Go Back   vb.org Archive > vBulletin 3 Discussion > vB3 General Discussions
FAQ Community Calendar Today's Posts Search

Reply
 
Thread Tools Display Modes
  #1  
Old 07-25-2007, 01:20 AM
jbroder jbroder is offline
 
Join Date: Oct 2002
Posts: 2
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default lost/reset password system needs work

I have two VB installs, running 3.0 and 3.6.

My users are not always the most tech-savvy, and so they get really confused by the lost password system.

The way the standard lost pw system works is that it emails the user a link to generate a new numeric (ex: 3450596) password, and then requires the user to use the user cp to change the password to something the user wants.

What would be more user-friendly, in my opinion, would be to bypass the numeric password, and send an email that says click here to update your password.

The change password url would have some sort of quick-expiring querystring hash to prevent unauthorized access.

I think this would be as secure as the existing system, since both will allow the email recipient to change the password. Mine just has fewer steps for the user to take.

I have been searching here for a mod like this, and didn't see any, but "lost password" is not a very unique search string, so maybe it is there and I just can't find it.

Does anyone know of a mod that does this?

Does anyone think this would be useful?

Does anyone think this is less secure than the existing system?

Thanks for a great site. I hope I put this in the right forum. I come here whenever I need something, and it always works out.

Jon
Reply With Quote
  #2  
Old 09-08-2007, 10:09 AM
perfphysio's Avatar
perfphysio perfphysio is offline
 
Join Date: Sep 2006
Location: London, UK
Posts: 212
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

I have asked for the same thing. It seems the password is saved as a one-way encrypted hash, which is ridiculous for user management and convenience. My users have allo sorts of problems trying to work out how to work with the resent temp one and then updating it etc etc. I to am hoping someone makes a mod for this to fix the moist annoying issue and it is perhaps the worst thing about what it otherwise a really good forum solution.

Many of my users have however left the site due to this continual problem!
Reply With Quote
  #3  
Old 09-08-2007, 07:12 PM
XFSImperial's Avatar
XFSImperial XFSImperial is offline
 
Join Date: Jul 2004
Location: USA
Posts: 100
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

I usually find that more people message asking for password resets than those who actually attempt to use the form. I think it is something that could be improved upon for future builds. How to best do it securely, that's up for debate.
Reply With Quote
  #4  
Old 09-08-2007, 09:57 PM
Paul M's Avatar
Paul M Paul M is offline
 
Join Date: Sep 2004
Location: Nottingham, UK
Posts: 23,748
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

I would think the obvious reason it works this way is to stop other users locking you out of your own account. If you can goto a link that just resets your password then so can I, therefore resetting your password and locking you out. Better still I could write a small script that does it for every user - basic denial of service attack.
Reply With Quote
  #5  
Old 09-09-2007, 01:39 PM
JacBowen JacBowen is offline
 
Join Date: Aug 2007
Location: Oxford
Posts: 62
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Think that's a no then lol.
Reply With Quote
Reply


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 09:44 PM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.03430 seconds
  • Memory Usage 2,192KB
  • Queries Executed 11 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (5)post_thanks_box
  • (5)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (5)post_thanks_postbit_info
  • (5)postbit
  • (5)postbit_onlinestatus
  • (5)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete