Shoutbox

I wanted to reset my Nathan account, because I forgot my p/w. So I used the forgotten password tool. But it sent me emails about account ghostie and spammer. I don't remember making these account, but I could of. Either way it should not reset password (or send the link) for all 3 accounts, right WDZ?

Its a crappy system and sends emails to all accounts registered under that email.

quote:

---

Originally posted by matty
Its a crappy system and sends emails to all accounts registered under that email.

---

Because it doesn't know which account you forgot the password for.

If the form only asked for a username, someone could send me a password reset email without even knowing the address I registered with, which is kinda dodgy. And if it came up with a list of usernames associated with an email address, that would be a privacy issue because there's currently no other way to search for members by email address.

It wouldn't be bad to have a custom security question plus username

Why not asking for both username and e-mail address, and only send the reset e-mail only when the input e-mail address matches that in the database for the username?

quote:

---

Originally posted by blessedguy
custom security question

---

No. Whoever invented security questions should be shot.

quote:

---

Originally posted by person who should be shot
Hey, if you forgot your password you could just access your account with a second password which is easier to guess or socially engineer.

---

I always randomly hit my keyboard if a service requires you set up a secret question/answer. If the ever make me answer the question the service wasn't worth using in the first place.

its a good thing tbh, help you to remember all your accounts

quote:

---

Originally posted by WDZ

quote:

---

Originally posted by matty
Its a crappy system and sends emails to all accounts registered under that email.

---

Because it doesn't know which account you forgot the password for.

If the form only asked for a username, someone could send me a password reset email without even knowing the address I registered with, which is kinda dodgy. And if it came up with a list of usernames associated with an email address, that would be a privacy issue because there's currently no other way to search for members by email address.

---

You could very easily have a "click this link to set a new password" link if they just input the username. Thus, if you get it, and it wasn't you, you can click the report link, or do nothing at all. I don't think entering a username is such a bad idea.

I'm surprised you are allowing multiple accounts on a single emailaddress anyway .

quote:

---

Originally posted by Menthix
I'm surprised you are allowing multiple accounts on a single emailaddress anyway .

---

there is nothing in the rules saying u can't have multiple accounts