(Wow I'm probably not going to use this site for anything else but I just wanted to clear up any misinformation)
The full story is: Back in January of this year some community members from the Windows 93 Discord had a group chat in which they found an exploit that allowed them to download every single file from the Windows 93 servers. One of these files was a "users.json" file that contained an email and plaintext password of every single MySpace93 user (At the time 46k). They immediately alerted Janken (Tom) about it (he got pissed).
One of the people in the group chat decided to start DMing the users.json file to random people on Discord. (I should mention that the copy they DMd to random people apparently only had 20k accounts) One of these people was a friend of mine. My friend didn't do anything malicious with the passwords except log in into the Tom account, which had admin permissions to edit anyone's profile on the site. My friend only used these permissions to troll me and other friends by changing their country to "Trollface Ethnostate" or something. They also made a new MySpace account called "The Backdoor" in which they put HTML using the admin tools (Nothing malicious, for example one of the things they put just changed the account's username to appear as green across the entire site).
Fast forward a couple of months until June this year and Janken finds out about The Backdoor account. He opens MySpace admin logs and sees that my profile was being edited using the admin tools. He DMs me and I explain what happened. He finds out that MySpace93 passwords have been getting leaked. This is where it goes downhill. He does the famous "Your account seems sus" message, except he doesn't say anywhere that he has been hacked and compromised, he just tells people to change their passwords on MySpace only for seemingly no reason. (Also the password was emailed to people in plaintext, which I find pretty funny, because he apparently lied to random people that asked about security that he hashes passwords).
I should probably explain what's wrong with just telling people to change their MySpace93 password after the passwords of 20k users were leaked. A lot of people on the internet use the same password for many sites. This was the case for a lot of MySpace93 users as well. Only telling people to change their MySpace93 password without saying that you've been hacked and that people's passwords were leaked is a terrible way to handle a breach. Nobody would know to change their password on literally every site. What's particularly funny about this is that someone asked Janken to hash passwords to avoid leaks like that and he replied "nobody really cares ^^".
Anyway, after this he started banning random active users from the Windows 93 Discord and MySpace93, and soon he deleted the Discord server. People started making blogs on MySpace93 telling people to change their passwords and they immediately got banned by Janken.
A few days later (June 28th) on
Windows 93 /b/ someone posted a 6 GB zip containing everything that was obtained during January including Windows 93 source code of v1 and v2 and a users.json file containing 40k email and plaintext password combos. When Janken found out he shut down MySpace93 and you can read what he wrote on the site. Most of what he wrote is filled with lies and inconsistencies. He says that the site wasn't hacked and passwords weren't leaked yet later he says "Some time ago some users close to me (who had access to my server and who I thought were friends) had fun stealing source code and passwords from me and shared it on discord." (Also "who had access to my server" is a lie, they broke into it without consent).
I'm personally very disappointed of how Janken is handling this. Continuously lying about not being hacked and even banning people from MySpace93 who warn users to change their passwords. There's also a lot of inactive MySpace93 users that used the same password they use on every site on MySpace93, and they probably won't even check myspace.windows93.net again. To me, the best thing he could do is email every 46k users about the breach, explaining what actually happened.
Forum:
Report Topic
Permalink
![mossy :]'s profile picture](https://cdn.spacehey.net/profilepics/1521025_4481307bae19accedd01381fca05f9ac.png?expires=1738410351&token=0238d490fbe2d2e40021c46d68a667dc171e6c46f65fccc08360fc9a4c3ef2a8)