Password reset log

[Raize]

Implementing TOTP 2FA is significantly more effective than implementing a password reset log.

It's also significantly more difficult. SMF's password-handling and use is, to put it simply, horrible. It's better to just have the new forum designed from the ground up to use 2FA than to even attempt to hack it into SMF. I can't speak for theymos, but I'd be terrified to try to hack up a 2FA for SMF given the little I already know of its code and especially the anti-XSS part of it.

I just recently changed my password and I think I agree with the others, it should be a bigger font and maybe even RED and bolded. It might help cut down significantly on the "oh, I got hacked!" scams. Of course, it's going to have to require that a lot of folks actively refuse to do business with people who have changed their password or reset their account recently.

[Salmon1989]

And I imagine setting up 2F is significantly more work than implementing a simple password reset log. Shouldn't be too long for the new forum now anyway.

You mean the new forum that's supposedly in the works since jan 2013? Frankly, I don't understand why there's a need to design a completely new forum software from scratch when there are many off-the-shelve open-source choices available. It would save so much time going with one of them that closely fits the requirements and just customize and mod it to fit our purposes.

The following is what theymos said 8 months ago about the new forum software.

Why do you think we needed to spend so much for software when there are free or much cheaper option available?

The most popular forum software is:
- Old.
- Written in PHP, which sucks.
- Written insecurely and messily.
- Difficult to modify, especially safely.
- Not much more featureful than SMF, if at all.

There are a handful of newer forum software packages which solve some of those problems, but all of them are very sparse in features.

The goal of this software project is to create new, open source forum software which will compete with SMF, phpBB, etc.

What special features will the forum have?

This isn't completely defined yet. It'll have almost all features that we have now. A main goal will be improving filtering and data presentation so that users can more easily manage the flood of posts both board-wide and within threads, while simultaneously reducing the need for centralized moderation.

[theymos]

I added color-coding to the usernames in this log. That'll make it easier to pick out more valuable accounts from the list. The colors are the same as the colors on Who's Online:
- Admins = red
- Global mods = dark blue
- Donators = green
- VIPs = violet
- Staff = pink
- Regular users are various shades of grey, getting darker with seniority.
- Legendary = lightish blue

Also, I made the "reset recently" text darker and larger.

[Muhammed Zakir]

I added color-coding to the usernames in this log. That'll make it easier to pick out more valuable accounts from the list. The colors are the same as the colors on Who's Online:
- Admins = red
- Global mods = dark blue
- Donators = green
- VIPs = violet
- Staff = pink
- Regular users are various shades of grey, getting darker with seniority.
- Legendary = lightish blue

Also, I made the "reset recently" text darker and larger.

Thanks! Now it is better.

Off-topic: It would be good if you make a total no. of logged in users and total no. of guests in a small box or something like that in Who's Online.

   ~~MZ~~

[--Encrypted--]

sorry for bumping an old topic, but I have just noticed something a little strange while I was wandering around.

KWH's trust page shows the "This user's password was reset recently." notice, but according to seclog, his password hasn't been changed since May 25th. and I compared him with some other members that had changed their password on that day, but I don't see anything like this.

which one is correct?

for additional info, I noticed that before this appeared on the seclog. "10:36:25 PM - DooMAD - password changed"

[Muhammed Zakir]

sorry for bumping an old topic, but I have just noticed something a little strange while I was wandering around.

KWH's trust page shows the "This user's password was reset recently." notice, but according to seclog, his password hasn't been changed since May 25th. and I compared him with some other members that had changed their password on that day, but I don't see anything like this.

which one is correct?

for additional info, I noticed that before this appeared on the seclog. "10:36:25 PM - DooMAD - password changed"

KWH resetted his password via email. It will be shown till June 25.

-snip-
Additionally, these same actions will be listed on the person's Trust page. A reset will be shown for 30 days, while a password change will be shown for 3 days.
 -snip

[yogg]

Sorry for bumping an old thread...

Is there any way to check the seclog archives for between 2015 and 2017 ? Yeah, I know it's 24 months and it keeps only the last 30 days...  

I tried webarchive but it didn't keep track of everything.