You are viewing a single comment's thread from:
RE: Important Security Announcement: Steemit CEO Ned Scott
Do you know how the attacker got in? I assume they altered the javascript to exfil private keys, yes? How do you know how many accounts were compromised? It might be wise to cycle everyone's keys at this point. I'll definitely be updating my posting key.
Yea, I was thinking something along these lines as well. XSS to grab a js token. I haven't looked into the site code, but I seriously hope they're not using js tokens and are instead using http only cookies.
At least is now been compromised, and from this experience Steem will up lift there security. Lesson learn.