Delcampe Encryption Change... Wait, What?

I just got the most bizarre email from Delcampe:




(emphasis added)

I have never heard of such a thing and I've been through many forced password changes over the years.

If their new encryption can't handle uppercase letters, it is most definitely NOT a higher level of security.

If that is not the case, then they should NOT do a password conversion, but rather enforce a mandatory password reset for all users. That is the industry standard.

I realize that GDPR has everyone running higgeldy piggeldy, but this is NOT how they should be implementing higher security.

Good grief.

I got the same e-mail and immediately thought it was a phishing e-mail that would take me to a spoof site to try to steal my password - but it looks like the e-mail is actually from Delcampe

Uhh. Does this mean that they're storing passwords in plaintext? That's a major computer security no-no.

Most secure sites store passwords as hashes (i.e. an irreversible math function that converts the password to a large number), for a couple reasons: first, it stops attackers with access to the database from simply reading the passwords (they only see the result of the hashes), and second you can easily combine the hash with something called a salt value, to prevent attackers with access to the database from cracking the passwords by brute force hash calculation over a dictionary.

Needless to say, if all you are storing is the hash function value, you can't convert the original password to lowercase.

Yeah, that's bogus. For better password security, they should force everyone registered to do a password reset, enforcing strong password requirements (min length, mixed case, using mix of characters/digits/special characters).

I too just got this email, although it has my correct name and user account log-in name, it really appears that this is a phishing attempt. None of the links were associated with Delcampe, all were the same giberish link. But I'm afraid they may have gained at least partial access because they had my name and user name, and of course my email address. This does not look good. How do we report this to Delcampe.

Looking closer, it is either a phishing emeail or the links are via a 3rd party email provider I've never heard of.

The domain in the links is XXXXXXXXX.mjt.lu

.lu is the country domain suffix for Luxembourg. Is that where Delcampe is located?

What a fustercluck.

Can't speak for the legitimacy of the email, but the password change requirement appears to be legit. I can no longer login with my old password, and the error message says to try it all lowercase.

Security "upgrade" with the most inane password change ever, emailed in such a way that none of the links in the email are recognizable as legitimate links... what could possibly go wrong?

Oy vey.

This probably won't be the last notice you'll get; there will be more from other sites. It really means that you should change your password regardless. And not by clicking on the link in the email, but going to the site.

I don't know what Delcampe wrote you, but mixing caps and numbers and oddball characters (that you usually can't remember) is supremely hackable nowadays, especially as people throw in personal touches to remember a password. That kind of thing is easily guessed nowadays. Either use a password app that creates a truly randomized password and/or use one as long as you can within the limits of the website. A 10-character-long password is not a problem for the bad guys anymore.

Maybe not for the bad guys but for my memory? It's getting to the point that I can only be a "guest"on sites because the passwords need so many variations I can no longer remember them. I usually use a combination of number preceded by something in the site name, eg, Amazon= az, here is scf, ebay is eb, etc.

I fooled them -- my password is 123456 ; let's see them force that into lowercase

"1-2-3-4-5-6? That's the stupidest combination I've ever heard of in my life! That's the kinda thing an idiot would have on his luggage!"

Bonus points for those who get the movie reference.

Don