Technical Issues - TPU Main Site & Forum (2021)

[Bill_Bright]

I will have to reset passwords on approximately = 260 different sites !!!!

Then it is time (long long overdue, actually) to start using unique PWs for each site. Most 1/2 way decent PW managers will generate unique PWs for you. I have well over 400 entries in my PW manager for sites I have accounts at. I had well over 550! I started a couple years ago to work my way through to (1) verify the site was still alive (if not, it was deleted), (2) update their addresses to https and (3), set a unique PW. A real, tedious PITA, but, IMO, an evil necessity.

BTW, Mary had a little lamb is easier to remember but harder to crack than ^V6yZn5$. I'm just saying... .

***

FTR, I'm okay with 2FA as long as it is not required every time I log on AND it does not involve sending a text/code to my cell phone. Unlike many these days, my cell phone is not glued to my body, I don't live on it, and it does not control my life.

At another XenForo site where I'm on the staff, every 30 days, when we attempt to log in, we get a message saying we have to enter a unique 2FA code to complete the log in. I still find it annoying but I can live with it. What makes it very tolerable is that as soon as you see the message saying you need to enter a new code, the email with the new code is already in the inbox of your registered email address.

My primary doctor's website requires a new code every single day. I HATE THAT. But what makes it worse is that it often takes 10 minutes for the code to appear in my inbox. That is unacceptable.

 

[W1zzard]

how am i doing so far?

 

[Bill_Bright]

Will this appear when we clean out our cookies?

 

[Night]

how am i doing so far?

Just what is needed. Looks great.
Edit: Also will this appear while we're using the site or only at login?

 

[W1zzard]

Will this appear when we clean out our cookies?

no

 

[Bill_Bright]

I like it!

 

[W1zzard]

This is live now

 

[Space Lynx]

This is live now

SEE MY SIGNATURE BOYS!!!

side note - W1zz might delete this sig... LOL its ok

 

[W1zzard]

SEE MY SIGNATURE BOYS!!!

sigh, lol

 

[WhitetailAni]

So you don't have email?

I do have email, but 2FA is pointless with email IMO. With the email you can change the password.
I'll put it this way: A 2FA security system is a hallway with 2 doors with separate keys. 2FA w/ one password and one SMS message, the two keys are separate. There's a secret door that requires a third key that lets you bypass the first door.
With 2FA w/ one password and one email message, the secret door and the second door now share the same key. If you have the key to the second door, you have the key to the secret door, rendering the first door (the regular password) useless.

 

[W1zzard]

but 2FA is pointless with email IMO

that's why you should use the app method

 

[Bill_Bright]

I do have email, but 2FA is pointless with email IMO. With the email you can change the password.

With 2FA w/ one password and one email message, the secret door and the second door now share the same key.

No they don't - not unless your email account uses the same PW as the site - and that would be dumb.

 

[WhitetailAni]

that's why you should use the app method

I wish I had a phone

No they don't - not unless your email account uses the same PW as the site - and that would be dumb.

You can reset your password with your email. If someone gains access to my email, they can then reset the password to here. Once they change that, if I have email 2FA on, the email code is pointless. It's like making a door out of cheese instead of steel.

 

[Frick]

I do have email, but 2FA is pointless with email IMO. With the email you can change the password.
I'll put it this way: A 2FA security system is a hallway with 2 doors with separate keys. 2FA w/ one password and one SMS message, the two keys are separate. There's a secret door that requires a third key that lets you bypass the first door.
With 2FA w/ one password and one email message, the secret door and the second door now share the same key. If you have the key to the second door, you have the key to the secret door, rendering the first door (the regular password) useless.

One key goes to both doors sure, but the other doesn't, and that is the point. It's more likely someone will get your credentials to a random site site than say Hotmail or Gmail.

 

[Bill_Bright]

You can reset your password with your email. If someone gains access to my email, they can then reset the password to here.

"IF" someone gains access to your email? Come on! That's a big if and it applies to every account you own - including the email account itself. Plus, they would also have to know your username and perhaps other information to even request a PW reset.

Of course it is still possible but bad guys tend to be lazy opportunists. If they received any level of resistance, they move on to easier pickings. You essentially are describing a scenario where someone knows you personally, is targeting you personally, and is out to do you harm. And in that case, you have bigger issues to worry about.

I mean you could use a fingerprint reader. But then a bad guy could still access your account "IF" they cut off your finger.

 

[rtwjunkie]

I've used it for 3 years and only ever received one email saying verify your account when I made it'

I have it and I've never had to use 2FA for it

Because I get on Several Discord accounts infrequently, I always have to 2FA get onto there.

 

[newtekie1]

I find this kind of system really annoying as i have a dynamic ip and it means i have to do it everymonth
idk how you would fix it im just saying it annoys me

Do what? It would just be a notification email telling you that you logged in from a new IP.

Plus there's some people (like me) who can't use 2FA. Requiring it would essentially boot me out of here.

What reason do you have that you can't use 2FA?

I do have email, but 2FA is pointless with email IMO. With the email you can change the password.

I have to wonder, do you think someone who managed to hack your email is going to target your TPU account and not any of the other higher value accounts they have access to?

I can just see the hacker now: "I finally got into his email! Let's see, he has banks accounts, and a 401K account, and an eTrade account...wait a minute, what is this?!? He has a TPU account, hell yeah! I'm going after that TPU account first thing!"

 

[WhitetailAni]

What reason do you have that you can't use 2FA?

I can't log into my main email from school devices. I would use SMS, but I don't have a phone.

 

[newtekie1]

I can't log into my main email from school devices. I would use SMS, but I don't have a phone.

So they don't allow you to check any email service, but let you log into TPU just fine? Somehow I find that unbelievable.

 

[WhitetailAni]

So they don't allow you to check any email service, but let you log into TPU just fine? Somehow I find that unbelievable.

No, I can log into my school email. But I'm restricted to only emails that have their school district extension, of which my personal email is not one.
But yes, I can log into TPU and LTT.
No Reddit though.

 

[Space Lynx]

I wish I had a phone

You can reset your password with your email. If someone gains access to my email, they can then reset the password to here. Once they change that, if I have email 2FA on, the email code is pointless. It's like making a door out of cheese instead of steel.

I get text message sent to phone if someone tries to reset my password on email.

 

[Durvelle27]

Im curious as to how @Durvelle27 machine was exploited also where the exploit originated from and how and when. Was there some malicious code written to the FP that injected some other code and started hijacking or logging the users keypresses? what was TPUs involvement in all of it if multiple users was hacked? It couldnt of been a freak accident unless the affected accounts are either all run by the same person which is against ToS or the users both visted the same website or clicked on the same link that lead to their details being stolen or hacked. Im guessing it wasnt a brute force attack because TPU would have banned many I.Ps already

I think me being so cool painted a target on my back XD

 

[Mussels]

Agreed. I'm thinking about making it mandatory for staff, but not even that is decided yet

Logical enough, staff are the ones who are most likely to be targeted and can do the most damage

So they don't allow you to check any email service, but let you log into TPU just fine? Somehow I find that unbelievable.

Thats how it always worked for me even a decade ago - they blocked third party email access on-site due to the security risk

Even back then in the XP days i could just bypass it with a VPN, but he's certainly in a rare situation with no access to any 2FA stuff.
He can make the choice to have no 2FA at the risk of his security, seems fair.

I think me being so cool painted a target on my back XD

Probs got your password hacked from another forum breach and used the same name there. I can see myself getting potentially hit by that since i go by the same name (with different passwords) in a lot of forums, but i could have used the same password twice at some point

 

[newtekie1]

He can make the choice to have no 2FA at the risk of his security, seems fair.

But as we've seen, it's no longer just the risk of his security. People lost large amounts of money here.

 

[Hachi_Roku256563]

But as we've seen, it's no longer just the risk of his security. People lost large amounts of money here.

maybe require the setting on to engadge in buying and selling