Hi,
I do not know if this is the correct place to place this question, please feel free to redirect me to the right place.
I have one account at fedora project 'lmello' this account is assigned with my old employer email (lmello AT redhat.com), since i no longer work at redhat i am unable to change my password and associate my account with my new email address.
Could some one change my lmello account email address from lmello AT redhat.com to l at lmello.eu.org ? I had created a new account associated with my new email address called lmello2, feel free to remove it if necessary.
Best.
On Mon, May 28, 2012 at 5:54 PM, Leonardo Rodrigues de Mello l@lmello.eu.org wrote:
Hi,
I do not know if this is the correct place to place this question, please feel free to redirect me to the right place.
Hello
Of course you are on the right place. However if you can remember the password you can login and change the email address, but if you dont remember the password that would be a problem, I suppose.
You will get a solution on this soon. Hold-on !!
On Mon, 28 May 2012 09:24:02 -0300 Leonardo Rodrigues de Mello l@lmello.eu.org wrote:
Hi,
I do not know if this is the correct place to place this question, please feel free to redirect me to the right place.
Sure, here or 'accounts@fedoraproject.org'.
I have one account at fedora project 'lmello' this account is assigned with my old employer email (lmello AT redhat.com), since i no longer work at redhat i am unable to change my password and associate my account with my new email address.
Do you have a gpg key associated with the account? It seems not. ;(
Could some one change my lmello account email address from lmello AT redhat.com to l at lmello.eu.org ? I had created a new account associated with my new email address called lmello2, feel free to remove it if necessary.
I'm afraid we can't do that. I'd suggest just creating a new account as you have and just rejoin the groups you were in.
We don't really have any way to tell you are who registered the account sadly.
Sorry,
kevin
Le lundi 28 mai 2012 à 13:40 -0600, Kevin Fenzi a écrit :
On Mon, 28 May 2012 09:24:02 -0300 Leonardo Rodrigues de Mello l@lmello.eu.org wrote:
Could some one change my lmello account email address from lmello AT redhat.com to l at lmello.eu.org ? I had created a new account associated with my new email address called lmello2, feel free to remove it if necessary.
I'm afraid we can't do that. I'd suggest just creating a new account as you have and just rejoin the groups you were in.
We don't really have any way to tell you are who registered the account sadly.
What happen if the email was redirected to a manager ? If someone from HR for the previous company can confirm the identity, would it be sufficient ?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
On 05/28/2012 03:25 PM, Michael Scherer wrote:
What happen if the email was redirected to a manager ? If someone from HR for the previous company can confirm the identity, would it be sufficient ?
The problem with that could be, how do they verify the person without meeting them in person?
- --
Larry Brower, CCNA
Fedora Ambassador - North America Fedora Quality Assurance lbrower@fedoraproject.org http://www.fedoraproject.org/
On 28/05/12 23:17, Larry Brower wrote:
On 05/28/2012 03:25 PM, Michael Scherer wrote:
What happen if the email was redirected to a manager ? If someone from HR for the previous company can confirm the identity, would it be sufficient ?
The problem with that could be, how do they verify the person without meeting them in person?
He worked for Red Hat, not some weird and wonderful company that is "that" external.
Leonardo,
how about if you contact your supervisor/manager/HR person who knows you ? The they could email Kevin the change of email addy ?
Just an idea. If you get two people from Red Hat to verify, I do not see how that would be a problem.
Regards,
Tristan
infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
If they don't remember their password to log into their account and their email address is no longer valid, they should do what the rest of us do and create another account.
Chris On May 28, 2012 6:17 PM, "Larry Brower" larry@maxqe.com wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
On 05/28/2012 03:25 PM, Michael Scherer wrote:
What happen if the email was redirected to a manager ? If someone from HR for the previous company can confirm the identity, would it be sufficient ?
The problem with that could be, how do they verify the person without meeting them in person?
Larry Brower, CCNA
Fedora Ambassador - North America Fedora Quality Assurance lbrower@fedoraproject.org http://www.fedoraproject.org/ -----BEGIN PGP SIGNATURE-----
iQIcBAEBCgAGBQJPw/ltAAoJEF1Xw4ZWTEoJMn0QAIze03SsBPkG0M2jOP8hM7FL ZqrsvwIL9wFXCQSu1zeKqABgw5Ieu6KADSs25pqIylpM60SjINNgl0i6lUi3icf4 vLSm3TRytXAxLrgUyEwG+P5B5kxVMBqzR600Y7Xa8DxlhWhihFQ/Iojqi8VpaV7h 9L16z1i4fEOYBzIUO+rMljs5WnLr5G1vyTuwcJEk4ZN8p+38AQudM9FeaRFSrRg7 /qy+46ts0LLrwRCDAUFlVaW3C0KeEWoPQ7NbIVci+q7YHdHqG1uLSjUuAjw3NeEI j6+LByZUuvNvlGZ/NBW++JqywWPbvmISeCBFm5I58Qz39gbZvqWFC6yXmleGzOY5 nmssbu6uWfQo51nM499tm+CSglP4n3fKeClJkrLg4GUIYtR925iBsj1XUXjxzJ7S 4fRae030o1p7WonNMNyLfuCo82+zR9PRb5yHYgqYKHp3DN6XJbLHir4bju7mc3c5 trj4UFtUozDz8rCd0q2hCAKEJ8BSDhDL9YOdeSUm0NipZJD87qYJOHvzvyXoJj+K Z6CWcQ1FgZwi2NsD3SgN0iFMERLeS7Sc/dyXzKmQwhk0a38K+fZAukR2bbEuPIZ9 CH6x94cPm0eKsOjuSyPORTv+0I+u8DVy3FlXGTauSMAZ3jquIqJcWnOfffeCqAsS acc6jsb0IJoxV63lWuvv =4I+w -----END PGP SIGNATURE----- _______________________________________________ infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
On 05/28/2012 05:24 PM, Chris Dix wrote:
If they don't remember their password to log into their account and their email address is no longer valid, they should do what the rest of us do and create another account.
Chris
I would agree that this is the best option. Perhaps we should research adding a "password / login recovery " feature.
- --
Larry Brower, CCNA
Fedora Ambassador - North America Fedora Quality Assurance lbrower@fedoraproject.org http://www.fedoraproject.org/
On Mon, May 28, 2012 at 6:26 PM, Larry Brower larry@maxqe.com wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
On 05/28/2012 05:24 PM, Chris Dix wrote:
If they don't remember their password to log into their account and their email address is no longer valid, they should do what the rest of us do and create another account.
Chris
I would agree that this is the best option. Perhaps we should research adding a "password / login recovery " feature.
There is such a feature already. It does require access to email though.
If he has contacts that still control access to the email - surely he could use the 'forgotten password' functionality and have individuals in control of said email forward it along.
--David
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
On 05/28/2012 05:32 PM, David Nalley wrote:
There is such a feature already. It does require access to email though.
If he has contacts that still control access to the email - surely he could use the 'forgotten password' functionality and have individuals in control of said email forward it along.
--David
Couldn't we expand on this feature to allow somethign like answering "account security questions" similar to how banks and other organizations do ?
While this would require more work to implement, it would reduce support overhead when people lose access to email and forget their password as well as lower the number of extra accounts in the FAS which are not in use. Less clutter is always a good thing :)
- --
Larry Brower, CCNA
Fedora Ambassador - North America Fedora Quality Assurance lbrower@fedoraproject.org http://www.fedoraproject.org/
On Mon, 28 May 2012, Larry Brower wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
On 05/28/2012 05:32 PM, David Nalley wrote:
There is such a feature already. It does require access to email though.
If he has contacts that still control access to the email - surely he could use the 'forgotten password' functionality and have individuals in control of said email forward it along.
--David
Couldn't we expand on this feature to allow somethign like answering "account security questions" similar to how banks and other organizations do ?
If you're offering a patch to do this I am certain that we could. However, implementing such a feature requires developer time that is not immediately available, otherwise.
I don't mean this dismissively - if you're interested in working on it - then yes - absolutely, please.
-sv
On Tue, May 29, 2012 at 4:15 AM, Larry Brower larry@maxqe.com wrote:
Couldn't we expand on this feature to allow somethign like answering "account security questions" similar to how banks and other organizations do ?
I m not that sure that the security question is secure enough since we are using a lengthy-strong password. (I doudt whether anyone can bare mind the answer for the security question if he/she tend to loose their password) One idea from me is using the web of trust as we are almost using it. How about endorsing around 3-5 fedora contributors about the request personally so that infra can make the change internally.
For an example if I lost my access then I can ask my local contributors to speak for me and show the trust and endorse my request. So that the infra team can set it internally.
Investing much time on this is not required as we are not having such cases all the time but very few.
Just an idea to consider.
On Sat, 2 Jun 2012 01:02:10 +0530 Buddhike Kurera bckurera@fedoraproject.org wrote:
On Tue, May 29, 2012 at 4:15 AM, Larry Brower larry@maxqe.com wrote:
Couldn't we expand on this feature to allow somethign like answering "account security questions" similar to how banks and other organizations do ?
I m not that sure that the security question is secure enough since we are using a lengthy-strong password. (I doudt whether anyone can bare mind the answer for the security question if he/she tend to loose their password) One idea from me is using the web of trust as we are almost using it. How about endorsing around 3-5 fedora contributors about the request personally so that infra can make the change internally.
Sure, but many people are in places where they don't personally have 3-5 other Fedora folks around to meet with them and vouch for them.
For an example if I lost my access then I can ask my local contributors to speak for me and show the trust and endorse my request. So that the infra team can set it internally.
Investing much time on this is not required as we are not having such cases all the time but very few.
yeah, it doesn't come up all that often really...
kevin
Probably what we need is an alternative email feature to allow recover password if you have not access to your main email and it to the recover password option
my two cents.
On Mon, 2012-05-28 at 18:32 -0400, David Nalley wrote:
On Mon, May 28, 2012 at 6:26 PM, Larry Brower larry@maxqe.com wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
On 05/28/2012 05:24 PM, Chris Dix wrote:
If they don't remember their password to log into their account and their email address is no longer valid, they should do what the rest of us do and create another account.
Chris
I would agree that this is the best option. Perhaps we should research adding a "password / login recovery " feature.
There is such a feature already. It does require access to email though.
If he has contacts that still control access to the email - surely he could use the 'forgotten password' functionality and have individuals in control of said email forward it along.
--David _______________________________________________ infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
either 'account security questions' or sending a validation code as SMS to a mobile are the options. implementing 'account security questions' is much cheaper as SMS solution cost small amount for each SMS
On Tue, May 29, 2012 at 6:01 AM, Alejandro Pérez < alejandro.perez.torres@gmail.com> wrote:
Probably what we need is an alternative email feature to allow recover password if you have not access to your main email and it to the recover password option
my two cents.
On Mon, 2012-05-28 at 18:32 -0400, David Nalley wrote:
On Mon, May 28, 2012 at 6:26 PM, Larry Brower larry@maxqe.com wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
On 05/28/2012 05:24 PM, Chris Dix wrote:
If they don't remember their password to log into their account and their email address is no longer valid, they should do what the rest
of
us do and create another account.
Chris
I would agree that this is the best option. Perhaps we should research adding a "password / login recovery " feature.
There is such a feature already. It does require access to email though.
If he has contacts that still control access to the email - surely he could use the 'forgotten password' functionality and have individuals in control of said email forward it along.
--David _______________________________________________ infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
I think adding a 'security question(s)' feature would be great.
I would strongly suggest however that the questions and answers be free form. There's little security in canned security questions that have answers people can find out. ie, 'What was your high school?'
Anyhow, sounds like a nice feature for someone to work on. ;)
kevin
Kevin Fenzi <kevin@...> writes:
I think adding a 'security question(s)' feature would be great.
I would strongly suggest however that the questions and answers be free form. There's little security in canned security questions that have answers people can find out. ie, 'What was your high school?'
I just use a password manager and if a site forces me to answer "security" questions, I put them in the Notes section using strong random passwords for the answers. For example
What was your high school? 48ZGrNaDQR75
I think the security questions should be optional in any case to save the trouble of having to make and store several strong random passwords rather than just one.
On 5/29/2012 11:45 PM, Andre Robatino wrote:
Kevin Fenzi <kevin@...> writes:
I think adding a 'security question(s)' feature would be great.
I would strongly suggest however that the questions and answers be free form. There's little security in canned security questions that have answers people can find out. ie, 'What was your high school?'
I just use a password manager and if a site forces me to answer "security" questions, I put them in the Notes section using strong random passwords for the answers. For example
What was your high school? 48ZGrNaDQR75
I think the security questions should be optional in any case to save the trouble of having to make and store several strong random passwords rather than just one.
Or maybe have primary (company?) email and private email registered.
Instead of re-inventing a whole new chunk of code by introducing a security question and all, simple allow 2 emails to be valid at any given time.
Fabio
On Wed, May 30, 2012 at 9:41 AM, Fabio M. Di Nitto fdinitto@redhat.com wrote:
On 5/29/2012 11:45 PM, Andre Robatino wrote:
Kevin Fenzi <kevin@...> writes:
I think adding a 'security question(s)' feature would be great.
I would strongly suggest however that the questions and answers be free form. There's little security in canned security questions that have answers people can find out. ie, 'What was your high school?'
I just use a password manager and if a site forces me to answer "security" questions, I put them in the Notes section using strong random passwords for the answers. For example
What was your high school? 48ZGrNaDQR75
I think the security questions should be optional in any case to save the trouble of having to make and store several strong random passwords rather than just one.
Or maybe have primary (company?) email and private email registered.
Instead of re-inventing a whole new chunk of code by introducing a security question and all, simple allow 2 emails to be valid at any given time.
Another possibility would be to let 2 people from an "important" group guarantee, that the person requesting access to an account is the proper one. e.g. when you know 2 ambassadors/packager/translator/whatever in person or somewhere else, you can be sure, it's the same one, I don't see a reason to get him/her access to the account again. This is kind of similar to verifying the GPG key given in the account.
(hint: "Important" group above means non-cla and non-fedorahosted-git* group for me.)
Greetings, Tom
Fabio,
If you implement a password recovery feature, that would email the new password to the user. That does no good if they don't have access to their email account.
We probably do want an alternate email that can be used for these situations.
Chris On May 30, 2012 3:41 AM, "Fabio M. Di Nitto" fdinitto@redhat.com wrote:
On 5/29/2012 11:45 PM, Andre Robatino wrote:
Kevin Fenzi <kevin@...> writes:
I think adding a 'security question(s)' feature would be great.
I would strongly suggest however that the questions and answers be free form. There's little security in canned security questions that have answers people can find out. ie, 'What was your high school?'
I just use a password manager and if a site forces me to answer
"security"
questions, I put them in the Notes section using strong random passwords
for the
answers. For example
What was your high school? 48ZGrNaDQR75
I think the security questions should be optional in any case to save the trouble of having to make and store several strong random passwords
rather than
just one.
Or maybe have primary (company?) email and private email registered.
Instead of re-inventing a whole new chunk of code by introducing a security question and all, simple allow 2 emails to be valid at any given time.
Fabio _______________________________________________ infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
On 5/30/2012 1:37 PM, Chris Dix wrote:
Fabio,
If you implement a password recovery feature, that would email the new password to the user. That does no good if they don't have access to their email account.
We probably do want an alternate email that can be used for these situations.
I don´t think we understood each other :)
I am suggesting that every user in fas has 2 emails registered, one primary one backup. Both active at the same time. If you lose access to one email and password to fas, you still have one backup email address that is recognized for password recovery.
<sarcasm> If the user can manage to lose password, and access to 2 emails at the same time, I am not entirely sure I´d want his packages to be installed on my system. </sarcasm>
The point being that there is already all the code there written to handle one email address, and it would be enough to make it understand backup address vs rewriting a whole new chunk of code for security questions, store them, hash answers, crypt the db... etc.
Fabio
Chris
On May 30, 2012 3:41 AM, "Fabio M. Di Nitto" <fdinitto@redhat.com mailto:fdinitto@redhat.com> wrote:
On 5/29/2012 11:45 PM, Andre Robatino wrote: > Kevin Fenzi <kevin@...> writes: > >> I think adding a 'security question(s)' feature would be great. >> >> I would strongly suggest however that the questions and answers be free >> form. There's little security in canned security questions that have >> answers people can find out. ie, 'What was your high school?' > > I just use a password manager and if a site forces me to answer "security" > questions, I put them in the Notes section using strong random passwords for the > answers. For example > > What was your high school? 48ZGrNaDQR75 > > I think the security questions should be optional in any case to save the > trouble of having to make and store several strong random passwords rather than > just one. Or maybe have primary (company?) email and private email registered. Instead of re-inventing a whole new chunk of code by introducing a security question and all, simple allow 2 emails to be valid at any given time. Fabio _______________________________________________ infrastructure mailing list infrastructure@lists.fedoraproject.org <mailto:infrastructure@lists.fedoraproject.org> https://admin.fedoraproject.org/mailman/listinfo/infrastructure
infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
On 01/06/12 18:35, Fabio M. Di Nitto wrote:
On 5/30/2012 1:37 PM, Chris Dix wrote:
Fabio,
If you implement a password recovery feature, that would email the new password to the user. That does no good if they don't have access to their email account.
We probably do want an alternate email that can be used for these situations.
I don´t think we understood each other :)
I am suggesting that every user in fas has 2 emails registered, one primary one backup. Both active at the same time. If you lose access to one email and password to fas, you still have one backup email address that is recognized for password recovery.
<sarcasm> If the user can manage to lose password, and access to 2 emails at the same time, I am not entirely sure I´d want his packages to be installed on my system. </sarcasm>
The point being that there is already all the code there written to handle one email address, and it would be enough to make it understand backup address vs rewriting a whole new chunk of code for security questions, store them, hash answers, crypt the db... etc.
Fabio
Chris
On May 30, 2012 3:41 AM, "Fabio M. Di Nitto" <fdinitto@redhat.com mailto:fdinitto@redhat.com> wrote:
On 5/29/2012 11:45 PM, Andre Robatino wrote: > Kevin Fenzi <kevin@...> writes: > >> I think adding a 'security question(s)' feature would be great. >> >> I would strongly suggest however that the questions and answers be free >> form. There's little security in canned security questions that have >> answers people can find out. ie, 'What was your high school?' > > I just use a password manager and if a site forces me to answer "security" > questions, I put them in the Notes section using strong random passwords for the > answers. For example > > What was your high school? 48ZGrNaDQR75 > > I think the security questions should be optional in any case to save the > trouble of having to make and store several strong random passwords rather than > just one. Or maybe have primary (company?) email and private email registered. Instead of re-inventing a whole new chunk of code by introducing a security question and all, simple allow 2 emails to be valid at any given time. Fabio _______________________________________________ infrastructure mailing list infrastructure@lists.fedoraproject.org <mailto:infrastructure@lists.fedoraproject.org> https://admin.fedoraproject.org/mailman/listinfo/infrastructure
infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
If a user maintains packages, he will know how to use a public key ;-p. And as such know gnupg and how to sign emails with his private key.
People should just remember to put in their public keys.
The only reason why I was so vocal about the user asking about a change was, that he is a former red hat employee and as such should receive a common courtesy of going the extra mile. As long as he contacts his supervisor/manger/HR person who can verify that he is who he claims to be.
With other people this would be harder.
Regards,
Tristan
On Fri, 01 Jun 2012 19:33:28 +0100 Tristan Santore tristan.santore@internexusconnect.net wrote:
If a user maintains packages, he will know how to use a public key ;-p. And as such know gnupg and how to sign emails with his private key.
People should just remember to put in their public keys.
This would help, yeah.
The only reason why I was so vocal about the user asking about a change was, that he is a former red hat employee and as such should receive a common courtesy of going the extra mile. As long as he contacts his supervisor/manger/HR person who can verify that he is who he claims to be.
Yes, but not sure how easy that would be if they moved as part of a new job, or the like. (ie, if they couldn't talk face to face or at least voice of someone who knows them well).
kevin
On Jun 1, 2012 3:39 PM, "Kevin Fenzi" kevin@scrye.com wrote:
On Fri, 01 Jun 2012 19:33:28 +0100 Tristan Santore tristan.santore@internexusconnect.net wrote:
If a user maintains packages, he will know how to use a public key ;-p. And as such know gnupg and how to sign emails with his private key.
People should just remember to put in their public keys.
This would help, yeah.
The only reason why I was so vocal about the user asking about a change was, that he is a former red hat employee and as such should receive a common courtesy of going the extra mile. As long as he contacts his supervisor/manger/HR person who can verify that he is who he claims to be.
Yes, but not sure how easy that would be if they moved as part of a new job, or the like. (ie, if they couldn't talk face to face or at least voice of someone who knows them well).
kevin
Dont we already ask for a contact phone number? Could that somehow be used to verify an individual?
Sijis
Aren't people supposed to be registering a gpg key with their account? That can be used to do a recovery.
Backup passwords need to be used carefully as they are a potential weak spot. They are often easier to guess and may be used to provide a way back in to compromised accounts.
Bruno Wolff III <bruno@...> writes:
Backup passwords need to be used carefully as they are a potential weak spot. They are often easier to guess and may be used to provide a way back in to compromised accounts.
http://gawker.com/5916349/mitt-romneys-hotmail-hacker-would-like-you-to-know...
infrastructure@lists.fedoraproject.org
-
Alejandro Perez -
Andre Robatino -
Bruno Wolff III -
Buddhike Kurera -
Chris Dix -
Danishka Navin -
David Nalley -
Fabio M. Di Nitto -
Kevin Fenzi -
Larry Brower -
Leonardo Rodrigues de Mello -
Michael Scherer -
Seth Vidal -
Sijis Aviles -
Thomas Spura -
Tristan Santore