Increasing login security

Forums › Geekzone › Increasing login security

1 | 2 | 3 | 4

1598 posts

Uber Geek
Inactive user

#509360 20-Aug-2011 14:33

freitasm: But we should provide the option. I actually thought of implementing a two factor authentication earlier this year. Just thought was overkill for Geekzone.

However... Another thought: I have a hidden "feature" that sends me an email if someone tries to login using my user name. Never actually received a notification, until last night, when someone tried to login on Geekzone as "freitasm" from a Chinese IP address.

For the first feature check out the YubiKey from YubiCo. They are a really cool device, similar to the more expensive ones but with comparable security and a much lower price point. As for the last feature, that would be cool to have too. Facebook has this feature. also

freitasm: Lucky we don't store or show passwords in plain text, otherwise this would be another risk.

Email sent.

Norton

Get easy to use, easy to install Norton antivirus protection against advanced online threats (affiliate link).

freitasm

BDFL - Memuneh
76341 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509480 20-Aug-2011 23:17

Please note I have now changed the default for this feature to be the opposite.

If you want increased security you have to check the box. It will be unchecked by default.

This is because of the number of emails I received from people having problems with their low quality DSL connections that kept changing IP address on every modem reset.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

codyc1515

1598 posts

Uber Geek
Inactive user

#509488 20-Aug-2011 23:44

freitasm: Please note I have now changed the default for this feature to be the opposite.

If you want increased security you have to check the box. It will be unchecked by default.

This is because of the number of emails I received from people having problems with their low quality DSL connections that kept changing IP address on every modem reset.

I find it concerning the number of people having issues with their connections..

freitasm

BDFL - Memuneh
76341 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509493 20-Aug-2011 23:57

Yep... While at this, I will prepare a page showing all current login activity - might even give each session a name.

Not for this week though - Microsoft TechEd is upon us and I will spend the week in Auckland.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

raytaylor

3835 posts

Uber Geek

Trusted

#509516 21-Aug-2011 02:24

So the ip changing auto login thing is turned off?
I havent been able to login properly and post because i have my internet load balanced between a couple of dedicated connections. One of my customers who uses this site was also having problems.

tried switching off the load balancing just for geekzone and just push it through one connection but it didnt really work for some reason.

oh my - that was the first post to work tonight - tried to reply earlier this evening and had issues but now it just worked. awesome.

My bank uses two factor authentication. After the normal login screen, you have to choose your 3 icons out of 9 random ones. They move and change each time. Super annoying at first because i am quite happy with just a username and password, but i have gotten used to it.
If you do implement two factor authentication, can you use the same icon library as my bank??? lol

Ray Taylor

There is no place like localhost

Spreadsheet for Comparing Electricity Plans Here

freitasm

BDFL - Memuneh
76341 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509529 21-Aug-2011 08:42

It is off by default. Anyone wanting to use it needs to change the setting in your own profile page.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

freitasm

BDFL - Memuneh
76341 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509541 21-Aug-2011 09:59

hellonearthisman: I have it off but would like it on, if it could recall where I was going on geekzone.
I get an email to a thread, click the link and then have to log in and
geekzone forgets that I was heading to a link once logged in.

Could it at lease send me to the thread and ask to be logged in from there?

You should now have a link on IPChange.asp that will forward you to login.asp and from there directly to your final destination after you login.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

hellonearthisman

1819 posts

Uber Geek

Trusted

#509543 21-Aug-2011 10:22

freitasm:
hellonearthisman: I have it off but would like it on, if it could recall where I was going on geekzone.
I get an email to a thread, click the link and then have to log in and
geekzone forgets that I was heading to a link once logged in.

Could it at lease send me to the thread and ask to be logged in from there?

You should now have a link on IPChange.asp that will forward you to login.asp and from there directly to your final destination after you login.

Awesome, thanks so much.

old3eyes

8995 posts

Uber Geek

Subscriber

#509644 21-Aug-2011 17:08

I'm seeing an old issue come back again since you did these changes. Regardless of whether I "Reset read flags" or log out the next time I access GZ I see all the items that I have seen for the current day. I have turned off the security settings..

Regards,

Old3eyes

freitasm

BDFL - Memuneh
76341 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509646 21-Aug-2011 17:12

Yes, I've seen this and I will be changing this bit.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

freitasm

BDFL - Memuneh
76341 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509660 21-Aug-2011 18:13

This should be fixed now.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

hellonearthisman

1819 posts

Uber Geek

Trusted

#509733 21-Aug-2011 23:02

The login is directing nicely but I have a problem that login offered under the navigation menu doesn't work

and I have to click the link to go to the login screen to login.

freitasm

BDFL - Memuneh
76341 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509734 21-Aug-2011 23:16

It works for me. Are you using a saved password? Is it correct?

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

hellonearthisman

1819 posts

Uber Geek

Trusted

#509765 22-Aug-2011 02:25

freitasm: It works for me. Are you using a saved password? Is it correct?

Yes and Yes.

Using win7 and Google chrome.

Just now, coming via an email link, I could view the thread and was not asked for login until I replied and was presented with the login screen. Worked well and with no problem.
But changing my IP address and refreshing the page, I get the same issue as described before.

I also logged out and then logged in while keeping the same IPaddress and using the login below the navbar worked without a hitch.

freitasm

BDFL - Memuneh
76341 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#509818 22-Aug-2011 10:05

The IPChange page is no longer accessible if you are logged in. This will prevent people thinking they are logged out, when they are not.

The login form on top of IPChange notification will redirect to the destination page, the same as the link, saving one click if you rather use that form instead of going to the login page itself.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

1 | 2 | 3 | 4