Mac Forum Forced Password Change?

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
I was rather surprised this morning when I tried to log into this Mac Forum and received a message that my password was 120 days old and I had to change it before I could continue.

This is the first forum ever in my many years on the net and subscribing to forums that a password change for a forum became mandatory after a certain time period.

I can understand "forced" password changes for sites that contain financial or confidential personal information, but for a forum like this???
What exactly will someone be able to "steal" if they get my password for this forum and log in?

And for me making the change was not completely trivial since for sites like this, with no financial or confidential information, I set up my browser to automatically populate the user ID and password fields, so my old, existing password which is required for the change, is not readily available.
 
Joined
Jan 1, 2009
Messages
15,453
Reaction score
3,808
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 15 Pro, plus ATVs, AWatch, MacMinis (multiple)
I got the same message last week. I think it's built into the software supporting the site. And your old password would be in Keychain, given what you said about automatically populating, for the future.
 
Joined
May 21, 2012
Messages
10,703
Reaction score
1,158
Points
113
Location
Rhode Island
Your Mac's Specs
M1 Mac Studio, 11" iPad Pro 3rdGen, iPhone 13 ProMax, Watch S7, 2018 15" MBP, AirPods Pro
You don't have the ability to view saved passwords through your browsers preferences? What browser do you use?
 
OP
krs

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
I got the same message last week. I think it's built into the software supporting the site. And your old password would be in Keychain, given what you said about automatically populating, for the future.

I have 260 items in keychain.
Didn't spot macforums, then did a search for mac... only two items showed up but neither one was macforums.

I'm wondering, does keychain somehow store passwords I use in Firefox?
I eventually found the password in Firefox, but it's not obvious where to look - that's what I was getting at.

And as to this being built into the software...yes, but I assume it must be activated somehow.
I'm a member of other forums that use vBulletin and have for years, and none of them force a password change.

I was mostly wondering of what the point is of changing a password every four months on a forum site.

- - - Updated - - -

You don't have the ability to view saved passwords through your browsers preferences? What browser do you use?

I found it eventually...browser is Firefox but I'm transferring to Brave; Firefox doesn't work that well anymore after the latest updates.
 
Joined
Jan 1, 2009
Messages
15,453
Reaction score
3,808
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 15 Pro, plus ATVs, AWatch, MacMinis (multiple)
Well, I used Keychain Access and did a search for "forum" and it found the last five passwords I have used at Mac-forums.com. Don't know why your search in keychain didn't find it, unless it's a "feature" of Firefox not to share with Keychain. I use Safari and the passwords are in both Keychain and Safari/Preferences. I did try Brave, but it's not ready for prime time, IMHO. Maybe someday.
 
Joined
Jul 30, 2009
Messages
7,295
Reaction score
301
Points
83
Location
Wisconsin
Your Mac's Specs
Mac Mini (Late 2014) 2.6GHz Intel Core i5 Memory: 8GB 1600MHz DDR3
What exactly will someone be able to "steal" if they get my password for this forum and log in?

That's a good question.... :holdon
 
OP
krs

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
Well, I used Keychain Access and did a search for "forum" and it found the last five passwords I have used at Mac-forums.com. Don't know why your search in keychain didn't find it, unless it's a "feature" of Firefox not to share with Keychain. I use Safari and the passwords are in both Keychain and Safari/Preferences. I did try Brave, but it's not ready for prime time, IMHO. Maybe someday.

Strange...
I just checked keychain again, did a search for forum and get 21 results but mac-forums isn't one of them.

I thought user names and passords for websites would only show up in keychain if one used Safari as the browser.

As to "Brave not ready for prime time". I'm interested in more of your comments on that and wil start a separate thread.
 
OP
krs

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
When I now tried to log in again, I ended up in a strange loop.

When I try to log in, I get this window below telling me I have to reset my password again.
When I do that and get a temporary password in my email and try to use it, I get another window that suggests that I need to register.
But then I end up with the "For security reasons" window again and it just keeps going around that loop.

Only way I got back into the forum is to use a different browser that I had never used with mac-forums before.

As far as I know, vBuletin is commercial software that has to be paid for - as such it's pretty crappy.
Not just now but thinking back to all the previous issues in the last few months that Nick had to struggle with

mac-forums reset.jpg

macforum_login.jpg
 
OP
krs

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
I think I have an idea what the problem might be.

When I go to Mac-Forums in my bookmarks, I see the log-in option at the top of the page. See attachment with arrow pointing to it.
When I click on that, my user name and password shows up, but no button to click on to actually log in.
So I tried clicking on the page, in later tries I hit the return key on the keyboard - they all took me to the password reset "for security reasons" page.

The way I got back in with firefox now was to select a thread, try to reply to it, that then brought up a different log in window with a log in button that I could click on.
Man, what a pain...and all of that was triggered by the 120 day "forced" password reset

macforum_login arrow.jpg
 

IWT


Joined
Jan 23, 2009
Messages
10,218
Reaction score
2,175
Points
113
Location
Born Scotland. Worked all over UK. Live in Wales
Your Mac's Specs
M2 Max Studio Extra, 32GB memory, 4TB, Sonoma 14.4 Apple 5K Retina Studio Monitor
I'm the opposite:)

Never been asked to change my PW - ever. I do change it now and again by choice.

krs - you point to Log In. Manually put in your User Name, then your PW, then check "remember me", then hit Log In.

That might do the trick.

Oh, and another possible point, I never log out. After all, I go to this Forum umpteen times a day. (Wish I could help that often, but that's another story).

Ian
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
I don't know how Firefox interacts with the Keychain, but Safari and Chrome both will store and retrieve passwords from the Keychain. And as Ian has pointed out, by remaining logged in you should have no problem entering the forums once your password has been set.

As for the 120 Day password change requirement, that was implemented some time ago when these forums (under a different ownership) were compromised. And yes, it's true that some other forums do not require a password change every so often. However, for now, ours does.
 
OP
krs

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
I'm the opposite:)

Never been asked to change my PW - ever. I do change it now and again by choice.

krs - you point to Log In. Manually put in your User Name, then your PW, then check "remember me", then hit Log In.

That might do the trick.

Oh, and another possible point, I never log out. After all, I go to this Forum umpteen times a day. (Wish I could help that often, but that's another story).

Ian

My user name and password (password just showing dots) was actually preselected, I just cut that part off since I didn't want my email address showing.
I also tried it with and without checking the remember me box.
Also deleted cookies and cache - that made no difference.
But I didn't try deleting the preselection and entering user name and password manually

And I never log out either for this forum or any other forum - the "forced" password change was strictly triggered by the 120 day window, at least that is what the message said originally - after that the message was always "for security reasons"....what security I wonder.
 
OP
krs

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
I don't know how Firefox interacts with the Keychain, but Safari and Chrome both will store and retrieve passwords from the Keychain. And as Ian has pointed out, by remaining logged in you should have no problem entering the forums once your password has been set.

As for the 120 Day password change requirement, that was implemented some time ago when these forums (under a different ownership) were compromised. And yes, it's true that some other forums do not require a password change every so often. However, for now, ours does.

This information seems to be somewhat conflicting.
First you suggest that I should be able to enter the forum once the password has been set and one has not logged out - which is exactly the case with me (except that didn't happen).

But then you state that the 120-day forced password change is still implemented on this forum now.

So should everyone get the 120-day password change or not?
Seems some of us do and others do not.
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
As far as I'm aware, the 120 Day password change requirement refers to everyone including the staff.

What is conflicted? Once your new password is set and you remain logged in, you should not have to enter it again until it once more expires after 120 days. Is there something about that you don't understand?
 
OP
krs

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
As far as I'm aware, the 120 Day password change requirement refers to everyone including the staff.

What is conflicted? Once your new password is set and you remain logged in, you should not have to enter it again until it once more expires after 120 days. Is there something about that you don't understand?

Well, it doesn't work like that.

After I had to change the password, I now have to log in every single time I want to post a reply...like this time.

To be specific - I received an email notification about your post.
I clicked on the link in the email notification.

I then get the same type of mac-forums page I posted earlier with the wide blank column at the right.
What is odd is that at the bottom right there is the "Reply with Quote" option, but the "Reply" option is missing
If I then click on the "Reply with Quote" option (which is the only one available, I get taken to the log in page
User name and password there were prepopulated.
I then select "Keep me logged in" and then the log in
That gets me back to the post I want to reply to and now both te "Reply" and "Reply with Quote" options show up.

So at least the "Keep me logged in" part now no longer works.
Worked fine for the last 120 days - the forced password change must have caused this.

Next time around I'll take a screen shot of every step
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
Next time around I'll take a screen shot of every step

Good idea. We'll try to figure out what's happening.
 
OP
krs

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
Good idea. We'll try to figure out what's happening.

OK - same thing happened this time as last time.

Screenshot of email with the link
Then first web page that comes up when I click on the link in the email, bottom show "Reply with Quote" only - tried clicking on top right login box, but it wasn't a box that was clickable.
Clicking on "Reply with Quote" took me to the log in page - user name and password were prepopulated, checkmark at "Remember Me?" I selected each time, then clicked on "Log In"
Next web page is the Reply window with the quote

PS: Browser I'm using is Firefox, same as I have always used

mf email.jpg

mf link from email.jpg

click on reply with quote.jpg

after logging in.jpg
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
It appears that your log in information is not being retained in your Keychain. I can duplicate the exact sequence of events by going into my Safari passwords and removing the information stored there for Mac Forums. I don't know in your situation if it's Firefox that's not retaining the information or something else.

As a test, if you could switch to Safari, enter your user name and password, click on "remember me", enter the forums and then switch to another page (do not log out). After, go back to our forums and see if you are still logged in.

You might even try doing the above by rebooting your machine to see if you remain logged in.
 
OP
krs

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
It appears that your log in information is not being retained in your Keychain. I can duplicate the exact sequence of events by going into my Safari passwords and removing the information stored there for Mac Forums. I don't know in your situation if it's Firefox that's not retaining the information or something else.

As a test, if you could switch to Safari, enter your user name and password, click on "remember me", enter the forums and then switch to another page (do not log out). After, go back to our forums and see if you are still logged in.

You might even try doing the above by rebooting your machine to see if you remain logged in.

We already established earlier in this thread that Firefox does not keep log in information in keychain, so yes, that the log in information is not in keychain. The login information wasn't in keychain before either when everything worked fine.

I just double checked on the net and found this:
Can my Mac keychain save the passwords used in firefox? | Firefox Support Forum | Mozilla Support

I also checked the stored login information in Firefox and user name and password is shown there.
In fact, the user name and password is prepopulated when the forum software takes me to the login page which I had posted.

Somehow the forum software doesn't get the saved user name and password from Firefox when I click on the link in the email but gets it fine later when I'm in the login page.

I'm going to do some more testing.
In a pinch I will try to register all over again, maybe with a different user name so the forum software doesn't get confused.
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
In a pinch I will try to register all over again, maybe with a different user name so the forum software doesn't get confused.

Don't do that as the forum software will catch it as a double registration and automatically flag it and likely ban you. It can detect that you're using the same IP address.

I know you like Firefox, but Firefox at least for me has been problematic. I no longer use it. Safari and Chrome seem to work well to access this forum and others.
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top