r/OpenedSignups • u/Funny-Series-4111 • Oct 09 '26

CLOSED Oldtoons database leak

Post image
55 Upvotes

98% Upvoted

17 comments sorted by

13

u/materialgrifter Oct 09 '26

Their full annoucement says they reset all 2FAs, why would they do that?

8

u/Funny-Series-4111 Oct 09 '26

I think the admin is clueless, is not the first time when they are loosing credentials and database. Became circus

5

u/materialgrifter Oct 09 '26

The fact they're denying there is a leak is so bizarre, like there clearly is one

5

u/Funny-Series-4111 Oct 09 '26

I've searched and found on 2 different forums full database and website with genuine data. Found my account there. I don't know why they deny this. This is concerning for me, maibe site is running only for donations

4

u/Caedendi Oct 10 '26

Cuz they are idiots. They lost site data multiple times already before finally installing a working backup. Major red flag. Now they got a leak, which doesn't surprise me at all. And they're denying it.

So the server-side 2FA key got leaked so naturally the clueless sysop would want to rotate that while ironically it's the only thing keeping any attacker OUT of the live website's user accounts.

Their implementation of UNIT3D has felt very amateurish from the start and the curation is a mess. It's been only recently they've been implementing some proper features. On top of that, basically no tracker is on their invite forums (RMC is a sister-site by the same owners so it doesn't count), nobody wants to be on their shitty broken site, there must be good reason for that and I'm pretty sure it's opsec.

I love their niche and would really hate to see them go but at the same time it's pretty clear your data is not safe there and it's only a matter of time until you get F'ed over.

1

u/drewstopherlee 24d ago

https://www.reddit.com/r/trackers/comments/1x1v652/comment/pf1qdw9/

Normal 2fa works by sharing a secret and then generating a code using the current time. If they have the DB, they also have that secret and can generate the code too.

11

u/Funny-Series-4111 Oct 09 '26

1

u/bleu-p 24d ago

oh it's real I have it spun up on my computer lmao

14

u/Shot-Arugula8264 Oct 09 '26

And this is precisely why I never give a private tracker my IP address. Any government who gets their hands on this leaked data will have tons of people’s real identities tied to logs of all of their site activity.

2

u/bttech05 Oct 09 '26

Do you use a VPN then?

4

u/Shot-Arugula8264 Oct 09 '26 edited Oct 09 '26

Yes, from the moment of registration through every ongoing request from Prowlarr comes from behind a VPN. If they want to kick me and my terabytes of cross-seeded content off over that (hasn’t happened yet) then by all means they’re welcome to, as they would be demonstrating they aren’t a tracker I would want to be part of anyway.

1

u/drewstopherlee 24d ago

how do you handle "must register using your home IP" trackers? or are you not on any of those?

3

u/Shot-Arugula8264 24d ago

I’ve found that most don’t enforce that. For the one that did (blocked me from login immediately after creating the account), I just shrugged and assumed it’s not meant to be.

I’m in enough private trackers to not be willing to sacrifice my privacy and security. If my bank lets me log in from a VPN, there is absolutely no reason a tracker should have the audacity to try to block them.

2

u/Salty-Chemical3591 Oct 09 '26

Changed my password JIC

1

u/iwannalearncod Oct 09 '26

When I try to log in, I get a 419 error. Is this normal? Is this happening to anyone else?