Comments on: What's up with the "type these words" login?

What's up with the "type these words" login?

Reggie Digest — Thu, 08 Nov 2007 15:01:27 -0800

The new login procedure is annoying.

I can understand the implementation on Blogger comments, but MetaFilter? Are spambots a big problem on a site where users pay to join?

By: mathowie

mathowie — Thu, 08 Nov 2007 15:09:54 -0800

The old login procedure was annoying and the current one is a new compromise.

Here's the thing about the login page:

- we have to have some way to disallow people a million tries at logging in, because people can write bots that dictionary-attack any known username here. They've done it (successfully) in the past. It can't happen again.

- I was allowing only five login attempts, then you'd be locked out for 24 hours like a bank might block you. But MeFi isn't a bank and people don't read so they were often getting locked out from trying too many times before emailing their password to themselves. Several times a week I had to clear out a user's login history because they got blocked. It often happens in the middle of the night as well, so they're pissed they got locked out and further pissed that it isn't reset within a reasonable time.

- Instead of the painful login lockout and logging thing, I decided to go with a captcha we've been using on the contact form for the past few months (which has gone well and we don't have spammers crapflooding anymore). It's Recaptcha which is a beneficial project -- you are helping OCR scanned in textbooks for the Gutenberg project. I agree the widget is kind of large, and sometimes the text can be hard to read, but if you hit the little refresh button it will give you a new piece of text and it offers an audio option as well.

So it's a compromise and I have to limit login activity in some way, and this helps out a cool project while fulfilling the bot-attack prevention thing.

By: Reggie Digest

Reggie Digest — Thu, 08 Nov 2007 15:18:25 -0800

Fair enough.

Still, let me explain why it I thought it was a MeTa-worthy pain in the ass: I was dumb enough to click 'OK' when Firefox asked me if I wanted it to save the new password. Now it thinks my password is a long string of seemingly random characters, and since there's no way of logging in without the widget, I can't reset it, so I'm stuck filling out every field, every time, by hand.

By: puke & cry

puke & cry — Thu, 08 Nov 2007 15:19:23 -0800

By: mathowie

mathowie — Thu, 08 Nov 2007 15:22:07 -0800

Reggie, in testing on my macs running firefox, my saved passwords didn't change. It sounds like maybe the captcha itself is being saved along with your login?

By: veggieboy

veggieboy — Thu, 08 Nov 2007 15:23:13 -0800

I clicked through to read about that Recaptcha project -- so cool.

By: Reggie Digest

Reggie Digest — Thu, 08 Nov 2007 15:23:26 -0800

Exactly.

By: eyeballkid

eyeballkid — Thu, 08 Nov 2007 15:23:57 -0800

Firefox > Tools > Security > Show Passwords > select Metafilter password > Remove.

Is that what you need?

By: Reggie Digest

Reggie Digest — Thu, 08 Nov 2007 15:24:44 -0800

No, I already removed it. That's why I have to retype everything every time.

By: mathowie

mathowie — Thu, 08 Nov 2007 15:25:22 -0800

Ok, I see that yeah, it oddly asks to mangle my browser's saved password.

I'll see if I can get it to stop doing that, but you can still login successfully and it's probably a bad idea in the first place to save our logins in login forms forever. I mean, it's nice and all but it's bad security practice.

By: SassHat

SassHat — Thu, 08 Nov 2007 15:29:04 -0800

Heh, I remember the days when I used to log out. I had what they call "friends" then...

By: lee

lee — Thu, 08 Nov 2007 15:33:53 -0800

I only log out when I buy a new computer

By: Reggie Digest

Reggie Digest — Thu, 08 Nov 2007 15:34:05 -0800

I only save passwords because I change them regularly and my memory sucks and I get sick of retyping the same thing a million times a day.

(Surely doing that would be bad security practice if there were a keylogger on my computer?)

By: cortex

cortex — Thu, 08 Nov 2007 15:37:18 -0800

There's no such thing as good security practice that allows "there's a keylogger on my computer" as a given. :)

By: puke & cry

puke & cry — Thu, 08 Nov 2007 15:38:22 -0800

I just use my cats name for all my passwords. That way I don't have to save any.

By: fandango_matt

fandango_matt — Thu, 08 Nov 2007 15:40:27 -0800

posted by puke & cry I just use my cats name for all my passwords. That way I don't have to save any.

Cats, or passwords?

By: jonmc

jonmc — Thu, 08 Nov 2007 15:40:47 -0800

Serves ya right for logging out.

By: neustile

neustile — Thu, 08 Nov 2007 15:41:22 -0800

The recaptcha audio is the creepiest thing I've heard in a while. Log out just to hear it, yikes.

By: soundofsuburbia

soundofsuburbia — Thu, 08 Nov 2007 15:42:10 -0800

That would require logging out. Absurd, sir.

So, yeah, I've not been here as long as some of you, but in 5+ years I've never logged out. I've logged in a few times - deleted cookies, new computers, what have you - but never out. MetaFilter's the only site in the history of my internet browsing - going on thirteen years, now - that I've pledged such an allegiance to. Goddamit, I love this place.

By: puke & cry

puke & cry — Thu, 08 Nov 2007 15:42:40 -0800

Cats, or passwords?

Either one, really.

By: Reggie Digest

Reggie Digest — Thu, 08 Nov 2007 15:42:57 -0800

cortex: Well, obviously, but it's always best to assume the worst, right?

By: brain_drain

brain_drain — Thu, 08 Nov 2007 15:43:27 -0800

It's Recaptcha which is a beneficial project -- you are helping OCR scanned in textbooks for the Gutenberg project.

*ponders how to hack "FARTS LOL" into every Gutenberg text*

By: cortex

cortex — Thu, 08 Nov 2007 15:45:22 -0800

If that were the case, I'd have to close your account and scramble your password for hacking Reggie's account.

By: eyeballkid

eyeballkid — Thu, 08 Nov 2007 15:46:53 -0800

I just keep my password in my profile. So I don't forget it.

By: nomisxid

nomisxid — Thu, 08 Nov 2007 15:49:09 -0800

ARGH!! So much for posting thru lynx I guess. =( (well, after my current cookie expires, or lynx crashes and loses them all)

By: flapjax at midnite

flapjax at midnite — Thu, 08 Nov 2007 16:06:07 -0800

My password is a miniature poetic masterpiece so utterly perfect that should I ever forget it, life would no longer be worth living anyway. It'd be time for the BIG logout.

By: quin

quin — Thu, 08 Nov 2007 16:13:05 -0800

Just for the meta-ness of it all, I'm gonna name my next cat Captcha.

By: chrisbucks

chrisbucks — Thu, 08 Nov 2007 16:20:58 -0800

I've been having an issue here, where by when I use the login form I get an error page saying that the form.username was not submitted (or words to that effect).

I ignored it and gave up eventually, but now I've noticed that it still logged me in. This might be because I'm using a university machine and I think it had some script blocking extensions in the browser. Unfortunitely I can't produce the error page again since I'm now properly logged in.

By: bardic

bardic — Thu, 08 Nov 2007 16:35:00 -0800

My popsuckits are screwed.

By: whir

whir — Thu, 08 Nov 2007 16:36:50 -0800

I got the same thing as chrisbucks - looks like it actually did log me in, but then threw up an error page.

As a compromise on the compromise, could we maybe get the first login screen not to display a captcha, and then you could throw it up after the first unsuccessful attempt from a given IP or something?

By: pb

pb — Thu, 08 Nov 2007 16:50:15 -0800

hey whir, could you post (or use the contact form to email) the full error message you get? That'd help us track down the problem.

By: Memo

Memo — Thu, 08 Nov 2007 16:55:14 -0800

A question. Why would you want to logout if you are sure no one is going to use your saved up passwords to log in?

By: mathowie

mathowie — Thu, 08 Nov 2007 17:01:42 -0800

Ok, so we're going to do the thing that Gmail does which is a hybrid of both: you'll get 4 attempts then you'll be shown a captcha and any subsequent attempt will require a captcha.

By: Reggie Digest

Reggie Digest — Thu, 08 Nov 2007 17:02:26 -0800

Um, master password?

By: Reggie Digest

Reggie Digest — Thu, 08 Nov 2007 17:04:27 -0800

Ahem.

Memo: Um, master password?

By: Reggie Digest

Reggie Digest — Thu, 08 Nov 2007 17:05:08 -0800

So, yeah. Thanks!

By: whir

whir — Thu, 08 Nov 2007 17:16:35 -0800

could you post the full error message you get?

Sorry, I just tried it again and I didn't see the error this time. However, I did notice that the URL was something like /logincheck.cfm. Also, sometime during that process my cookies seemed to get wiped out, since I went back to the default blue theme. If I can get it to recur I'll submit it the message via the contact form, though. If you want to go digging in your logs, it would have happened probably not more than a few minutes before my post above.

By: Memo

Memo — Thu, 08 Nov 2007 17:21:46 -0800

Ahem.

Memo: Um, master password? #

Yeah, I thought about that possibility two seconds after posting that comment.

By: The Deej

The Deej — Thu, 08 Nov 2007 17:34:27 -0800

I can't remember the last time I logged in.

By: psmealey

psmealey — Thu, 08 Nov 2007 17:50:07 -0800

This was just a device to catch people with sockpuppets. The only people who ever log out, after all, are people with nasty sockpuppets.

By: nomisxid

nomisxid — Thu, 08 Nov 2007 17:51:55 -0800

thanx for the latest changes matt =)

By: solotoro

solotoro — Thu, 08 Nov 2007 18:29:57 -0800

When I browse at home, I rarely log in. The only reason I logged in tonight was because I think reCAPTCHA is a cool idea. So cheers, Matt.

By: ZachsMind

ZachsMind — Thu, 08 Nov 2007 18:33:23 -0800

PSMeasley, I have nasty sock puppets, but I use them at YouTube, not here at MeFi. ...I mean actual sock puppets...

Matthowie. You rock. As usual. Thanks for going the extra mile to secure the site for everybody, and bringing attention to that kewl Gutenberg thingy.

...come to think of it I have puppets but they're not made out of socks... That's just splitting hairs, isn't it?

By: drezdn

drezdn — Thu, 08 Nov 2007 18:34:36 -0800

I just use login in for my password. It brings back the memories.

By: Chuckles

Chuckles — Thu, 08 Nov 2007 18:51:36 -0800

I mean, it's nice and all but it's bad security practice.

I don't know about that.. Much better to manage one password properly than a thousand passwords improperly. Given that most modern computer users have tens to hundreds of accounts, and manually managing that many passwords properly is a practical impossibility, surely a secure password manager is actually good security practice.

By: delmoi

delmoi — Thu, 08 Nov 2007 19:53:11 -0800

It's Recaptcha which is a beneficial project -- you are helping OCR scanned in textbooks for the Gutenberg project.

Holy shit, that's fucking wild.

_{'wild' is my new favorite term for anything cool and original}

By: delmoi

delmoi — Thu, 08 Nov 2007 19:56:45 -0800

And yeah, I never log out, so I have trouble remembering my password on new computers. So a Captcha would be a welcome addition for me.

By: ericb

ericb — Thu, 08 Nov 2007 20:52:58 -0800

Captcha gotcha -- especially if you're drubk.

By: exlotuseater

exlotuseater — Thu, 08 Nov 2007 21:04:19 -0800

tl;dr

By: dhammond

dhammond — Thu, 08 Nov 2007 21:09:22 -0800

That's why I have to retype everything every time.

Also known as "logging in"

By: dhammond

dhammond — Thu, 08 Nov 2007 22:50:58 -0800

Also, I just got "Amos Represent" as my Recaptcha. So I am in total favor of this.

By: roll truck roll

roll truck roll — Thu, 08 Nov 2007 22:53:11 -0800

eyeballkid wins.

By: quin

quin — Thu, 08 Nov 2007 23:04:33 -0800

delmoi : 'wild' is my new favorite term for anything cool and original

"Clutch" is the new fan favorite.

Or at least it is in my smallish group of acquaintances.

Join our meme...

Join us...

By: team lowkey

team lowkey — Fri, 09 Nov 2007 00:00:38 -0800

quin, stop trying to make "clutch" happen! It's not going to happen!

By: rokusan

rokusan — Fri, 09 Nov 2007 01:06:23 -0800

"Clutch" implies timely. Clutch is wild + timeliness.

By: psmealey

psmealey — Fri, 09 Nov 2007 02:36:51 -0800

Fetch, dude. Fetch.

By: odinsdream

odinsdream — Fri, 09 Nov 2007 05:55:39 -0800

I also failed to log in once with the captcha. I'm fairly certain it was typed exactly correct, as well.

Does the space count? On the second try, I continued to type in both words including a space between. I got the error about form username, but I was logged in anyway.

How exactly does this project help OCR accuracy? Doesn't the system have to already know what the words I'm supposed to type in are?

By: carsonb

carsonb — Fri, 09 Nov 2007 06:18:08 -0800

Wild? Clutch?! Sweet cheebus, what century are you fogeys from? Pukka is teh new hotness.

By: psmealey

psmealey — Fri, 09 Nov 2007 06:23:52 -0800

groovy

By: inigo2

inigo2 — Fri, 09 Nov 2007 06:28:36 -0800

"Clutch" is from Mean Girls, carsonb. (As is team lowkey's quote.)

By: inigo2

inigo2 — Fri, 09 Nov 2007 06:30:27 -0800

odinsdream, from the recaptcha page:
"But if a computer can't read such a CAPTCHA, how does the system know the correct answer to the puzzle? Here's how: Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct."

By: carsonb

carsonb — Fri, 09 Nov 2007 06:31:14 -0800

Quoting Mean Girls?! Golly, what century are you fogeys from?

By: drezdn

drezdn — Fri, 09 Nov 2007 06:43:27 -0800

I associate "clutch" with David Eckstein and I do not enjoy David Eckstein.

By: drezdn

drezdn — Fri, 09 Nov 2007 06:44:06 -0800

Plus everyone knows unleaded == cool.

By: roofus

roofus — Fri, 09 Nov 2007 07:05:59 -0800

I also had Chrisbucks problem above, in identical circumstances.

By: bitmage

bitmage — Fri, 09 Nov 2007 07:21:38 -0800

Ok, so we're going to do the thing that Gmail does which is a hybrid of both: you'll get 4 attempts then you'll be shown a captcha and any subsequent attempt will require a captcha.

That's not working here - if I log out I have to do the whole captcha thing again on the next login.

It also sucks with Firefox on Linux - when you paste the generated code into the text box, a tab and some spaces get inserted in front of the code. This is scrolled off the top of the text box where you don't see it, leaving you fuming as to why the damn thing keeps insisting that you didn't login right.

By: krinklyfig

krinklyfig — Fri, 09 Nov 2007 07:27:12 -0800

mathowie writes "I'll see if I can get it to stop doing that, but you can still login successfully and it's probably a bad idea in the first place to save our logins in login forms forever. I mean, it's nice and all but it's bad security practice."

Yeah, but like you said this isn't a bank. I only store passwords for sites like this. If someone were to get this password, there's not much they could do but ruin my reputation here, and that would be a drag, but it's not like ruining my credit.

By: timeistight

timeistight — Fri, 09 Nov 2007 07:57:00 -0800

Quoting Mean Girls?! Golly, what century are you fogeys from?

I'm from the twentieth. What centuries are you guys from?

By: mathowie

mathowie — Fri, 09 Nov 2007 08:59:24 -0800

That's not working here - if I log out I have to do the whole captcha thing again on the next login.

If you re-read what I wrote about the four tries then captcha, I said "Ok, so we're going to..." meaning it should be live today.

when you paste the generated code into the text box, a tab and some spaces get inserted in front of the code.

I don't understand what you mean here. You shouldn't be pasting anything, but typing keystroke by keystroke into the captcha field. What you type should display normally as it's a normal form element, so I'm not understanding how it is scrolling for you or hard to use but then I'm not on linux.

By: team lowkey

team lowkey — Fri, 09 Nov 2007 09:48:09 -0800

inigo2: ""Clutch" is from Mean Girls, carsonb.

It's actually "fetch" in Mean Girls, but, yeah I'm a twentieth century fogey quoting a Lindsay Lohan movie. I should be ashamed. But I'm not.

By: quonsar

quonsar — Fri, 09 Nov 2007 09:52:11 -0800

i can't figure out how my weenie works. i have spambots, in my pants.

By: pb

pb — Fri, 09 Nov 2007 10:28:51 -0800

...paste the generated code into the text box...

This is part of the reCaptcha process if you have JavaScript disabled. If you're not using JavaScript, then yeah, this login process is much more of a pain. bitmage, any chance you could enable JavaScript for just this site, maybe just the login page?

Anyway, I'm working on the four-strikes-and-you're-captcha'd page as mathowie described. So that should take care of things for ya when it's live.

By: Dr-Baa

Dr-Baa — Fri, 09 Nov 2007 10:42:01 -0800

When I first saw the captcha, I was like

:(

Then I read "you are helping OCR scanned in textbooks for the Gutenberg project," and I was like

:D

By: lodurr

lodurr — Fri, 09 Nov 2007 11:23:17 -0800

I've had mediocre luck with captchas. There appear to be script-kiddie toolkits out there (for the past year and a half or so) to crack captchas. Hopefully this one will be a little better.

By: bitmage

bitmage — Fri, 09 Nov 2007 12:00:02 -0800

This is part of the reCaptcha process if you have JavaScript disabled. If you're not using JavaScript, then yeah, this login process is much more of a pain. bitmage, any chance you could enable JavaScript for just this site, maybe just the login page?

I have Javascript enabled for MeFi, but I guess I'll need to enable it for the captcha site...

Ah! That does make the process much less annoying than the enter username, enter password, enter captcha, click on Human button, cut 5 lines of generated text, paste into dialog, edit to remove tab and spaces that came from nowhere, submit, pant, pant, pant sequence.

By: blacklite

blacklite — Fri, 09 Nov 2007 12:04:01 -0800

Mean Girls is one of the best movies of all time. It is so fetch.

By: inigo2

inigo2 — Fri, 09 Nov 2007 12:16:29 -0800

It's actually "fetch" in Mean Girls...

Son of a..... I knew that didn't sound right, and yet I insisted to myself that it was...oh well.

By: pb

pb — Fri, 09 Nov 2007 12:32:32 -0800

The new, new login page is live. You'll only see the captcha if you've unsuccessfully tried to login five times.

By: bitmage

bitmage — Fri, 09 Nov 2007 12:38:52 -0800

PB:
Now when I login, I'm asked for username and password. When I enter those, I end up on a blank page with the URL: http://www.metafilter.com/login/checklogin.cfm#cgi.HTTP_REFERER#

If I refresh that blank page, I get the following page:
--------------------------------------------------------
Login Error!

The form wasn't submitted properly, there's no username defined. Go back and try again, or if you get this message frequently please contact the admins and describe your problem.
--------------------------------------------------------

But then I'm logged in ok. Javascript is active, I'm behind a squid-proxy firewall here at work.

By: psmealey

psmealey — Fri, 09 Nov 2007 12:40:11 -0800

I'm a twentieth century fogey quoting a Lindsay Lohan movie

I thought it was a Rachel MacAdams movie... rowr.

By: pb

pb — Fri, 09 Nov 2007 12:52:17 -0800

hey bitmage, do you get that same sequence of events each time you try to log in? Or was it a one-time thing? You also might try Shift + Refreshing the login page.

By: bitmage

bitmage — Fri, 09 Nov 2007 12:57:53 -0800

Same sequence, i.e.
Logout, close browser, open browser, go login, blank page, refresh, weird message and I'm logged in. My cache and cookies are cleared whenever I exit Firefox.

It's not a big issue, but I thought you might want to know.
Thanks for making the captcha bit less intrusive!

By: pb

pb — Fri, 09 Nov 2007 13:05:52 -0800

huh. sounds like the redirect at the end of the login process isn't working for you. You might see a blank page for a split second, but you're supposed to go on to your final destination.

By: bitmage

bitmage — Fri, 09 Nov 2007 13:14:22 -0800

but you're supposed to go on to your final destination.

Where I'll be baked, and then there will be cake...

Not a problem, this is much better than the captcha sequence before! Thanks!

By: mathowie

mathowie — Fri, 09 Nov 2007 13:38:30 -0800

http://www.metafilter.com/login/checklogin.cfm#cgi.HTTP_REFERER#

pb, looks like some CF code isn't running if a user is seeing the variables like this.

By: pb

pb — Fri, 09 Nov 2007 13:58:32 -0800

yeah, can't for the life of me reproduce it though.

By: pb

pb — Fri, 09 Nov 2007 14:10:04 -0800

And it's fixed. (Found it after all.) You should be all set bitmage.

By: cortex

cortex — Fri, 09 Nov 2007 14:11:31 -0800

Now my car won't start.

By: pb

pb — Fri, 09 Nov 2007 14:13:08 -0800

I just fixed it, cortex. Try again.

By: bitmage

bitmage — Fri, 09 Nov 2007 14:14:32 -0800

Login works fine now. Thanks for the quick fix!
Cortex, type the capcha on your dash - should look something like PRNDL...

By: cortex

cortex — Fri, 09 Nov 2007 14:55:33 -0800

It's kind of doing this "rrrRUNNNGrrrRUNNNNGGkakkity" thing and then smoke comes out of the cup holders.

I'm parked at the Opera, if that helps.

By: Iamtherealme

Iamtherealme — Fri, 09 Nov 2007 20:54:14 -0800

When I try to change the capcha or have it read to me, it tells me "Internet Explorer cannot display the webpage." Is it just me? I was looking forward to hearing how creepy the audio option sounded.

By: pb

pb — Fri, 09 Nov 2007 21:21:24 -0800

oh it's horror show alright, just like a numbers station. (The worst is the murmuring voices in the background.)

If you have "Open links in new windows?" checked in your preferences, you might try unchecking that, saving, and trying the captcha again. I've noticed that reload and audio don't work with links set to open in a new window.

By: Reggie Digest

Reggie Digest — Fri, 09 Nov 2007 21:31:47 -0800

Whoa. Any reason the site went white?

By: Reggie Digest

Reggie Digest — Fri, 09 Nov 2007 22:48:39 -0800

Ha.. D'oh. Fuckin Firefox.