New Security Measures

Blog Discussion in 'BeerAdvocate Talk' started by Todd, Jul 17, 2020.

Thread Status:
Not open for further replies.
Page 1 of 4
  1. Todd

    Todd Founder (13,518) Aug 23, 1996 Finland
    STAFF Mod Team Society Pooh-Bah

    In addition to the numerous measures that we've taken since the 2012-2013 data breach, we just applied the following updates to help protect our services and your accounts.

    Mass Password Reset
    To secure all accounts, all passwords have been changed and password resets are required.
    • Important: If you no longer have access to the email that's associated with your account, please contact us with your username, existing email address, and new email address.
    • Important: You won't be able to change your password (different than resetting) or email address from your account settings until you reset your password (see below).
    How to Reset Your Password
    https://www.beeradvocate.com/community/lost-password/
    • If you're logged out, use the above link to reset your password.
    • If you're logged in, you'll need to log out (desktop: mouseover your avatar/name; mobile: click your avatar in the main navigation) and reset your password using the above link.
    • No action is required if you created your account after 3pm PT on July 17, 2020.
    Forced Password Changes
    Passwords will eventually expire based on various criteria.

    Login Sessions
    Do you log in from multiple devices? Head to your account settings to view all active login sessions for your account and remove sessions from your devices. Handy if you forgot to log out from a public or work computer.

    Security Watchers
    We've installed watchers to help detect abnormal or malicious site activity.

    Questions on these measures and protecting your account? Let us know.

    We also recommend that you read: How to Secure Your Account.
     
    #1 Todd, Jul 17, 2020
    Shanex, WoodBrew, larryi86 and 10 others like this.
  2. Bitterbill

    Bitterbill Grand High Pooh-Bah (7,036) Sep 14, 2002 Wyoming
    BA4LYFE Society Pooh-Bah

    Done.
     
    #2 Bitterbill, Jul 18, 2020
    BrewsOverHoes, AZBeerDude72 and SFACRKnight like this.
  3. SFACRKnight

    SFACRKnight Grand Pooh-Bah (3,348) Jan 20, 2012 Colorado
    Pooh-Bah Trader

    Ditto. Didnt see the email, figured my account got haxored. :rolling_eyes:
     
    #3 SFACRKnight, Jul 18, 2020
    ChicagoJ, Shanex and BrewsOverHoes like this.
  4. Jugs_McGhee

    Jugs_McGhee Grand High Pooh-Bah (6,140) Aug 15, 2010 Texas
    Pooh-Bah Trader

    There's literally no way to actually read your privacy policy or terms of use before clicking the checkbox to agree to them. The links to them aren't active until after you've agreed.

    What is this...amateur hour?
     
    #4 Jugs_McGhee, Jul 18, 2020
    duceswild, TrojanRB, BeastOfTheNortheast and 18 others like this.
  5. jvgoor3786

    jvgoor3786 Grand Pooh-Bah (4,222) May 28, 2015 Arkansas
    Society Pooh-Bah Trader

    Forced password changes are not necessarily an industry best practice. I believe NIST guidelines recommend against it. Just make us choose a strong password with 2FA.
     
    #5 jvgoor3786, Jul 18, 2020
    Last edited: Jul 18, 2020
    BeastOfTheNortheast, ScottDrinksCraft, ShireExfiguniter and 5 others like this.
  6. DIM

    DIM Grand Pooh-Bah (4,788) Sep 28, 2006 Pennsylvania
    BA4LYFE Society Pooh-Bah Trader

    Comic Book Guy from The Simpsons is only funny as a cartoon, that kind of snark doesn't work in real life. Be nice.
     
    #6 DIM, Jul 18, 2020
    JohnnyHopps, far333, Todd and 1 other person like this.
  7. LarryV

    LarryV Grand Pooh-Bah (5,408) Jun 13, 2001 Massachusetts
    BA4LYFE Society Pooh-Bah

    I totally agree, and for 2FA, why can't you just text us a code, I really don't want to download and install an app for that purpose. Amazon, Google, all the financial institutions I deal with just text the authorization code to my cell.
     
    #7 LarryV, Jul 18, 2020
    Shanex, Jaycase and jvgoor3786 like this.
  8. Todd

    Todd Founder (13,518) Aug 23, 1996 Finland
    STAFF Mod Team Society Pooh-Bah

    May have been some caching going on. Just tested multiple times. Working fine. More than happy to reset this for you or anyone else. Just DM me.
     
    #8 Todd, Jul 18, 2020
    meefmoff, sulldaddy and officerbill like this.
  9. MNAle

    MNAle Initiate (0) Sep 6, 2011 Minnesota

    re: forced password changes. Hopefully, it will be a bit more graceful than having to go through the "forgot password" rigamarole.
     
    #9 MNAle, Jul 18, 2020
    Todd likes this.
  10. Todd

    Todd Founder (13,518) Aug 23, 1996 Finland
    STAFF Mod Team Society Pooh-Bah

    As mentioned, we'll be looking at forcing updates based on various criteria. For example: that could be users who don't have 2FA activated. :wink:
     
    #10 Todd, Jul 18, 2020
    jvgoor3786 likes this.
  11. jvgoor3786

    jvgoor3786 Grand Pooh-Bah (4,222) May 28, 2015 Arkansas
    Society Pooh-Bah Trader

    Awesome. Can we get a text code option?
     
    #11 jvgoor3786, Jul 18, 2020
    Todd likes this.
  12. Todd

    Todd Founder (13,518) Aug 23, 1996 Finland
    STAFF Mod Team Society Pooh-Bah

    Yeah. It's a PITA, but the only other option was emailing everyone new passwords. Hard pass on that.
     
    #12 Todd, Jul 18, 2020
    CDBeerDisappear, Scrapss, ovaltine and 2 others like this.
  13. Todd

    Todd Founder (13,518) Aug 23, 1996 Finland
    STAFF Mod Team Society Pooh-Bah

    You can use an app, email confirmation, or backup codes. Visit the Two-Step Verification setting under your account to learn more.
     
    #13 Todd, Jul 18, 2020
    Scrapss, vurt and jvgoor3786 like this.
  14. officerbill

    officerbill Pooh-Bah (2,228) Feb 9, 2019 New York
    Pooh-Bah Trader

    I don't think most folks on BA want to go through the hassle of 2 factor logins at each visit. This is a beer forum, not a bank.
     
    #14 officerbill, Jul 18, 2020
    TrojanRB, CDBeerDisappear, skelliott and 13 others like this.
  15. MNAle

    MNAle Initiate (0) Sep 6, 2011 Minnesota

    Yeah. If I have to choose one or the other, I would choose periodic forced password change. I have a pretty slick method for dealing with that, since it was required by my former employer.
     
    #15 MNAle, Jul 18, 2020
    Bitterbill and officerbill like this.
  16. jvgoor3786

    jvgoor3786 Grand Pooh-Bah (4,222) May 28, 2015 Arkansas
    Society Pooh-Bah Trader

    It's only required when you log in. If you stay logged in on a specific device, you'll never have to deal with it. It prevents people from logging in from other devices. While I understand most people don't really care of someone hijacks a beer account, if you use the same password on any other account, the added protection is important. For example, if you use the same password for BA and your email, then if someone steals your BA info, they could use it to log into your email. I'm guessing your email is where all your password resets are sent.

    Sorry, I can rant about passwords a bit too much....
     
    #16 jvgoor3786, Jul 18, 2020
    Roguer, Thirst_trappist, officerbill and 7 others like this.
  17. ovaltine

    ovaltine Grand High Pooh-Bah (6,787) Apr 6, 2010 Indiana
    BA4LYFE Society Pooh-Bah Trader

    It took me about 48 seconds to update, and I'm a moron, so you made the right choice, IMHO. This was a minor, minor inconvenience.

    The heart attack I almost suffered when I couldn't access the WBAYDN thread for about an hour, OTOH, was a mind-bending inconvenience. I almost started to hypervenilate.

    [​IMG]
     
    #17 ovaltine, Jul 18, 2020
    TrojanRB, Roguer, ShireExfiguniter and 15 others like this.
  18. DEdesings57

    DEdesings57 Pooh-Bah (2,556) Aug 26, 2012 New Jersey
    Pooh-Bah Trader

    Wait what? We are being told about a breach that happened 8 years ago and to take protective measures against it today?!?!
     
    #18 DEdesings57, Jul 18, 2020
    duceswild, TrojanRB, StoutElk_92 and 1 other person like this.
  19. jarrettbrown

    jarrettbrown Initiate (0) Jan 14, 2013

    Done
     
    #19 jarrettbrown, Jul 18, 2020
    Todd likes this.
  20. CSO

    CSO Savant (1,134) Jan 31, 2014 Illinois
    Trader

    The email attached to my account is no longer valid. How do I go about resetting my password?
     
    #20 CSO, Jul 18, 2020
    BeastOfTheNortheast likes this.
Page 1 of 4
Thread Status:
Not open for further replies.