Increasing login security

Forums › Geekzone › Increasing login security

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#88593 18-Aug-2011 16:28

Hello folks

We have just made a small change to our login system: if your IP address changes since your login then your session will be closed and you will have to login again.

This will reduce the chances some malicious software or web sites could use the tokens we give out when you login to impersonate your user here on Geekzone.

It may be an incovenience for some mobile users since those are more likely to have their IP address changed without notice. If you see a message stating your session terminated because of your IP address changed then you will know why.

This is the default behaviour. There's now an option on your profile that will control this and you can turn it off if needed.

1 | 2 | 3 | 4

1598 posts

Uber Geek
Inactive user

#508646 18-Aug-2011 16:29

Excellent feature for improving the website security in general. Also, there is a typo in your first sentence.

NonprayingMantis

6434 posts

Uber Geek

#508650 18-Aug-2011 16:33

does thismean if I use geekzone on two computers (e.g. my home desktop and my home laptop) then each time I switch between the two I will be logged out and will have to manually log back in again?

codyc1515

1598 posts

Uber Geek
Inactive user

#508651 18-Aug-2011 16:36

NonprayingMantis: does thismean if I use geekzone on two computers (e.g. my home desktop and my home laptop) then each time I switch between the two I will be logged out and will have to manually log back in again?

Probably will be better for you if you disable the feature in this case then.

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#508652 18-Aug-2011 16:37

Good question. The answer is "no".

This is on per IP/browser basis. You can be logged on your home PC, on your work and those are considered independent sessions.

If you get your work PC out of the docking station, goes to a another city and start using your laptop at the hotel then it will be a different IP address and your work PC will be logged out. This will not affect the home PC.

However, there's a link you can click (it's been there for some time now) that will "destroy" all existing sessions.

This is handy for example if you turn off the IP address lock feature but have your work laptop stolen. You can click that link from any other PC and *ALL* your sesions will be closed, regardless of which browser or PC is currently logged in. This is good for example if you use Geekzone from a Internet Cafe and leave the session open. You can then close it remotely.

RunningMan

8955 posts

Uber Geek

#508662 18-Aug-2011 16:54

freitasm: if your IP address changes since your login then your session will be closed and you will have to login again.

If you are behind a NAT router, is it the internal or external IP changing that triggers the logout?

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#508663 18-Aug-2011 17:00

It should be the external one.

codyc1515

1598 posts

Uber Geek
Inactive user

#508672 18-Aug-2011 17:36

freitasm: Good question. The answer is "no".

This is on per IP/browser basis. You can be logged on your home PC, on your work and those are considered independent sessions.

If you get your work PC out of the docking station, goes to a another city and start using your laptop at the hotel then it will be a different IP address and your work PC will be logged out. This will not affect the home PC.

However, there's a link you can click (it's been there for some time now) that will "destroy" all existing sessions.

This is handy for example if you turn off the IP address lock feature but have your work laptop stolen. You can click that link from any other PC and *ALL* your sesions will be closed, regardless of which browser or PC is currently logged in. This is good for example if you use Geekzone from a Internet Cafe and leave the session open. You can then close it remotely.

Whoops, I take back my prior statement. This is correct, it would be separate sessions.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#508791 18-Aug-2011 23:28

I've noticed a problem with this new way of managing security when accessing the main site from a smartphone.

Ooops. I will be looking at this later this week.

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#508888 19-Aug-2011 10:45

Actually just tested in this happens only on Telecom XT. I am following up this.

Finch

2851 posts

Uber Geek

#508890 19-Aug-2011 10:52

This is the default behaviour. There's now an option on your profile that will control this and you can turn it off if needed.

Where is this option? Im either blind or its not there.

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#508891 19-Aug-2011 10:53

It's there, under "Security Options".

Paulthagerous

698 posts

Ultimate Geek

Trusted

#509080 19-Aug-2011 16:30

I may be a bit slow today, but I can't even find security options :(

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509101 19-Aug-2011 17:19

Are you looking at http://www.geekzone.co.nz/upd_user.asp at all?

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509102 19-Aug-2011 17:20

Also note that this should not be turned off unless you understand the implications and why we implemented it.

hellonearthisman

1819 posts

Uber Geek

Trusted

#509111 19-Aug-2011 17:42

I have it off but would like it on, if it could recall where I was going on geekzone.
I get an email to a thread, click the link and then have to log in and
geekzone forgets that I was heading to a link once logged in.

Could it at lease send me to the thread and ask to be logged in from there?

1 | 2 | 3 | 4