Wedge

I do have one idea I haven't shared yet that I think you'll like but I'll demo it when I've got it working how I'd like.

The only reason you knew you were being attacked is because of being logged out. In fact, there is a much better defence already in place for the style of attack.

Especially since I consistently see both username and email spam attacks in attempts to brute force access... Meaning that they'll still try it, and it actually is not a defence any longer.

What might be good is to provide a blacklist of the most common passwords and bar them from being used, since of the attack you're referring to (and in fact most brute force attempts), the top 20 or so most commonly used passwords were just cycled through a rotation.

Yes, I know exactly what it's about, since earlier this year there was an alarming rate of login attempts being made.

What it comes back to is whether people would rather be secure or convenient, and most people would rather be convenient. Sad, but true.It always refers to the username you signed up with. There's a simple, practical and immediate defence right there: have a different display name to username. It is as secure as using an email address in this context.

In fact, in another context it may actually be more secure to leave it as is. Consider the case of key loggers, logging email and password. If you're a good person and use a different password for each service, it doesn't make a lot of difference, but if you're not, you just provided one extra way for them to get your email + password combination.

You know that the system already actually does this internally, right? If you supply an email address it will attempt to use it.

Facebook quite happily accepts both.

I should point out that there is a convenience factor attached here, typing a username is a whole lot shorter than typing an email address in most cases, though most people will just stay logged in 'forever'.

Like what?

If a user doesn't want their status known, that's fine, they have the power to opt out. But I have yet to see a case where you would summarily rule it out entirely, especially given how you can see who's online on the front page.

Revision: 953
Author: arantor
Date: 13:18:52, 19 August 2011
Message:
! Fixed installer doing very strange things like never actually getting past the DB settings stuff. (install.php)
----
Modified : /trunk/other/install.php


(Bah, meant to post this earlier.)

I have to say, I never really looked at 1.1.x themes before, but I gotta say, I just took a look at your work and it does look pretty good. I'd love to see any more themes you work on. :)