Some very bad people did a Very good job at convincing some good people to hand over their passwords and totally crushed the support team
Brad Oberwager
A resident gives out their password (the example given by Brad Oberwager was “potato1”), Linden Lab support spend 3 hours helping this resident get their account back. The next day the resident changes the password BACK to the COMPRIMISED PASSWORD.
That’s the kind of thing (level of stupidity) that LL support is having to deal with right now.
They have a backlog from March of tickets, caused by trying to make things easier for residents by allowing real-time payments, which resulted in a deluge of account takeovers and subsequent support requests.
Obviously not all the tickets are for account takeovers, there’s regular stuff too, but a load of them that arrived at once seem to be and the lab are working through it all methodically.
Maybe if a person that did that happens to read this, would they even realise the amount of wasted time they caused?
Can you imagine the needless frustration of Lab staff at the sheer stupidity of that resident? (To clarify no-one at Linden Lab called anyone stupid, that’s simply my opinion of someone that would do that.
Of course the Elephant in the room is: Why did the system allow the resident to re-use the weak password?
This is why the Lab issued their blog post about account security last week.
I just wanted to get this out there, because it was stuck in my head, stopping me thinking about what I’m meant to be focussing on tonight; the transition from Tillia to Thunes for payment processing in Second Life. That’ll have to wait until tomorrow now.
The hashtag #StopPotato1 was typed in the text chat of a Zoom call with the Lab by someone else, I’m not taking credit for it I just thought it perfectly summed up things, I just had to use it.
I can only think that if a person changes the password back to the original password that they may be vulnerable in some way through an illness. Maybe LL could code it so that the original password cannot be used again?
Yes, it’s a serious flaw in the platform that they were able to.