Migrating to FTH4

Your club admin received the instructions to update their admin password to access FTH4. (FTH3 admin passwords will NOT work in FTH4). Follow the instructions in the email and use 'Member sign in' in the top right corner to access the Club Admin account.

If you are not sure who the club admin is, in your member account; look at 'Club Officers and Members' > "Club Email addresses". The LAST item in this list is the person who is currently listed as your club admin.

If this is not correct, please complete and submit this form to change your club admin:
www.toastmastersclubs.org/welcome/change-admin/

Do not show pop-up with users on the login screen

  • tm123
  • tm123's Avatar Topic Author
  • Offline
  • New Member
  • New Member
  • Posts: 5
  • Thanks: 0

Do not show pop-up with users on the login screen

1 year 10 months ago
#93987
When loggin in there is this functionality that shows member names after typing first 4 characters:Enter your E-mail, Name, or Username, then select your Name or Username from the pop-up list that displays.
I don't think it's a good idea - it's leaking the names of all the members, even if they choose not to make their name public.
I didn't find anything in the settings to disable this behaviour.
I would suggest to remove it completely.
The topic has been locked.
  • NotLiable
  • NotLiable's Avatar
  • Offline
  • FreeToastHost Ambassador
  • FreeToastHost Ambassador
  • Posts: 308
  • Thanks: 50

Re: Do not show pop-up with users on the login screen

1 year 10 months ago
#93992
The pop-up list that displays is an auto-complete feature in the underlying code.  While yes, it does show names of members who have chosen not to make their profile public (which only shows name and member/officer status as a minimum), I don't see where this is terribly problematic.  Are those members, for whatever reason, totally reluctant to even admit that they are club members?
Yes, you are correct, that there is presently no disable setting, but again, I fail to see how this make-it-faster-and-easier-for-me-to-log-in feature is so troubling.
 
Arthur Farnsworth, DTM, PM4
We The Speakers, 9376
In-Person Toastmasters, 3474192
The topic has been locked.
  • tm123
  • tm123's Avatar Topic Author
  • Offline
  • New Member
  • New Member
  • Posts: 5
  • Thanks: 0

Re: Do not show pop-up with users on the login screen

1 year 10 months ago
#93996
To make it simple - it is not about user's preference - it is a security risk. It allows potential attacker to gather valid user names and then use another attack (ie password staffing) to break into that account.
Do not just believe me - have a look at "Account Enumeration" vulnerability, for example:
owasp.org/www-project-web-security-testi...essable_User_Account
www.virtuesecurity.com/kb/username-enumeration/

Please consider removing it from the code completely.
The topic has been locked.
  • Brian
  • Brian's Avatar
  • Offline
  • Administrator
  • Administrator
  • Posts: 13912
  • Thanks: 4140

Re: Do not show pop-up with users on the login screen

1 year 10 months ago - 1 year 10 months ago
#93998
Your issue has already been addressed. Those who do not want their name exposed can use the Username option.

 
Thank you,

Brian McDonald DTM
Silver and Wiser Online Toastmasters Club #777940

Technical Support Consultant and Developer for FreeToastHost
Last edit: 1 year 10 months ago by Heni.
The following user(s) said Thank You: Heni
The topic has been locked.
Moderators: Brian, Heni, Pam, RichardT, NotLiable, NSB, jgavin, Lcala305, peterb323, DebbieT
Time to create page: 0.150 seconds

Latest Forum Posts