ATTENTION ALL: Changes to the login process are coming.

[BeccaMumsnet]

Hi all,

We wanted to let you know in advance about a change we're making to the login page on Mumsnet, which will take effect from Monday.

As you'll all know unless you've been living under a rock for the last two months we've been looking very carefully at our site security in the wake of the hacking attacks in August. We've done a lot of work behind the scenes, but one of public changes we've decided to make is to remove the option of logging in using your username.

On a forum on which usernames are visible to the public, the wisdom now is that it's imprudent to allow people to log in with their usernames, on the grounds that a determined attacker could take their name and employ a piece of software to crack their password (this is known as a brute force attack). It's far more secure to require people to log in using their email addresses, since a hacker would have no way of knowing that.

From Monday on, therefore, we're going to remove the option of logging in using your nickname and password, and ask you to sign in using your email and password instead.

Alternatively, if you prefer, you can still log in via Facebook or Google+.

If any of this doesn't make sense, or you've any further questions, please do ask here or email us on [email protected]

Thanks all
MNHQ

Not for me. I've been trying for months and all I get when I fill in the conform box is 'error' and a cross in a box.

I wonder if they have fixed it in the last 20 minutes.

Just tried again.

me too, Ana

waste of feckin time

AF what OS and browser pray?

I'm on Win 7 and IE. (tech hates me for this)

IWasHereBeforeTheHack

Thats - so, you paid £6 for a notebook just to write passwords in

Umm, yes. Is that a problem for you? I hope you don't mind but I actually bought three, one for me and one each for my parents. Ill try to remember check with you first before buying anymore though

I have a notebook that was £1 for 5...

I am a cheapskate and scrawled them all in something not made for the purpose.

I don't think I have enough to fill a whole notebook. But notebook shopping is always a joy so I won't condemn it

You could just write the passwords on a sheet of A4 if you are bothered about the cost of notebooks

I'm used to signing in with email anyway. As I tend to read MN during lunch breaks and I don't want anyone looking over my shoulder at my username.

This email is only used for MN, so can't be used elsewhere.

Ana, Win7 and Firefox

So changing email address doesn't seem to be working?

nope

AF - can you try on a different browser? I used chrome, because I find ff to be fairly picky at times, usually when I really want it to do something.

After the last 'incident', I created an email address and password specifically for MN. I don't use it for anything else so am no longer worried about that type of thing on here. I use chrome and had no problems changing the email address in my account.

What would be wrong with limiting login attempts to say 3 unsuccessful logins before refusing any more attempted logins to that account for the next 30 mins.

Also even with this new change people should still be using complex passwords. Use complex password managers like KeePass that enable you to have huge unique passwords for different sites while only needing to remember one master password. Passwords like letmein, password, and 123456 are some of the first ones that would be tried in a dictionary attack.

If your password is something like Mitt5843jhf"££$ then it doesn't matter if someone is trying to brute-force it. It's not computationally feasible to crack that kind of password in our childrens lifetimes never mind ours.

I've been trying to change my email address but I can't remember my password !!!!

Well I've se up a new email & tried to change it & it doesn't seem to have worked.

Cba to try a different browser.

It's all seeming a lot of effort!

Oh the shame!

I'd missed out a full stop when I'd put in my new email address, that's why I'd had no confirmation email.

So, done & dusted!

Understood hq.

Hi all - can we just confirm you are all getting the confirmation at the top of the page saying the email has been changed and you will receive a confirmation, but the address itself stays the same?

Can we also just clarify which devices, operating system and browsers you're using? It seems that a few people are using Windows 7 - is anyone having this problem with a different OS?

It has all just worked for me.

Got the confirmation "banner" & email & my email address in my account has changed.

I'm on a laptop with Windows 7 & Firefox.

I can get the 'successful' banner and the conf email sent.

Then I have to click on the link in the email, it brings up a new page, asks me to confirm by clicking a button and that's when I get the error message, and my email does not change after all that.

Thanks, Anastasie,

Just checking - are you still on the desktop site, Windows 7, IE?

I'm having a bad day I think - so can I just check. When you log in with your email (not a problem), which user name does the system assign if you have more than one?

Whoo, get me-just logged in with my new purpose built email!!