Login issue

[Daniel Etter]

Hello @Michael for some reason when I open your site over the Internet, it logs me in as member BPD53. This does not occur when I use the app. I saw someone else a few days ago was having an issue along these lines.


Sent from my iPhone using Overland Bound Talk

 

[Michael]

Does this look like your email?


Sent from my iPhone using Overland Bound Talk

 

[Michael]

Both accounts appear to be valid.


Sent from my iPhone using Overland Bound Talk

 

[Daniel Etter]

That's the account that is not mine that it kept signing me into. My email is detter30@comcast.net with the username Daniel Etter. I logged out of his and haven't had the issue since. Just wanted to give you a heads up that people might have access to other people's accounts.


Sent from my iPhone using Overland Bound Talk

 

[BPD53]

That's my account.....I got logged on as another guy the other day too!

I am starting to think there is something going on around here.

How do I delete my Overland Bound account?

 

[Daniel Etter]

I thought I tagged you in the initial message to let you know but it didn't put the @ in front of your name


Sent from my iPhone using Overland Bound Talk

 

[BPD53]

No problem. I don't like the idea of someone gaining access to my account. I am glad a honest person got logged on as me.

Thanks for bringing it to my attention sir.

I think the security of this site needs addressed for sure.

 

[Steve]

Tagging @Michael

 

[Daniel Etter]

@Steve you were the other one affected by this right?


Sent from my iPhone using Overland Bound Talk

 

[Gnasher_PNW]

@MarkW As a heads up, I was logged into your account a few minutes ago. Sorry!

Any ideas what's causing this?

 

[Steve]

@Steve you were the other one affected by this right?

Yep, @BPD53 had somehow gotten logged in as me, just like you got logged in as him. Don't give up on us, @BPD53, as this has never happened before. I'm sure @Michael will get it figured out soon.

Steve

[EDIT] And just as I say in't never happened, @Gnasher_PNW finds himself logged in as @MarkW Michael, something drastic has changed recently, and the first instance was when testing the dual login of the home page and forum. There might be some wires crossed there.

 

[Daniel Etter]

Not sure what is going on with it. It just logged me back into @BPD53 again as well...


Sent from my iPhone using Overland Bound Talk

 

[BPD53]

Not sure what is going on with it. It just logged me back into @BPD53 again as well...


Sent from my iPhone using Overland Bound Talk

If you have any posts while logged in as me, make me look good.

 

[Daniel Etter]

Hahahaha so far I've noticed immediately that it wasn't my account


Sent from my iPhone using Overland Bound Talk

 

[Michael]

Hey all,

We believe the situation is resolved, and ended up NOT being malicious. It was a caching issue, and has been addressed by our security company. If there are any issues in the future, please let me know!

Thank you for your patience and trust. We hold user information and security as our most critical priority!

M

Note from security company:

Hello,

I'm sorry to hear about this issue. This is a classic cache issue.
Your cache setting is 'Enabled' which the highest level of cache and works well for most sites.
However, sites with member only areas should use the 'site-caching' level which ensures that
nothing will be cached for logged in users.

XXXXX

I have made that change for you now so this issue should no longer happen.
There is more information on our caching options here if you are interested:
XXXX

I hope that helps. Please let us know if you have any further questions or issues.

- jon

 

[Daniel Etter]

This just happened again @Michael and @BPD53

 

[Michael]

View attachment 4953
This just happened again @Michael and @BPD53

Looking at your accounts in the database to see if there is an actual code error. @BPD53 is the lucky winner. This is happening with you guys. I'm going to review the actual database tables. Will report back.

 

[BPD53]

@Michael I just got logged in under a member named Tek.

 

[Michael]

Hey all,

BPD534 requested that his account be deleted, and we have to respect that. I hate to see him go. We are going to reach out to him once we get the account logging issue solved. If any of you have worries, I recommend turning on two-factor auth in your profile. I know this is technical, not malicious. We'll get it solved.

M

 

[Daniel Etter]

That's unfortunate...