I've been working on our getting password resets to work better.
Password Resets - What changed
I have made a small number of changes to make our mail setup to be very precise about which IP addresses it sends mail from, got a reverse DNS pointer for that IP address, and updated our MX and SPF records to point at the correct IP address. These things now allow us to send mail to Hotmail (verified) and Optus (unverified, but the mail was delivered).
Testers Needed
I need a few volunteers on a couple of different ISPs.
The problematic ISPs in the past have been
- BigPond
- Optus
- TPG
- Hotmail
If you use one of these ISPs and want to help you, please PM me with your Skype, MSN, Google Talk, or AIM (iChat) username so we can talk in real time whilst we test the password reset mechanism.
What will happen?
I will add you to my chatting software so we can chat in real time. Once we're talking, I will get you to do a password reset or to change your e-mail address. If you don't receive an e-mail in the next five minutes, I will know if things are working or not.
No matter what, I will make sure you have access to your account before we finish talking - either by me resetting your password for you or you using the password reset feature to do it yourself.
Internet Explorer Login Woes - Changes Coming
In the next few weeks, I will be making small changes to help IE 7/8 users with logging onto the forum. I think I know what's happening here, but again need volunteers to make sure I have it working properly - and so I don't break the forum for Firefox / Safari / Chrome / Opera users.
I don't think you'll need to log on again for these changes, but if you're paranoid, you might see a Set-Cookie2: cookie (rarely used in real life), which has a version record. Version one records will continue to work, but if your browser supports Set-Cookie2, you will be a great deal safer from session hijacking attempts.
Username Rules
Lastly, for those of you still to register, I will be utterly relaxing the rules on user names within two months as we'll be moving to UID based prepared statements for all member record access. This not only will speed up the forum, it will make it less "hackable" and improve the choice of usernames. At that time, I will let a small number of users know that they may need to choose a new username as their username is the same as another user's due to capitalization reasons. To be fair and even with all of the affected users, the person with the lower user ID will win this battle - as they had the username first.
thanks,
Andrew
