So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask. Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
the email address we have listed
or both?
-Mike
Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask.
May-be it escaped you, that a) you didn't send reminders (I received one weeks ago). b) your password change hit almost simultanously to other authentication changes.
Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
the email address we have listed
or both?
username@fedoraproject.org - It is supposed to work.
RAlf
On Mon, 9 Mar 2009, Ralf Corsepius wrote:
Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask.
May-be it escaped you, that a) you didn't send reminders (I received one weeks ago).
I sent multiple emails to everyone who needed to reset their password unless they had already done it.
-Mike
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask.
May-be it escaped you, that a) you didn't send reminders (I received one weeks ago).
I sent multiple emails to everyone who needed to reset their password unless they had already done it.
I only got one and promptly forgot about it in the pile of other work and other things I needed to do. (Yea I know I should have taken the 2 mins required to action it straight away).
Peter
Mike McGrath wrote:
On Mon, 9 Mar 2009, Ralf Corsepius wrote:
Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask.
May-be it escaped you, that a) you didn't send reminders (I received one weeks ago).
I sent multiple emails to everyone who needed to reset their password unless they had already done it.
I stay corrected.
Besides the one mentioned (dated Feb. 20th) I just found one dated Mar. 2th sitting in my Inbox, already having been marked "read".
Ralf
Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask. Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
This is fine for me.
I was one of those who did not reset my password - simply because I have not logged in in a while, and would rather reset the password next time I need it.
Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask. Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
the email address we have listed
or both?
-Mike
I got mine, so whichever you did worked for me.
Once upon a time, Mike McGrath mmcgrath@redhat.com said:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask.
Oh, I got two notifications (and they're still in my inbox); I just haven't had time to do anything with it (and I don't log in very often). You sent them to the right place for me, I'm just simultaneously busy and lazy (sorry!).
I got one, but was lazy and didn't get around to resetting it before the password expired.
Rich.
Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask. Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
the email address we have listed
or both?
Why don't we stop requiring these pointless password resets altogether? I can understand being asked to change the password if there was some leakage like the recent wiki log issue, but expiring the password just because it's old makes no sense whatsoever.
Kevin Kofler
Kevin Kofler kevin.kofler@chello.at writes:
Why don't we stop requiring these pointless password resets altogether?
+1 ... it's a demonstrated fact that forcing periodic password changes does not improve security. What it does do is force people to write down their passwords so they can remember what's current.
The only passwords I can remember are the ones that I *don't* change routinely. Guess what, all the rest (including my Fedora one) are written down.
regards, tom lane
On Mon, Mar 09, 2009 at 21:07:43 -0400, Tom Lane tgl@redhat.com wrote:
Kevin Kofler kevin.kofler@chello.at writes:
Why don't we stop requiring these pointless password resets altogether?
+1 ... it's a demonstrated fact that forcing periodic password changes does not improve security. What it does do is force people to write down their passwords so they can remember what's current.
That is going to depend on the threat model. Forcing password resets can secure accounts where the password has been compromised, but the user doesn't know it. In practice I am not sure how big of a problem that is. And changing it may only help temporarily if the method that compromised the original password is still available.
Writing passwords down may or may not be a big problem. Keeping them in say your wallet may not be a big risk. If your wallet gets stolen the person stealing it probably isn't interested in your passwords and you will have time to deal with the passwords. (For people with kids, a wallet may not be a safe place to store passwords.) Keeping them in something like password safe might also work pretty well. If the machine that you are using to keep the encrypted passwords on is compromised, then there is a good chance your passwords would have been snatched even if you were typing them from memory.
What may be a bigger threat here is someone forging messages from Mike with deceptive URLs that trick people into changing their passwords using a hostile proxy. Doing things in the current manner is training people to get fooled.
I don't remember if Mike signed the message, but I don't recall getting a pgp warning when I read it. (But it's been long enough that I might have forgotten.) (I checked the url and figured even if the message was bogus, changing my password at the real FAS site wouldn't hurt.)
On Tue, 2009-03-10 at 09:02 -0500, Bruno Wolff III wrote:
Keeping them in something like password safe might also work pretty well.
Yeah. As a bit of evangelism, password managers are *great*, it's a bit of mindset change to start using one, but now I couldn't live without it (I use revelation).
Just remember to keep a backup of the database file, because losing it can be a bit of an inconvenience :)
Another unfortunate side effect of that password expiration: mail to username@fedoraproject.org bounces for those people who haven't renewed their password in time. This is also a security risk because it means people can commit bad things to their packages without them noticing. (I just got such a bounce for the commit message for a rebuild for broken dependencies.)
Kevin Kofler
Kevin Kofler kevin.kofler@chello.at writes:
Another unfortunate side effect of that password expiration: mail to username@fedoraproject.org bounces for those people who haven't renewed their password in time. This is also a security risk because it means people can commit bad things to their packages without them noticing. (I just got such a bounce for the commit message for a rebuild for broken dependencies.)
Ick. Surely that's a flat-out bad idea, independently of what you think of forced password changes.
Mail should only be disabled for dead accounts, and an account that is the maintainer of record for a live package had better not be considered dead, even if its password is (temporarily?) expired.
regards, tom lane
Tom Lane wrote:
Kevin Kofler kevin.kofler@chello.at writes:
Another unfortunate side effect of that password expiration: mail to username@fedoraproject.org bounces for those people who haven't renewed their password in time. This is also a security risk because it means people can commit bad things to their packages without them noticing. (I just got such a bounce for the commit message for a rebuild for broken dependencies.)
Ick. Surely that's a flat-out bad idea, independently of what you think of forced password changes.
Mail should only be disabled for dead accounts, and an account that is the maintainer of record for a live package had better not be considered dead, even if its password is (temporarily?) expired.
So this one actually works both ways and we won't know unless the person reactivate their account which it is.
If the person is actually gone, this has found that out for us and we can orphan their packages and begin the process of finding new owners for them.
If the person is not actually gone then mail is bouncing as you say with all the problem you mention.
-Toshio
On Tue, 10 Mar 2009 02:26:07 +0100, Kevin wrote:
Another unfortunate side effect of that password expiration: mail to username@fedoraproject.org bounces for those people who haven't renewed their password in time. This is also a security risk because it means people can commit bad things to their packages without them noticing. (I just got such a bounce for the commit message for a rebuild for broken dependencies.)
Just for the record, two hours ago I got a delivery failure notification for 14 users expanded from the packager sponsors' group alias. IMO there is an additional problem [unless the accounts for all these well-known names have been disabled].
Michael Schwendt wrote:
On Tue, 10 Mar 2009 02:26:07 +0100, Kevin wrote:
Another unfortunate side effect of that password expiration: mail to username@fedoraproject.org bounces for those people who haven't renewed their password in time. This is also a security risk because it means people can commit bad things to their packages without them noticing. (I just got such a bounce for the commit message for a rebuild for broken dependencies.)
Just for the record, two hours ago I got a delivery failure notification for 14 users expanded from the packager sponsors' group alias. IMO there is an additional problem [unless the accounts for all these well-known names have been disabled].
The accounts have been disabled. That is why the email to them is bouncing. We aren't doing something right though... the group aliases shouldn't be picking up inactive accounts but they are.
-Toshio
On Tue, 10 Mar 2009 03:18:48 -0700, Toshio wrote:
Michael Schwendt wrote:
On Tue, 10 Mar 2009 02:26:07 +0100, Kevin wrote:
Another unfortunate side effect of that password expiration: mail to username@fedoraproject.org bounces for those people who haven't renewed their password in time. This is also a security risk because it means people can commit bad things to their packages without them noticing. (I just got such a bounce for the commit message for a rebuild for broken dependencies.)
Just for the record, two hours ago I got a delivery failure notification for 14 users expanded from the packager sponsors' group alias. IMO there is an additional problem [unless the accounts for all these well-known names have been disabled].
The accounts have been disabled. That is why the email to them is bouncing. We aren't doing something right though... the group aliases shouldn't be picking up inactive accounts but they are.
This is unbelievable. We're talking about 14 sponsors with disabled accounts. Just based on their names I could call them "Fedora celebrities". Something has gone wrong here.
These people currently don't receive cvs commit notifications either?
On 03/10/2009 03:50 AM, Michael Schwendt wrote:
Something has gone wrong here.
Yes, something has gone wrong. They didn't get the email and refresh their account on time. I saw the email but forgot about it, and the only thing that reminded me to do something was when I could no longer log in.
On Mon, Mar 9, 2009 at 7:01 AM, Mike McGrath mmcgrath@redhat.com wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask. Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
the email address we have listed
or both?
-Mike
Mike, I did receive the requests, however I missed them because of all my bugzilla and mailing list email (I now filter mail from you with password so I will not miss it). Is there a better way to do this then just email? One thought I did have was could we have zodbot message people in IRC when they login to one of the channels is occupies if the password is up for reset? I know some people dont use IRC, but I think it could help the vast majority. Also if the idea is to detect dead accounts, can we just reset the expiration counter if they login to fedorapeople fedorahosted cvs or wiki?
--Brennan Ashton
Brennan Ashton wrote:
Also if the idea is to detect dead accounts, can we just reset the expiration counter if they login to fedorapeople fedorahosted cvs or wiki?
It's interesting that you mention those specific services because of those, only the wiki is easy to tie into such a counter. The web services that we've created or had a hand in creating an auth plugin for (account system, PackageDB, elections app, bodhi, mirrormanager, transifex, wiki) are all talking to the account system directly so we could be capturing that the user has logged in from these.
-Toshio
Hi!
On 09.03.2009 16:01, Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask.
Maybe part of the problem is: Inactive maintainers that stopped contributing to Fedora and thus ignored your mail? It's been a while since we were hunting for them to clean up FAS afaics. Maybe it's time to do it again to make sure that only those that need access to CVS actually have it (there are even sponsors that are inactive / moved on to other things in life).
CU knurd
On 10.03.2009 09:43, Thorsten Leemhuis wrote:
Hi!
On 09.03.2009 16:01, Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask.
Maybe part of the problem is: Inactive maintainers that stopped contributing to Fedora and thus ignored your mail? It's been a while since we were hunting for them to clean up FAS afaics. Maybe it's time to do it again to make sure that only those that need access to CVS actually have it (there are even sponsors that are inactive / moved on to other things in life).
Ohh, I missed that the FAS accounts for inactive people got disabled (thx kevin for letting me know). Are the inactive accounts removed sooner or later completely (or flagged as "inactive" or something like that)?
CU knurd
Thorsten Leemhuis wrote:
Ohh, I missed that the FAS accounts for inactive people got disabled (thx kevin for letting me know). Are the inactive accounts removed sooner or later completely (or flagged as "inactive" or something like that)?
FAS has the ability to flag the account as inactive. Login to your account and you can see that yours is listed as active.
Rahul
On Mon, 9 Mar 2009 10:01:19 -0500 (CDT), Mike wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask. Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
the email address we have listed
or both?
Both.
Just a few minutes ago, the aliases broke into many pieces when replying to the packager-sponsors alias. I got a delivery failure notification with a dozen "unknown user:" errors for the aliases.
On Mon, Mar 09, 2009 at 10:01:19AM -0500, Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm
Why is there a password reset? I'd prefer not to reset mine, it is a good password and I don't want to have too much passwords to remember, and also -- even if it is not much work to reset the password -- it is still uneeded work.
-- Pat
On 03/10/2009 03:04 AM, Patrice Dumas wrote:
Why is there a password reset? I'd prefer not to reset mine, it is a good password and I don't want to have too much passwords to remember, and also -- even if it is not much work to reset the password -- it is still uneeded work.
I do believe you can reset it to the same password you had. This is just the best way Infra has today to discover all the active and inactive accounts.
On Tue, Mar 10, 2009 at 09:56:51AM -0700, Jesse Keating wrote:
On 03/10/2009 03:04 AM, Patrice Dumas wrote:
Why is there a password reset? I'd prefer not to reset mine, it is a good password and I don't want to have too much passwords to remember, and also -- even if it is not much work to reset the password -- it is still uneeded work.
I do believe you can reset it to the same password you had. This is just the best way Infra has today to discover all the active and inactive accounts.
That's what I ended up doing. But maybe, in that case, it would be relevant to have another possiblity to ping, something like a simple button, and also maybe this should only be done for people who didn't login for a while in FAS.
Otherwise said, mixing password reset and activity check doesn't seem to be very wise to me. What is done is done, but maybe things could be handled better in the future?
-- Pat
On 03/10/2009 10:08 AM, Patrice Dumas wrote:
Otherwise said, mixing password reset and activity check doesn't seem to be very wise to me. What is done is done, but maybe things could be handled better in the future?
You're welcome to join the infrastructure group and give a hand planning/executing such things.
On Tue, Mar 10, 2009 at 10:14:31AM -0700, Jesse Keating wrote:
On 03/10/2009 10:08 AM, Patrice Dumas wrote:
Otherwise said, mixing password reset and activity check doesn't seem to be very wise to me. What is done is done, but maybe things could be handled better in the future?
You're welcome to join the infrastructure group and give a hand planning/executing such things.
I have left Fedora, so it is not gonna happen, but even if I had still been in Fedora things wouldn't have been different, I just made my comments at the time I was hit by the issue. I am reacting like a user wanting to have a service improved.
Now if nobody has time to do better or people disagree, I don't really care, since I don't put work where my mouth is.
-- Pat
Patrice Dumas wrote:
On Tue, Mar 10, 2009 at 09:56:51AM -0700, Jesse Keating wrote:
On 03/10/2009 03:04 AM, Patrice Dumas wrote:
Why is there a password reset? I'd prefer not to reset mine, it is a good password and I don't want to have too much passwords to remember, and also -- even if it is not much work to reset the password -- it is still uneeded work.
I do believe you can reset it to the same password you had. This is just the best way Infra has today to discover all the active and inactive accounts.
That's what I ended up doing. But maybe, in that case, it would be relevant to have another possiblity to ping, something like a simple button, and also maybe this should only be done for people who didn't login for a while in FAS.
Otherwise said, mixing password reset and activity check doesn't seem to be very wise to me. What is done is done, but maybe things could be handled better in the future?
https://fedorahosted.org/fedora-infrastructure/ticket/1237
Despite the name on this ticket, the discussion there is becoming what we can do instead of requiring password resets to determine activity.
I'm not sure if the final conclusion of infrastructure will be to do no password resets, but this can address the inactivity portion of the equation.
-Toshio
On Mo März 9 2009, Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask. Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
the email address we have listed
or both?
Please send it only once, I do not care to which address. But here are some suggestions for improvement:
1) Please use a consistent subject for these mails:
February: Fedora Project Password Reset Request December(1): FAS Password Change Request December(2): FAS Password
2) The mail from 2009-02-09 only said, that the password will expire. It was not mentioned that also further action will occur, e.g. afaik the contents of fedorapeople.org where moved. E.g. I only changed my password because I had to submit a security update, but otherwise I would not have cared for an expired password, because of little available time for Fedora work right now. Nevertheless I would have cared about moved fedorapeople.org contents or missing CVS notifications.
3) A two week deadline is imho too short. It may be especially bad if the fedorapeople.org contents are really moved and someone who is on vacation hosts a shared SCM there or other contents of wide interest.
Regards, Till
2009/3/10 Till Maas opensource@till.name
On Mo März 9 2009, Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask. Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
the email address we have listed
or both?
Please send it only once, I do not care to which address. But here are some suggestions for improvement:
- Please use a consistent subject for these mails:
February: Fedora Project Password Reset Request December(1): FAS Password Change Request December(2): FAS Password
- The mail from 2009-02-09 only said, that the password will expire. It
was not mentioned that also further action will occur, e.g. afaik the contents of fedorapeople.org where moved. E.g. I only changed my password because I had to submit a security update, but otherwise I would not have cared for an expired password, because of little available time for Fedora work right now. Nevertheless I would have cared about moved fedorapeople.org contents or missing CVS notifications.
- A two week deadline is imho too short. It may be especially bad if the
fedorapeople.org contents are really moved and someone who is on vacation hosts a shared SCM there or other contents of wide interest.
Regards, Till
-- fedora-devel-list mailing list fedora-devel-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-devel-list
For me, all mail with the words "password change" or "password reset" in any combination is automatically sent to a special spam folder because I literally get hundreds of those kinds of emails a week. It got so annoying that I set up a filter to block it and send it out. The only reason I found out now was because this was my monthly pruning through the spam mail day.
In the future, it would be better to set it up in the interface that when a person logs in with an expired password, it tells you that the aforementioned password is expired and goes to a reset prompt.
On Tue, 2009-03-10 at 22:41 +0100, Till Maas wrote:
On Mo März 9 2009, Mike McGrath wrote:
So the password reset generally went off without a hitch but a lot of people forgot to reset their password or just plain didn't and I'm wondering if it's because of where I sent the notifications to so I thought I'd ask. Would you generally like password reset requests to go to:
username@fedoraproject.org (the alias that directs to your email addr)
the email address we have listed
or both?
Please send it only once, I do not care to which address. But here are some suggestions for improvement:
- Please use a consistent subject for these mails:
February: Fedora Project Password Reset Request December(1): FAS Password Change Request December(2): FAS Password
- The mail from 2009-02-09 only said, that the password will expire. It was
not mentioned that also further action will occur, e.g. afaik the contents of fedorapeople.org where moved. E.g. I only changed my password because I had to submit a security update, but otherwise I would not have cared for an expired password, because of little available time for Fedora work right now. Nevertheless I would have cared about moved fedorapeople.org contents or missing CVS notifications.
Yeah this was the point that was missed, missing a password reset should *not* remove web content and email addresses, this is called overkill, a staged removal, where you reset the password, wait 2-3 months and then start culling the crap.
Its also arguable whether web content should ever be killed, when I started in RH people were very quick to give out about people.redhat.com, and saying use people.fedoraproject.org we don't have any of the silly limitations and a/c expiring stuff. Guess they were wrong.
Dave.
On Tue, 10 Mar 2009, Till Maas wrote:
- A two week deadline is imho too short. It may be especially bad if the
fedorapeople.org contents are really moved and someone who is on vacation hosts a shared SCM there or other contents of wide interest.
Is 4 weeks enough with 5 total emails? 4 week warning, 3 week, 2 week, 1 week, you've been disabled?
-Mike
On Tue, 2009-03-10 at 22:17 -0500, Mike McGrath wrote:
On Tue, 10 Mar 2009, Till Maas wrote:
- A two week deadline is imho too short. It may be especially bad if the
fedorapeople.org contents are really moved and someone who is on vacation hosts a shared SCM there or other contents of wide interest.
Is 4 weeks enough with 5 total emails? 4 week warning, 3 week, 2 week, 1 week, you've been disabled?
I think a month is reasonable. A week is easy to miss, two weeks is a week plus someone getting back from vacation and missing emails while they were gone, then drowning as they try to catch up.
Jon.
Jon Masters jcm@redhat.com writes:
On Tue, 2009-03-10 at 22:17 -0500, Mike McGrath wrote:
Is 4 weeks enough with 5 total emails? 4 week warning, 3 week, 2 week, 1 week, you've been disabled?
I think a month is reasonable. A week is easy to miss, two weeks is a week plus someone getting back from vacation and missing emails while they were gone, then drowning as they try to catch up.
Month-long summer vacation is, or at least used to be, common in Europe. And what of situations that are even a bit unusual, like someone getting hurt and being in hospital for a month or two?
I don't have much of a problem with a short fuse on an easily reversible action, like disabling your Fedora password and requiring you to reset it. Blocking email or removing web content should only be done after a significant period of time --- multiple months --- has elapsed without signs of life.
regards, tom lane
On Wed, 11 Mar 2009, Tom Lane wrote:
Jon Masters jcm@redhat.com writes:
On Tue, 2009-03-10 at 22:17 -0500, Mike McGrath wrote:
Is 4 weeks enough with 5 total emails? 4 week warning, 3 week, 2 week, 1 week, you've been disabled?
I think a month is reasonable. A week is easy to miss, two weeks is a week plus someone getting back from vacation and missing emails while they were gone, then drowning as they try to catch up.
Month-long summer vacation is, or at least used to be, common in Europe. And what of situations that are even a bit unusual, like someone getting hurt and being in hospital for a month or two?
Two months of notice means you'll be asked to reset your password every 4 months if you stay on top of things. Is that acceptable?
-Mike
On Wed, 11 Mar 2009, Mike McGrath wrote:
On Wed, 11 Mar 2009, Tom Lane wrote:
Jon Masters jcm@redhat.com writes:
On Tue, 2009-03-10 at 22:17 -0500, Mike McGrath wrote:
Is 4 weeks enough with 5 total emails? 4 week warning, 3 week, 2 week, 1 week, you've been disabled?
I think a month is reasonable. A week is easy to miss, two weeks is a week plus someone getting back from vacation and missing emails while they were gone, then drowning as they try to catch up.
Month-long summer vacation is, or at least used to be, common in Europe. And what of situations that are even a bit unusual, like someone getting hurt and being in hospital for a month or two?
Two months of notice means you'll be asked to reset your password every 4 months if you stay on top of things. Is that acceptable?
Actually if we push password resets back to 8 months with a 2 month leway, that's still no more then notifications every 6 months.
-Mike
On Wed, 11 Mar 2009, Mike McGrath wrote:
On Wed, 11 Mar 2009, Mike McGrath wrote:
On Wed, 11 Mar 2009, Tom Lane wrote:
Jon Masters jcm@redhat.com writes:
On Tue, 2009-03-10 at 22:17 -0500, Mike McGrath wrote:
Is 4 weeks enough with 5 total emails? 4 week warning, 3 week, 2 week, 1 week, you've been disabled?
I think a month is reasonable. A week is easy to miss, two weeks is a week plus someone getting back from vacation and missing emails while they were gone, then drowning as they try to catch up.
Month-long summer vacation is, or at least used to be, common in Europe. And what of situations that are even a bit unusual, like someone getting hurt and being in hospital for a month or two?
Two months of notice means you'll be asked to reset your password every 4 months if you stay on top of things. Is that acceptable?
Actually if we push password resets back to 8 months with a 2 month leway, that's still no more then notifications every 6 months.
+1 to this.
changes every 8months with a 2month notice sounds good.
-sv
On Wed, Mar 11, 2009 at 9:19 AM, Mike McGrath mmcgrath@redhat.com wrote:
Two months of notice means you'll be asked to reset your password every 4 months if you stay on top of things. Is that acceptable?
If the actual goal of the reset is to close off inactive accounts, we are restarting the 4 month timer when e.g. doing CVS commits hopefully?
On Wed, 11 Mar 2009, Colin Walters wrote:
On Wed, Mar 11, 2009 at 9:19 AM, Mike McGrath mmcgrath@redhat.com wrote:
Two months of notice means you'll be asked to reset your password every 4 months if you stay on top of things. Is that acceptable?
If the actual goal of the reset is to close off inactive accounts, we are restarting the 4 month timer when e.g. doing CVS commits hopefully?
We've talked about that type of thing. It's more of a "wouldn't it be nice". The problem is we've got thousands of contributors, relatively few of them actually commit to cvs. So we could go around to figure out how to make all of our various auth points report back but that's a lot of work. The account system is the only common point of entry for every contributor.
-Mike
On 03/11/2009 07:05 AM, Mike McGrath wrote:
On Wed, 11 Mar 2009, Colin Walters wrote:
If the actual goal of the reset is to close off inactive accounts, we are restarting the 4 month timer when e.g. doing CVS commits hopefully?
We've talked about that type of thing. It's more of a "wouldn't it be nice". The problem is we've got thousands of contributors, relatively few of them actually commit to cvs. So we could go around to figure out how to make all of our various auth points report back but that's a lot of work. The account system is the only common point of entry for every contributor.
So let's require to them to simply _log in_ to FAS to reset the timer (you need to do that to change passwords, anyway!).
Then, if other groups want to implement the timer reset for CVS commits, wiki edits, openID usage, etc. they can, and nobody needs to worry because there is a way for everyone to reset the timer. Just some groups may have more.
On Wed, 2009-03-11 at 11:54 -0700, Christopher Aillon wrote:
On 03/11/2009 07:05 AM, Mike McGrath wrote:
On Wed, 11 Mar 2009, Colin Walters wrote:
If the actual goal of the reset is to close off inactive accounts, we are restarting the 4 month timer when e.g. doing CVS commits hopefully?
We've talked about that type of thing. It's more of a "wouldn't it be nice". The problem is we've got thousands of contributors, relatively few of them actually commit to cvs. So we could go around to figure out how to make all of our various auth points report back but that's a lot of work. The account system is the only common point of entry for every contributor.
So let's require to them to simply _log in_ to FAS to reset the timer (you need to do that to change passwords, anyway!).
Then, if other groups want to implement the timer reset for CVS commits, wiki edits, openID usage, etc. they can, and nobody needs to worry because there is a way for everyone to reset the timer. Just some groups may have more.
That sounds like the most sensible thing I've read in this thread so far. If the requirement is 'figure out who's active', the sensible condition seems to be 'who's logged in interactively lately', not 'who can be bothered to change their password in response to an email request'.
This way has two other considerable advantages - it's transparent for many people (since you have to log in for one reason or another anyway) and you could just send the email to people who would be on the 'inactive list' as currently calculated, and not bother anyone else about it.
On Wed, Mar 11, 2009 at 02:56:05PM -0700, Adam Williamson wrote:
That sounds like the most sensible thing I've read in this thread so far. If the requirement is 'figure out who's active', the sensible condition seems to be 'who's logged in interactively lately', not 'who can be bothered to change their password in response to an email request'.
This way has two other considerable advantages - it's transparent for many people (since you have to log in for one reason or another anyway) and you could just send the email to people who would be on the 'inactive list' as currently calculated, and not bother anyone else about it.
It is what Toshio more or less proposes in https://fedorahosted.org/fedora-infrastructure/ticket/1237#comment:3
-- Pat