We have rebuilt Luxine's accounts: new passwords, email verification and multi-account

Two days ago I explained the flaw the SifG22 team demonstrated to me: my password recovery system let anyone into someone else’s account without really checking who was asking. I shut down logins, accounts and comments, and promised to come back with the system rebuilt.

It is done. And it was not a patch: I rebuilt authentication entirely.

One important note first: we have reset the passwords of every account. No previous password works any more. Below I explain exactly how to recover your access depending on your case.

First things first: how you get back in

There are two situations, depending on whether you had a recovery email linked.

If you had a recovery email

You can do it yourself, right now. Go to Sign in → “I forgot my password” and follow the three steps. If you are in this group, we have already sent a notice to your inbox.

If you did not have a recovery email

You need me to issue you a temporary password, but you do not have to chase me down: try the process anyway. When you enter your username, if the account exists and has no email linked, an automatic alert reaches me and I get on it.

You can also write to contactoluxine@gmail.com with your username, especially if I am slow. When you sign in with the temporary password, the site will immediately require you to choose one of your own.

It is less convenient, and I am sorry about that. But the alternative — granting access to whoever claims to be you — is precisely the flaw SifG22 pointed out.

What changed, one thing at a time

Password recovery is no longer about guessing an email

This was the hole. Before, getting your username and your recovery email right was enough for the system to let you change the password. The problem is obvious the moment you say it out loud: someone’s email address is not a secret. It shows up in a profile, in an old comment, anywhere.

Now the email is no longer the proof, only the recipient. The process takes three steps:

1. You enter your username and your email.
2. We send a 6-digit code to that address. If it is not you, the code lands in the real owner’s inbox and you are left outside.
3. Only after verifying the code can you choose a new password.

The code expires after 15 minutes, allows 5 attempts and is burned once used. And one detail matters: when the details do not match, the system answers exactly the same as when they do. Previously, a different message for “that user does not exist” turned the form into a tool for finding out which accounts were registered.

On top of that, email delivery now actually works. In the old system the recovery link simply never arrived, yet the site reported the send as successful. That was lying to the user, and it was in my code.

Here it is, clickable. In step 2 there are two buttons: one plays the account owner, the other somebody who only knows the email address.

Temporary passwords that expire

For accounts without an email, an administrator can issue a temporary password. But under strict rules:

• It expires (24 hours by default).
• Whoever signs in with it cannot use the site until they define their own password. It is not a suggestion: any page they try to visit sends them back to the change screen.
• Issuing it destroys the previous password. If the account was compromised, the old one stops working that instant.
• It is shown only once. Only its encrypted fingerprint is stored. If it is lost, it cannot be looked up: a new one has to be issued.

And the part I care most about making clear: I do not see your passwords. Not the temporary one once the window is closed, and above all not the one you choose afterwards. The only thing recorded is the date you changed it. That is not a promise; it simply does not exist anywhere I could read it.

This is how it looks from the inside. Run the commands and compare what the old system answered with what the current one does:

Several accounts in the same browser

This is convenience rather than security, but I took the chance to do it properly. You can now keep several accounts open at once and switch between them from the user menu without retyping your password, like in a mail client.

Each account keeps its own separate session, and all of them still expire after exactly one hour. Having several open does not extend any of them.

Sessions can now actually be cut off

Before, an open session stayed valid until it expired, no matter what happened. Now sessions are recorded and are cut when they should be: changing your password closes every other session on your account. If somebody had signed in with your old password, it throws them out immediately.

Moving your history to another account

If you had duplicate accounts or want to consolidate, you can move your comments to another account of yours. It requires your password and typing a confirmation phrase, so it cannot happen by accident. It is logged: I can see that the transfer happened, between which accounts and when. Never any password.

About the terminal-looking panels

Several of you have asked over these days: why do the internal panels look like a console, with the $ commands and the green on black?

The short answer: yes, it was a hint.

When I started rebuilding this, the first thing that changed was not the security code but the admin interface. Not for the look of it. A panel that looks like a terminal forces you to treat every action as what it is: a command with consequences, not a pretty button you press without thinking. $ ban, $ chmod, $ passwd -t. When the screen spells it out that way, you think twice before pressing.

There is a more practical side too. Redesigning them meant listing, one by one, every action an administrator could run. That inventory is what showed me which ones asked for no confirmation, which ones were recorded nowhere, and which ones — the most serious — did not require retyping my password. Today, changing a role or issuing a temporary password asks for my admin password every single time, even with my session already open.

So when you saw those panels appear, what you were looking at was the start of this work. The rebuild was already under way.

What I have not solved

I would rather say it than have you find out.

• Accounts without an email depend on me. The automatic alert means I find out, but it does not solve the underlying issue: there is no way to verify that somebody is who they claim to be without a verified channel, so I still do that check by hand. If I am slow to reply, those people wait. The real fix is for you to link a recovery email as soon as you get in.
• The attempt limit lives in the server’s memory. In practice it stops brute force from a single IP, but an attacker spread across several instances would get more attempts than the nominal limit. It is identified and I will move it to shared storage.
• This has not been through an external audit. I fixed what SifG22 found and what I spotted myself while reviewing it. That is not the same as saying nothing is left.

If you find something

The way SifG22 did this — telling me privately, proving it without spreading any data — is exactly the right one. If you find something odd, write to contactoluxine@gmail.com before telling anyone else. I will be grateful, even if it turns out to be nothing.

Thank you for your patience these days. And thanks to SifG22: a warning from a friend costs far less than the alternative.