YHK - yet another hacker news clone

AO3 Down for Maintenance

127 points idlewords 1 day ago 41 comments

wmf 1 day ago | parent

Discussion from yesterday: https://news.ycombinator.com/item?id=50293546

swyx 1 day ago | parent

> Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far. However, we want to make some things clear:

First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.

Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.

We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.

AO3 does not collect real names, so none could be exposed. Additionally, our donor information is held in an entirely separate system and is never linked to AO3, so that data has also not been exposed.

We will update everyone as our investigation continues; we may be unable to respond to individual inquiries from users. Please keep an eye on our official outlets for updates. Our next update will be posted when we have further information available.

Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks. During that time, we may be able to bring the site back up in a degraded state, meaning that not all features will be available and/or the site may be read-only. If we are able to do that, please be aware that we might have to bring the site back down unexpectedly as part of our recovery efforts. We will keep you in the loop for any developments. Oct 30, 2026 - 01:27 UTC

rahidz 1 day ago | parent

"The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password."

Dear lord. Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'ed/bookmarked? Like a miniature version of the Ashley Madison hack.

echoangle 1 day ago | parent

Did anyone sign up to that with their real name or email?

lunar_rover 1 day ago | parent

I'm certain many people signed up using established internet identities which can then be linked to real world identities through social engineering techniques.

UqWBcuFx6NV4r 1 day ago | parent

I am certain that many people will have signed up with an email address that contains their real name. If this leaks I’ve gotta imagine that someone with a particularly dark/evil sense of honour makes a tool where you enter an email address and are shown an AO3 presence.

cowlevel 14 hours ago | parent

If you put a phone number into Grindr's "forgot password" feature it tells you whether there's an account with that phone number or not.

Gigachad 23 hours ago | parent

Unless you had a unique email just for that service, you could just cross link it with another leak that contains your name.

Sure it’s possible to have perfect op sec but almost no one does in reality.

KPGv2 23 hours ago | parent

I did. I couldn't care less if people know I write fanfiction. I talk about it IRL with people, completely without shame. firstnamelastname@gmail.com

ashleyn 1 day ago | parent

It's worth noting that often, the email can be correlated with other breaches to get your real name. People can do that relatively easily on osint websites. I wasn't terribly pleased when I found my teenage furaffinity account show up in an identity theft monitoring app. Other people have turned up in breaches of far more objectionable websites.

If your email provider offers email aliases, you should really get familiar with how to use them, and use a unique email alias per website.

Gigachad 23 hours ago | parent

At this point it’s all public. Everything you do on the internet is or will be public.

I was also in the furaffinity leak lol. Though ultimately everyone is in so many leaks it won’t even matter. Unless you have committed some kind of crime, having possibly embarrassing personal details leaked is the reality for everyone right now.

whoanoway 23 hours ago | parent

Also, character assassinations. Good luck telling fact from fiction!

Gigachad 22 hours ago | parent

I think we are approaching a future where no one will care. An example would be the Canadian prime minister who had photos of him doing black face as a teenager emerge. And nothing happened because everyone has embarrassing teenage past actions.

noritori 21 hours ago | parent

>An example would be the Canadian prime minister who had photos of him doing black face as a teenager emerge.

He was a teacher at the time, at West Point Grey Academy, not a teenager. [1]

I'm not saying people can't grow and make mistakes throughout their life, and become better people, but it was definitely not a teenage mistake.

[1]: https://www.cbc.ca/news/politics/canada-votes-2019-trudeau-b...

Gigachad 21 hours ago | parent

My memory of it is fuzzy but I feel like that exemplifies the point more. No one really faces any consequences for this stuff leaking unless it’s truly bad. After all these hacks everyone is going to have embarrassing details leaked but it probably won’t matter.

Geezus_42 15 hours ago | parent

A good example would be the pedo felon sitting in the Whitehouse.

8cvor6j844qw_d6 22 hours ago | parent

Best practice to use your non-primary email address for these kinds of site. Data breach is a matter of when, not if, it happens.

KronisLV 11 hours ago | parent

Tbh it's probably a good idea to have a bunch of different e-mail accounts, at least for all of the professional, personal and other personal things.

There's horror stories of automated systems suspending people's Google accounts and suddenly they can't access their photos and other important data.

Like if you use a password manager and all of the passwords are random, might as well go a step further and at least have separate e-mail accounts for groups of activities.

culi 1 day ago | parent

Y'all are doing the right thing. Thanks for all the care you put into AO3.

Zambyte 1 day ago | parent

I don't think the person you responded to has anything to do with ao3. They quoted the content of the update on the linked status page.

Suppafly 20 hours ago | parent

>Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks.

That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours. I'm curious if they had no plan for this sort of thing and if they're unwilling to bring in professional companies that help analyze and cleanup these sorts of issues.

MattGaiser 1 day ago | parent

I guess this is just going to be the next few months/years, as HN right now is just breach after breach.

Lapalux 1 day ago | parent

I'm sweating as a infrastructure guy for SaaS right now

erelong 1 day ago | parent

wishing you and others luck

if something happens, it's probably not your fault?

UqWBcuFx6NV4r 1 day ago | parent

Poor Troy Hunt is going to need to employ a team of minions (or at the very least agents).

tialaramex 1 day ago | parent

> The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.

There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3

WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.

tbrownaw 1 day ago | parent

Replacing "something you know" with "something you have" is actually not an unalloyed good.

UqWBcuFx6NV4r 1 day ago | parent

I don’t think they said that it was.

tbrownaw 1 day ago | parent

In that case how would you interpret the "we can just do better"?

Starlevel004 1 day ago | parent

> WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.

Yes, because all of those teenage fanfiction readers are going to have yubikeys.

danielmeskin 1 day ago | parent

It’s built into most smartphones now isn’t it?

Gigachad 23 hours ago | parent

The same tech does Passkeys too. I suspect in the future we will move to passkey/yubikey only auth and store as little user data as possible.

cowlevel 14 hours ago | parent

And there will be a word you can type into a backup yubikey to make it an identical clone. I.e. a password.

blurbleblurble 1 day ago | parent

I wonder how many breaches are going undetected/unreported

cowlevel 14 hours ago | parent

There are, no kidding, five or ten breaches on front page HN in the last three days. All php2shell, do you think?

ChrisArchitect 1 day ago | parent

[dupe] https://news.ycombinator.com/item?id=50293546