehaw Support@beehaw.org – 32 points –

Were we actually even hacked? Are we patched? And should we do anything like change our passwords?

9

You are viewing a single comment
View all comments

We were not hacked. The site was taken down preemptively for security measures. Are we ok? Yet to be determined fully.

Incident response on the available systems and data, show attempted XSS comments sourced from federated instances; none on Beehaw itself. Those were deleted from our Beehaw database. Additional security measures put in place to try and mitigate XSS and other Web based exploits. Changed the Content-Security-Policy to be more strict (might break some apps). Secrets for tokens and salting passwords were changed on the backend. You shouldn't need to change your password, but it can't hurt at this point.

If you're unable to login on Firefox:

* Open Beehaw website, tools -> more tools -> web developer tools

* Delete EVERYTHING for cache, cookies, indexed db, local storage, session storage

* Ctrl+F5 the page and try to login again.

I'm a Liftoff user right now, I had to clear the app cache and relog in order to continue using the app. Maybe it will help someone

I had to relog on Memmy as well. Both here and for .world

Same but for Memmy. Cleared cache and a relog, back in business

Good on y'all for being on top of things!

If you’re unable to login on Firefox:

I also had trouble signing back in again on Edge.

To fix it I had to delete the Beehaw.org cookies using the following method:

  • Click the menu (three dots) button.
  • In the menu that then opens click "Settings".
  • Click "Cookies and site permissions" in the list on the left.
  • Click "Manage and delete cookies and site data" at the top of the list in the centre.
  • Click "See all cookies and site data". This is located fourth option from the top. The last option in the first block of options in the centre.
  • Type "beehaw.org" in the "Search cookies" box at the top right (or just scroll through the list until you find it.)
  • Click the chevron/down arrow on the right hand side of the beehaw.org entry. Then click all the little trashcan icons next to the beehaw.org cookies to delete them (I had two, but now only have one. Make sure they are only the ones marked beehaw or you may delete cookies from other sites if you chose to scroll rather than search.)
  • Can't remember if I used "ctrl + F5" on the log in page to cleanly refresh it but it probably wouldn't hurt.-