Re: [Mug-devel] Passwords and password passwords

[Haim D. <ha...@di...>]

Thank you for your comments John!

Yesterday night, after a wild night at the bar I decided to do some PHP 
and implemented the password recovery. You can see it in action at 
http://www.flux.org/mug . Look underneath the login box for the 'lost 
your password' link. Of course, it only appears if you are NOT logged 
in so make sure you are logged off the site.

Haim.

On Tuesday, October 7, 2003, at 01:47  PM, John Hicks wrote:

> See comments inline.
>
> On Sunday 05 October 2003 04:17 pm, Haim Dimer wrote:
>> Awesome!
>>
>> Now I have many users who asked for the ability to
>> reset their own passwords. Since we keep them
>> encrypted in the database, we can't send it to them
>> by email, can we? Maybe a solution would be to store
>> them in the database encrypted using a key defined
>> in config.php. That way at least we can retrieve
>> them in clear.
>
> An alternative is to reset the password to a randomly
> generated one and email that to the user. He/she can
> then change it to his/her preference.
>
>> As for the emailing it back to the user, how about
>> having the user enter his or her mother's maiden
>> name at registration time and use that answer to see
>> if he or she is who he or she claims to be.
>
> The only significant security problem with using email
> would occur if an interloper has physical access to
> the user's desktop while the user is logged in. Since
> we are not dealing with high finance or national
> security, let's let the user worry about his/her
> desktop security.
>
> Mother's maiden name amounts to a second password
> (since, naturally, no one who guards his/her privacy
> will give his/her mother's actual maiden name :). If
> someone forgets their first password, they're probably
> going to forget the second one. Let's KIS and have
> just one password.
>
> JM2CW.
>
> Regards,
>
> --John
>
>> We have a mailing list at we...@fl...
>> (http://www.flux.org and follow the links to mailing
>> list) that is dedicated to implementing MUG as the
>> website for FLUX. Check it out ...
>>
>> How's the kid by the way?
>>
>> It good to hear from you again dude. I hope all is
>> well.
>>
>> On Sunday, October 5, 2003, at 04:04  PM, David Smith
> wrote:
>>> Meta-admins can add other admins. :)
>>>
>>> For the poll link, I think you can just put
>>> show_results=true in the query string or
>>> something. You'll have to look at the code to be
>>> sure.
>>>
>>> --Dave
>>>
>>> Haim Dimer wrote:
>>>> David,
>>>>
>>>> Thanks for the tip! I implemented it into our
>>>> website and it's great! I
>>>>
>>>> I see that users can either be Meta-Admins,
>>>> Admins or Normal. What is the difference between
>>>> Meta-Admins and regular Admins?
>>>>
>>>> Also, I would like to have a link on the poll
>>>> that people could click on to see the results of
>>>> the poll without having to vote. What do you
>>>> suggest?
>>>>
>>>> Thanks again.
>>>>
>>>> On Sunday, October 5, 2003, at 01:43  AM, David
> Smith wrote:
>>>>> Haim,
>>>>>
>>>>> You can use the $admin_email variable that is
>>>>> set in the config.php file.
>>>>> Just add a call to the mail() function in
>>>>> suggestions.php like so:
>>>>>
>>>>> $suggestion_contents = 'foo'; // fill in with
>>>>> form contents mail( $admin_email, 'New
>>>>> suggestion', $suggestion_contents );
>>>>>
>>>>> That should do the trick. When you're done, send
>>>>> the diff to Jake Albretsen. He can apply the
>>>>> patch in CVS. I'm not officially doing mug
>>>>> development right now. :)
>>>>>
>>>>> --Dave
>>>>>
>>>>> <quote who="Haim Dimer">
>>>>>
>>>>>> Thanks for the reply!
>>>>>>
>>>>>> I was mentioning to a buddy of mine how cool it
>>>>>> would be to have the admins emailed every time
>>>>>> there is something that needs to be approved.
>>>>>> What do you think about doing that? Which
>>>>>> function can I call to email
>>>>>> the admins? Where should I put the call to it?
>>>>>>
>>>>>> On Wednesday, October 1, 2003, at 10:03  PM,
> David Smith wrote:
>>>>>>> You can set this on a per-user basis in the
>>>>>>> "My Alerts" section under
>>>>>>> "My
>>>>>>> Account". Currently, supported is notification
>>>>>>> for:
>>>>>>>
>>>>>>>  New users
>>>>>>>  New articles
>>>>>>>  New announcements
>>>>>>>  New screenshots
>>>>>>>  New events.
>>>>>>>
>>>>>>> I do not believe that the admin is mailed
>>>>>>> automagically when a suggestion
>>>>>>> is posted, so you may have to add that
>>>>>>> yourself. Should be easy enough.
>>>>>>>
>>>>>>> --Dave
>>>>>>>
>>>>>>> <quote who="Haim Dimer">
>>>>>>>
>>>>>>>> Good Deal!
>>>>>>>>
>>>>>>>> I remember in the first version, back when
>>>>>>>> the software was not called
>>>>>>>> mug yet, there was a great feature that I
>>>>>>>> find missing in the version
>>>>>>>> I
>>>>>>>> have today. It is the ability for the system
>>>>>>>> to email the administrators whenever a new
>>>>>>>> member signs up or a new suggestion is
>>>>>>>> posted.
>>>>>>>>
>>>>>>>> Where should I look for this feature?
>>>>>>>>
>>>>>>>> On Wednesday, October 1, 2003, at 03:02  PM,
> David Smith wrote:
>>>>>>>>> pong.
>>>>>>>>>
>>>>>>>>> <quote who="Haim Dimer">
>>>>>>>>>
>>>>>>>>>> Just a test to see if the list is still
>>>>>>>>>> alive
>
>>>>>> Haim.
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Mug-devel mailing list
> Mug...@li...
> https://lists.sourceforge.net/lists/listinfo/mug-devel
>
>

Haim.

--
"poetry - cooking - eating - talking - singing - acting - working - 
enjoying.
Because tapping on a glass sounds better than honking a horn."