Re: [Mug-devel] Passwords and password passwords

[John H. <joh...@gu...>]

See comments inline.

On Sunday 05 October 2003 04:17 pm, Haim Dimer wrote:
> Awesome!
>
> Now I have many users who asked for the ability to
> reset their own passwords. Since we keep them
> encrypted in the database, we can't send it to them
> by email, can we? Maybe a solution would be to store
> them in the database encrypted using a key defined
> in config.php. That way at least we can retrieve
> them in clear.

An alternative is to reset the password to a randomly 
generated one and email that to the user. He/she can 
then change it to his/her preference.

> As for the emailing it back to the user, how about
> having the user enter his or her mother's maiden
> name at registration time and use that answer to see
> if he or she is who he or she claims to be.

The only significant security problem with using email 
would occur if an interloper has physical access to 
the user's desktop while the user is logged in. Since 
we are not dealing with high finance or national 
security, let's let the user worry about his/her 
desktop security.

Mother's maiden name amounts to a second password 
(since, naturally, no one who guards his/her privacy 
will give his/her mother's actual maiden name :). If 
someone forgets their first password, they're probably 
going to forget the second one. Let's KIS and have 
just one password.

JM2CW.

Regards,

--John

> We have a mailing list at we...@fl...
> (http://www.flux.org and follow the links to mailing
> list) that is dedicated to implementing MUG as the
> website for FLUX. Check it out ...
>
> How's the kid by the way?
>
> It good to hear from you again dude. I hope all is
> well.
>
> On Sunday, October 5, 2003, at 04:04  PM, David Smith 
wrote:
> > Meta-admins can add other admins. :)
> >
> > For the poll link, I think you can just put
> > show_results=true in the query string or
> > something. You'll have to look at the code to be
> > sure.
> >
> > --Dave
> >
> > Haim Dimer wrote:
> >> David,
> >>
> >> Thanks for the tip! I implemented it into our
> >> website and it's great! I
> >>
> >> I see that users can either be Meta-Admins,
> >> Admins or Normal. What is the difference between
> >> Meta-Admins and regular Admins?
> >>
> >> Also, I would like to have a link on the poll
> >> that people could click on to see the results of
> >> the poll without having to vote. What do you
> >> suggest?
> >>
> >> Thanks again.
> >>
> >> On Sunday, October 5, 2003, at 01:43  AM, David 
Smith wrote:
> >>> Haim,
> >>>
> >>> You can use the $admin_email variable that is
> >>> set in the config.php file.
> >>> Just add a call to the mail() function in
> >>> suggestions.php like so:
> >>>
> >>> $suggestion_contents = 'foo'; // fill in with
> >>> form contents mail( $admin_email, 'New
> >>> suggestion', $suggestion_contents );
> >>>
> >>> That should do the trick. When you're done, send
> >>> the diff to Jake Albretsen. He can apply the
> >>> patch in CVS. I'm not officially doing mug
> >>> development right now. :)
> >>>
> >>> --Dave
> >>>
> >>> <quote who="Haim Dimer">
> >>>
> >>>> Thanks for the reply!
> >>>>
> >>>> I was mentioning to a buddy of mine how cool it
> >>>> would be to have the admins emailed every time
> >>>> there is something that needs to be approved.
> >>>> What do you think about doing that? Which
> >>>> function can I call to email
> >>>> the admins? Where should I put the call to it?
> >>>>
> >>>> On Wednesday, October 1, 2003, at 10:03  PM, 
David Smith wrote:
> >>>>> You can set this on a per-user basis in the
> >>>>> "My Alerts" section under
> >>>>> "My
> >>>>> Account". Currently, supported is notification
> >>>>> for:
> >>>>>
> >>>>>  New users
> >>>>>  New articles
> >>>>>  New announcements
> >>>>>  New screenshots
> >>>>>  New events.
> >>>>>
> >>>>> I do not believe that the admin is mailed
> >>>>> automagically when a suggestion
> >>>>> is posted, so you may have to add that
> >>>>> yourself. Should be easy enough.
> >>>>>
> >>>>> --Dave
> >>>>>
> >>>>> <quote who="Haim Dimer">
> >>>>>
> >>>>>> Good Deal!
> >>>>>>
> >>>>>> I remember in the first version, back when
> >>>>>> the software was not called
> >>>>>> mug yet, there was a great feature that I
> >>>>>> find missing in the version
> >>>>>> I
> >>>>>> have today. It is the ability for the system
> >>>>>> to email the administrators whenever a new
> >>>>>> member signs up or a new suggestion is
> >>>>>> posted.
> >>>>>>
> >>>>>> Where should I look for this feature?
> >>>>>>
> >>>>>> On Wednesday, October 1, 2003, at 03:02  PM, 
David Smith wrote:
> >>>>>>> pong.
> >>>>>>>
> >>>>>>> <quote who="Haim Dimer">
> >>>>>>>
> >>>>>>>> Just a test to see if the list is still
> >>>>>>>> alive

> >>>> Haim.