forum.webdiplomacy.net

Hello All! I am from Portugal and this is my first post. Guys I need your help. I've been holidays. And I had left my account to my friend. So, he is not my friend anymore. He is fucking my accout. He enter in a game with me and he is losing and he is attacking the others. And he send messages to other guys to draw the game because he is losing. So, I already have changed my password, but the password is memorized is her computer. I dont want that any admin ban him, because he have my account memorized. I only want that, i mean...If it is possible to enter in their pc or account and refresh the site to my account dont stay logged in. Answer me fast please. My name is webdiplomacy is Chester, and he is peter25

PS: Sorry for my bad english

Thanks

The software issue itself is known, and whilst I think it should be changed, the reasoning behind it does make sense (ie it greatly reduces server load not to continually check if someone is logged on).

As for your personal issue, that's related to webDiplomacy.net rather than the software, and so probably should have gone to Kestas via the mods. I'll pass it on.

I talked with Kestas about this via email quite awhile back because it is a bit sensitive of an issue. The fact is that if you have someone sit your account, they have unlimited access to your account until the cookie expires after a year. If the md5 of the password was used in calculating the session key then when you change your password, your account is automatically logged out of every computer because the session key value is now different. If an evil sitter changed your password, you can still recover it via email so no problem.

The reasons for not doing a database lookup aren't really valid for the official site now that we're on dedicated hosting, so we could easily afford to add a check in now

I've changed Chester's userID, so you'll both need to log on again to get a new cookie which authenticates against the new ID.


We'll phase in a session based cookie system soon