PUBLIC SERVICE ANNOUNCEMENT: 2FA NOW MANDATORY - YOU DON'T NEED A PHONE NUMBER FFS

[Utgard-Loki]

your whore of a mother is valid for 15 minutes. could you change this to at least only require validation if you actively try to do something besides browse the goddamn forum?

 

[Kathlyn Kitty Kat]

Hi, had issues with not being able to validate the email code i received multiple times until the account was locked. Had to use a backup code to login. Please investigate.

 

[Taluntain]

Switch to the app option, e-mail can be problematic for several reasons.

 

[Kathlyn Kitty Kat]

i'm not downloading a app just to login in here.

 

[Black Plague]

Oops! We ran into some problems.
The two-step verification value could not be confirmed. Please try again.

Have you given Infinitron his shekels yet?

Won't give an edge shaving.

 

[Roguey]

i not downloading a app just to login in here.

Try https://rpghq.org/forums/viewtopic....-a-phone-rusty-s-recommended-password-manager

 

[Sunri]

wtf i had to do it again only to get informed that retardbox is back REEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

 

[Reinhardt]

yesterday it was "Oops! We ran into some problems." now i have to use vpn just to open codex. fuck this shithole.

 

[what am i doing]

Fuck you.

 

[Child of Malkav]

Hey faggot (King Crispy), every time I can't log in I'll post this. Enjoy.

Recently one of our more... prolific posters had his account compromised, after which the perpetrator apparently went on a mass-deletion spree which has fouled up all the threads this particular user participated in. Needless to say it has caused some consternation and poor @Twiglard now can't get any sleep because he has to sort all this out.

If you haven't already, you need to enable and start using our two-step verification feature (also known as two-factor authentication, or 2FA) which you can find in the security section of your settings page.

You have two choices: you can set it to use an app like Authy which you install on your cell phone and every month have to launch to verify the code, or you can just use an alternate email address to do the same thing. The app is recommended, because it's more of a stringent security system, but many of you are probably either too poor to afford a smart phone or you haven't upgraded from your dad's ancient flip phone yet.

2FA. Learn it. Live it. Love it.

Don't be that guy.

Thank you.

- The Administration

PUBLIC SERVICE ANNOUNCEMENT:​

FUCK YOU!

In case you didn't get the message:

Click to go fuck yourself!

 

[Peachcurl]

I can not login but I must post.

 

[gaussgunner]

Switch to the app option, e-mail can be problematic for several reasons.

There's always the nuclear option.

 

[Child of Malkav]

I can not login but I must post.

Obviously I managed to log in but after the ordeal I felt like I had to...give back, you know? Show some gratitude.
Oh and btw, fuck you too.

 

[Crispy]

Hey faggot (@King Crispy), every time I can't log in I'll post this. Enjoy.

If you're going to call me a faggot then I'm going to just be blunt with you.

I see you're on what appears to be a static IP with no VPN or other services apparent, but I also see that your actual IP seems to change every month, multiple times.

Why is that? Are you using a private VPN? If so, then you're probably fucking yourself in terms of easily/properly using 2FA, which needs to be able to identify your PC via a persistent IP address. That's why you have to log back in and establish a new 2FA token with every computer you access Codex from, or if you effectively move your PC, which is essentially what you're doing with whatever masking service you're using.

It's quite simple: once per month, the 2FA app asks you to verify with a new code. It checks that code based on your IP address. If you keep changing IP addresses, it needs to re-check to make sure you are who you say you are. Otherwise, you're basically a stranger to RPG Codex (in terms of security) and you're going to be asked to show your ID again.

Either stop using whatever VPN you're using or just deal with the fact that with IP hopping, that's what you'll have to do. Every time.

I hope this helps. Good luck to you.

 

[Child of Malkav]

Hey faggot (@King Crispy), every time I can't log in I'll post this. Enjoy.

If you're going to call me a faggot then I'm going to just be blunt with you.

I see you're on what appears to be a static IP with no VPN or other services apparent, but I also see that your actual IP seems to change every month, multiple times.

Why is that? Are you using a private VPN? If so, then you're probably fucking yourself in terms of easily/properly using 2FA, which needs to be able to identify your PC via a persistent IP address. That's why you have to log back in and establish a new 2FA token with every computer you access Codex from, or if you effectively move your PC, which is essentially what you're doing with whatever masking service you're using.

It's quite simple: once per month, the 2FA app asks you to verify with a new code. It checks that code based on your IP address. If you keep changing IP addresses, it needs to re-check to make sure you are who you say you are. Otherwise, you're basically a stranger to RPG Codex (in terms of security) and you're going to be asked to show your ID again.

Either stop using whatever VPN you're using or just deal with the fact that with IP hopping, that's what you'll have to do. Every time.

I hope this helps. Good luck to you.

The first message was posted from my PC. On Firefox. I use no VPN because I don't need to.
The 2nd message was posted from my mobile, Opera browser, again, no VPN. I know Opera offers that service but I don't use it.
This 3rd message is posted from my mobile again because the internet is down in my area and has been for the last 5 or so hours.
These are the only 2 devices that I browse the codex on.
Your explanation for my apparent IP change is weird to say the least. I don't use any masking software of any kind. I activated 2FA for another website some time ago and after witnessing the horror I promptly deactivated it.
On my account here I do have the option to deactivate it but it does precisely jack shit seeing as I have to go through this whole thing once a month.
It's rare but when it happens it's mighty frustrating as you can tell from my posts.
All I want to do when I visit this site is to read, post, search etc. Basically use it normally. Apparently it's too much to ask for.

 

[Crispy]

Your explanation for my apparent IP change is weird to say the least.

Then you may want to consider contacting your ISP and asking them some questions as opposed to calling me a faggot, telling me to fuck off, etc.

Twiglard, could you check to see if this guy's IP is within the range of any of the ones we've had trouble with lately?

 

[Peachcurl]

I thought IP doesn't matter, only device (cookies) matter?

 

[Child of Malkav]

Then you may want to consider contacting your ISP and asking them some questions

Why would I ask them questions? They do their job: provide access to internet. It's websites that utilize 2FA that are the problem. I didn't have any problems at all with browsing and interacting with this site until you or whoever else decided to implement 2FA.

 

[Crispy]

I thought IP doesn't matter, only device (cookies) matter?

2FA can be a more lax system requiring other-than-IP confirmation, yes, but it's then obviously quite a bit easier to defeat. Because of the malicious actions that someone has recently perpetuated against our database (causing frequent freezing, massive threads to freak out, etc.) we've had to rely on a stringent (IP-based) check.

 

[Crispy]

Why would I ask them questions?

You don't have to. You can just sit there and wonder why you're an exception rather than a rule as to how many people are able to successfully navigate our 2FA system to log in to Codex trouble-free. Hell, you might even just be curious as to why your IP seems to keep changing. I would be, if I were you.

You still seem to be antagonistic, as well, against someone (me) who had nothing to do with 2FA being enabled here. If you had read this thread carefully, you would have easily been able to deduce that. I personally don't give a flying fuck whether or not you can log in here, especially after everything you've called me and told me to do. Fuck you right back, pal.

However, if you want some actual assistance, then maybe I or Twiglard or Taluntain might be willing to see what could be the problem. It's up to you.

 

[Child of Malkav]

King Crispy Yeah I wasn't going to read through 40 pages to figure out who is responsible. I don't care who. I picked you because you're the OP and the tone you opened this thread up with was definitive. So yeah, easy target.
I calmed down since then now that we have a discussion going. If you're not responsible then I apologize.
In my internet settings the IP assignment is set to Automatic (DHCP).
I can log in just fine once a month but every time I have to do it both from the PC and mobile. Enter credentials, send a code to email, go to email, get the code, write the code here....bleh. I'll try the app thing. Not like I have a million of them installed already. I don't need more.

 

[Crispy]

If you're not responsible then I apologize.

I accept your apology (now go get your fuckin' shinebox).

In my internet settings the IP assignment is set to Automatic (DHCP).

This is how it's supposed to be. This is your personal, "internal" IP, which is irrelevent when it comes to the outside world. Your actual IP address is the one that your ISP provides, and is what we (the outside world) see(s).

What I meant by potentially calling your ISP is not to change your IP address, it's just the curiousity as to why it seems to be changing. A dynamic (frequently changing, or rotating) IP address isn't all that uncommon, such as with very large ISPs like Comcast who serve millions of customers, but you appear to be on a static IP, which normally doesn't change. Do you understand?

It is possible, although unlikely, based on the country in which you happen to live, that on our end, we might have blocked part of the range of IP addresses that your ISP is providing. That's why I tagged Twiglard to check. It's a long shot, but worth confirming, especially considering how hard you're complaining.

 

[Peachcurl]

I thought IP doesn't matter, only device (cookies) matter?

2FA can be a more lax system requiring other-than-IP confirmation, yes, but it's then obviously quite a bit easier to defeat. Because of the malicious actions that someone has recently perpetuated against our database (causing frequent freezing, massive threads to freak out, etc.) we've had to rely on a stringent (IP-based) check.

Are you sure? Because I'm using a VPN and have no issue so far. Had to enter the code once, after the ordinary 30 days.

 

[Rean]

I also thought it was cookie-based.

 

[Crispy]

It's actually both. For trusted IP ranges/regions it's cookie-based. But I believe for certain... questionable regions we can block entire ranges. Child of Malkav might be within one of those regions.