[BooGod]

Possibly because he uses proxies, not all are blocked for usage on Hack Forums, you just can't use ones by searching "proxy" onto Google. You just have to dig a bit not even that much into proxy options and providers.

Oh, I didn't know about it. Thanks for letting know, so this explains some things.

[Syracusia]

I think a x.x.x check would be enough, and not disrupt services for those with dynamic IPs too much. With this system, only 256 other IPs would pass the test. They would also have to be in the same geographical location, ISP, and also have the real user's account info.

Pretty much the same level of security while having less impact on users with dynamic IPs. Either way, still not too big of a deal.

[Uriel]

Yeah but can't damage be done before an admin noticed?
Look how much damage Morchid's account did in just hours.


But if someone sold their account, 2FA wouldn't be an issue.
It would either be disabled or shared.

EDIT: I am browsing HF on both my computer and phone. wut

Kind of my thought. If they sell their account then the info will likely be given to them regardless. Only gain I see is that the new IP will be logged once the account is sold, and they cannot hijack a session.

Luckily for me I rarely browse HF anywhere other than my home desktop PC.

[Riggs]

Given our target audience, I'm surprised this wasn't implemented a long time ago.

[Omniscient]

Locking mentor login IP's is probably another good precaution

Anyone with moderator permissions is going to get IP locked accounts. That's coming soon as possible. Even with a dynamic IP I can at least lock it to the ISP.

Depending on how this goes I may convert this to logout the account for an ISP change instead. That may help greatly reduce problems. It will be less secure but at least more convenient.

Have to fix that MyBB logging bug too asap.

This will definitely cut down on the compromising of accounts.

May or may not adequetely stop account sales though. No worries. I have a plan to curb that too.

Wait what's stopping someone from simply giving their credentials to a buyer?

The cookies are being passed and MyBB does not check the cookie session ip. It's a bad system actually. You can literally take a cookie from one browser and insert it into a completely difference device and it will work.

My ip is static, but whenever i close my browser and open again. my account is already logged out

Are you deleting cookies on browser close? Do you use an incognito mode or anything? And I'm seeing the same thing...going to have to disable this feature then until I resolve that.

Going to look at this better when I've had some rest. Been typing and staring at these screens for nearly 12 hours. Sort of bushed and I don't need to make a mistake right now.

So the feature is disabled for now.

So very tired and I still have at least 2 hours of work to do. :(

[Omniscient]

Just 10 months ago HF had little to no security.
Now we have a country lock, 2FA, session limitation AND a big fat banner if we don't enable these features.

Convenience is the price to pay for security.

And for all that extra work and security would you say we have more scammers or less?