Forum: Site Announcements

Login System Upcoming Changes

Lazeez Jiddan (Webmaster)

The current log in system dates back to 2012. It's not truly a unified system, but kind of like an ID database used to sync log-ins across sites. There are five sites that use this syncing system currently. Storiesonline, Finestories, Scifistories, Clitorides and Bookapy.

With the addition of Bookapy, the deficiency of the design is starting to show painfully. So before proceeding with other parts of the publishing system, I need to deal with this issue before anything else. Since Bookapy's addition, dealing with people's log in issues started taking an inordinate amount of my time.

So, I'm working on a true unified log in system for all the sites. There will be one log in page to enter your email and password. It will be at id.wlpc.com. You click 'Log In' at any of the sites and you're forwarded to the log in page where you enter your credentials and you're returned to the originating site/page. That page will also handle email and password changes.

Each site will still have its own user database for activity and preferences, but no longer a password field. One password per email address on all the sites.

Password changes will affect all the sites correctly. Email address changes too. The main benefit is that you or your browser will have to remember one password for all the sites. So you won't have your browser enter a different password for Finestories if you made the change through SOL for example.

And while making this significant change, I will be implementing optional Two Factor Authentication, however for now, it will be fairly basic and it won't use third party services. But it will be way more secure than just email/password combination. The system will have security questions and code by email.

Additionally, so that people don't forget their password, the system's 'remember me' setting will only last two weeks. You'll have to log in at least once every two weeks.

This is first announcement for everybody to know what's coming. The move to the new system will cause issues for some as there are conflicts in various sites user databases, which is exactly the reason for this move.

Any questions, concerns, suggestions, log in feature requests, I'm all ears.

Replies: Ernest Bywater

Ernest Bywater 🚫

@Lazeez Jiddan (Webmaster)

Once the new log in system is bedded down fully will there continue to be an opportunity to opt out of the 2 factor process for us Luddites suffering from Can't Remember Stuff?

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@Ernest Bywater

Due various considerations, including the demographics of the user base for our sites, Two Factor Authentication (2FA) will be opt in, not opt-out.

Having your security questions set up will help in case you forget your password and you lose access to your email like so many people do. You create the questions and the answers, no shitty preset questions. This will be like a second username/password combination, doubling the log in security.

Also, for the 'code via email' 2FA you don't need to remember anything. Just turn it on and when you log in, you enter your email address, then password and the system emails you a code and asks you for it, check your email for the code and enter it in the form. No memory required.

In the future, I'll probably implement third party hardware/software support for 2FA for additional options.

2FA is most important to authors selling through Bookapy as there is money involved and hackers motivated.

Ernest Bywater 🚫

That sounds OK to me.

I have no problem with a 2FA system for password or ID changes, as that's a common thing today. However, I don't like 2FA for most site access log ins.

There's a site I have to go to that uses 2FA with security question every time you log in. However, they have 5 questions and answers and only ask 2 of them chosen at random, and they also won't allow you to have the same answer for any 2 questions. The only way I can keep track of that damn system is to write all five questions and answers on a piece of paper I keep near the computer to be able to log in.

A lot of sites now use that 3rd party system where you click on pictures with a particular item in the image. The issue I have with that is I have to turn off some of my security settings to allow that to work, which is why I don't like it. However, I can understand why sites involving money need and use something like it.

Replies: Keet Switch Blayde Dominions Son

Keet 🚫

@Ernest Bywater

The issue I have with that is I have to turn off some of my security settings to allow that to work, which is why I don't like it.

Exactly the problem I have with third party systems. They are all in the disgusting data mining business, no privacy left. The best option is a self hosted option even if that's a third party (open source) library. Not even talking about the stupid people that rely on a fuckbook login.

Replies: Dominions Son

Dominions Son 🚫

@Keet

Exactly the problem I have with third party systems. They are all in the disgusting data mining business, no privacy left.

Those are captchas to block robots, not 2FA.

I work in IT. I have to deal with 2FA all the time for remote access to employer and client computer networks.

There are three separate setups I've worked with for 2FA.

RSA hard token.

This is a key fob that generates a 6 digit number every x seconds. Authentication is UID, regular password, fob number + a fixed pin. all entered on one login screen.

RSA soft token.

Uses a smartphone app. Enter pin on app and get an 8 digit number ever x seconds. Authentication is UID, regular password, RSA number. All entered on one login screen.

code by text message.

I log in to system with UID and Password. Employer/Client network sends a text message to my phone and I get a second dialog box where I have to enter the code from the text message + a fixed pin.

Microsoft authenticator

Client I am currently working with just recently switched from RSA, to Microsoft authenticator.

Microsoft authenticator is a smartphone app. I log in to the Client system with UID and Password. The client network sends a ping to the authenticator app on my phone and I have to enter a pin on the phone then it sends an authentication signal back to the client network.

What do all these methods of 2FA have in common? There is no man in the middle to do any sort of data collection/tracking.

Replies: Ernest Bywater Keet

Ernest Bywater 🚫

@Dominions Son

code by text message.

I log in to system with UID and Password. Employer/Client network sends a text message to my phone and I get a second dialog box where I have to enter the code from the text message + a fixed pin.

The biggest problem with that is us Luddites can't work 2 screens on the mobile devices at once so we can't get it from the email to the log on in a timely manner.

Replies: Dominions Son

Dominions Son 🚫

@Ernest Bywater

The biggest problem with that is us Luddites can't work 2 screens on the mobile devices

Yeah, mobile only access with 2FA is going to be an issue short of using something more like Microsoft Authenticator.

Keet 🚫

@Dominions Son

What do all these methods of 2FA have in common? There is no man in the middle to do any sort of data collection/tracking.

I'm surprised that you are so trusting towards just any authenticator, being in IT as you stated. I'm in IT for over 35 years now and have learned to trust no one until proven to being (somewhat) trustworthy; very few are.
I was referring more to types like using the facebook login for authentication. I can assure you facebook WILL log anything they can get away with, including WHERE you login. A trustworthy authenticator is open source and will do as you described with nothing to collect. None of the closed source authenticators can be trusted on face value. If you've been innocently on the wrong side once you come to understand what all can be used against you to twist reality. Ask Ernest. It's been a long, long time ago that happened to me but since then I'm up to the point of paranoia in keeping things private.
By-the-way, you are correct that capcha is not 2FA but like Ernest stated it's often used to force a login with name and password giving the user the illusion that it's 2FA.

Replies: Dominions Son Dominions Son

Dominions Son 🚫

@Keet

I'm surprised that you are so trusting towards just any authenticator, being in IT as you stated. I'm in IT for over 35 years now and have learned to trust no one until proven to being (somewhat) trustworthy; very few are.

Who says I trust just any authenticator? With the first three methods I mentioned, there simply is no middle man authenticator that needs to be trusted.

With the third, Microsoft Authenticator:

The client using this is a utility company and the largest nuclear operator in the US. They take cyber security seriously. A man in the middle capable of logging or tracking anything could compromise their network security.

Do I trust Microsoft? No. I trust that the client's IT secruity group has vetted the Microsoft Authenticator app against the possibility of any such threat.

Replies: bk69

bk69 🚫

@Dominions Son

With the first three methods I mentioned, there simply is no middle man authenticator that needs to be trusted.

Bullshit.

RSA soft token... unless you've looked at that smartphone app's source code (or you know exactly what information the site you're logging into sends to verify the code you entered from the app) you really shouldn't be trusting. Unless that app is specifically from the site you log into, which would mean having apps for every single site you use 2FA for, which is insane unless you only use 2FA for less than five sites total.

Replies: Dominions Son

Dominions Son 🚫
Updated:

@bk69

RSA soft token... unless you've looked at that smartphone app's source code (or you know exactly what information the site you're logging into sends to verify the code you entered from the app) you really shouldn't be trusting.

I haven't, but I trust that corporate IT security has.

RSA is used by corporate networks for 2fA for remote log in. If it had a major security flaw or a way of collecting info on users it would have come out a long time ago and they would go out of business because companies would stop using it in a heartbeat.

You can get hard tokens for RSA. The hard token is just a simple device that has an LCD screen to display a six digit number and generates a new number every so many seconds. The hard token has no communications with anything.

I would think the app works in the same way as the hard token, which can't send anything to anyone. It's just a seeded random number generator that produces a 6 digit number every x seconds. The site you use it to log into has it's own random number generator using the same seed to verify against. each token has a unique seed.

Dominions Son 🚫

@Keet

I was referring more to types like using the facebook login for authentication.

That is one of many (very foolish) attempts to create a single universal log in, not two factor authentication. No one serious about security would use it.

By-the-way, you are correct that capcha is not 2FA but like Ernest stated it's often used to force a login with name and password giving the user the illusion that it's 2FA.

Only for users who have never dealt with real 2FA and don't understand what it is or users who are complete idiots.

Replies: Keet

Keet 🚫

@Dominions Son

Only for users who have never dealt with real 2FA and don't understand what it is or users who are complete idiots.

You'd be surprised how many users that are, especially the idiots which I'd rather call computer illiterates.

To make it clear for all: most users either don't know the difference between 2FA, normal logins, authenticators, capcha's etc or they don't recognize/understand the difference. Only when it's explicitly presented as 2FA they know it. And the only thing they will know is that 'it's safer' because that's what is told in the media. That is also why I mentioned the facebook login, it offers 2FA authentication and thus is misinterpreted as "safer".

Replies: Dominions Son bk69

Dominions Son 🚫

@Keet

That is also why I mentioned the facebook login, it offers 2FA authentication

Only if you have to use a regular login and the Facebook login together, which I've never seen done. And you are the first person I've ever heard call it 2FA.

Replies: Keet

Keet 🚫

@Dominions Son

Only if you have to use a regular login and the Facebook login together, which I've never seen done. And you are the first person I've ever heard call it 2FA.

Using regular login AND facebook login? That seems very strange because it's twice logging in. 2FA is a well known shortcut for Two-Factor-Authentication.

Replies: Dominions Son bk69

Dominions Son 🚫

@Keet

2FA is a well known shortcut for Two-Factor-Authentication.

Yes, it is. And using a Facebook login as a substitute for a local site login in no way resembles anything that can be rationally called two-factor-authentication. Where is the second factor?

Replies: Keet

Keet 🚫

@Dominions Son

Yes, it is. And using a Facebook login as a substitute for a local site login in no way resembles anything that can be rationally called two-factor-authentication. Where is the second factor?

I never said that using a facebook login is a substitute for 2FA, of course it's not. What I said was that facebook has (optional) 2FA with it's login. Some sites use the facebook login so they don't have to implement 2FA for their own login but can use the facebook login with 2FA. Come to think of it, that might explain the double login you mentioned. Instead of replacing their login they just added the facebook login for the added 2FA.

Replies: Dominions Son

Dominions Son 🚫

@Keet

What I said was that facebook has (optional) 2FA with it's login.

Ah. I was not aware that Facebook was doing an optional 2FA login.

bk69 🚫

@Keet

Using regular login AND facebook login? That seems very strange because it's twice logging in.

Yeah. And? All 2FA systems require using multiple 'passcodes' to log in (userid/password combo, plus query/challenge or secondary access code) so you're basically logging in twice (although only entering a userid once, so I could see using crackbook login, then asking for your site password as being a valid form of 2FA).

bk69 🚫

@Keet

You'd be surprised how many users that are, especially the idiots which I'd rather call

crackbook addicts

Switch Blayde 🚫
Updated:

@Ernest Bywater

3rd party system where you click on pictures with a particular item in the image.

Many times my wife and I stare at the pictures confused and ask each other, "Is that a…?" and often choose wrongly.

Dominions Son 🚫

@Ernest Bywater

A lot of sites now use that 3rd party system where you click on pictures with a particular item in the image. The issue I have with that is I have to turn off some of my security settings to allow that to work

You're talking about a captcha, which is about blocking robots, NOT 2 factor authentication of the user.

Replies: Ernest Bywater

Ernest Bywater 🚫

@Dominions Son

You're talking about a captcha, which is about blocking robots, NOT 2 factor authentication of the user.

except many sites use them as 2FA anyway.

Replies: Dominions Son

Dominions Son 🚫

@Ernest Bywater

except many sites use them as 2FA anyway.

No they don't. They use them to make use they have a live user not a robot, they do absolutely nothing to help verify that a specific user is the right user. 2FA is all about identifying a specific user.

Replies: Ernest Bywater

Ernest Bywater 🚫
Updated:

@Dominions Son

No they don't. They use them to make use they have a live user not a robot,

Many sites do as you say, but some also use it as a further ID. Where you access a site where you can call the ID and password from the browser file I can see using Crapcha as an anti-bot thing if there is something there worth protecting from bots. However, some sites use a log on script to create a window where you must enter the ID and password from the keyboard and not call it from a file so a bot can't get through that part, then they throw in the Crapcha before letting you can go from the log on page.

edit to add: they may not be using the Crapcha as it was intended, but they are using it as a further verification process of the ID.

Replies: Dominions Son

Dominions Son 🚫
Updated:

@Ernest Bywater

but they are using it as a further verification process of the ID.

No they aren't, because the captcha is incapable of doing that. There is absolutely nothing a captcha can accomplish to add a second layer of verification that the person entering the user id and password is the correct person.

Replies: Ernest Bywater

Ernest Bywater 🚫

@Dominions Son

I didn't say Crapcha did or didn't add anything, only that they are using it as part of their verification process in a way that is a total waste of time. It matters not what Crapcha is designed to do or meant to do over 90% of the time it's a total waste of time and electrons and some sites use it as a verification process. You can say what you like, but it won't alter how they're using it.

Replies: Dominions Son

Dominions Son 🚫

@Ernest Bywater

You can say what you like, but it won't alter how they're using it.

You can say what you like, but no matter how they are using it in the verification process that doesn't make it a two factor autthentication.

Two factor authentication means something specific. Both factors have to be something that ties back to the specific user.

Dinsdale 🚫

This discussion is all very well and good - and one of Dominions Son's early contributions rather illuminating - but it has become increasingly divorced from the original announcement.
We need a posting mod-options "Mildly irrelevant" and "Totally fucking irrelevant". Not that they would not cause more problems than they solve.

Replies: Switch Blayde

Switch Blayde 🚫

@Dinsdale

We need a posting mod-options "Mildly irrelevant"

It may be irrelevant to the thread's topic, but I found it interesting.

GalTab 🚫

I hate capcha. I don't mind the random questions from a pool because my answers will always be the same. Please don't force me to log in too often, especially if it's just to increase my memory skills.You can send verification codes to my email address on file, but please don't require my phone number. I hate third party anything, you've never spammed me, but I bet if a third party becomes involved we'll all be getting new spam. You'd have to trust every current and future employee of the third party company. I already don't.

Replies: Dominions Son

Dominions Son 🚫

@GalTab

I hate third party anything, you've never spammed me, but I bet if a third party becomes involved we'll all be getting new spam.

What Lazeez talked about doing won't require anything third party other than a command line email program, something he already has to be using.

but please don't require my phone number.

I don't get why you seem to think this would be riskier than him having our email addresses.

Replies: Switch Blayde GalTab

Switch Blayde 🚫

@Dominions Son

I don't get why you seem to think this would be riskier than him having our email addresses.

Span emails are less intrusive than spam phone calls.

Replies: Dominions Son REP

Dominions Son 🚫

@Switch Blayde

Span emails are less intrusive than spam phone calls.

Has anyone ever gotten spam emails out of SOL having their email address?

Replies: Switch Blayde awnlee jawking

Switch Blayde 🚫

@Dominions Son

Has anyone ever gotten spam emails out of SOL having their email address?

The question wasn't whether he got spam from SOL. It was saying it would be worse with phone than email. You asked what the difference was. I answered that.

Replies: Dominions Son

Dominions Son 🚫

@Switch Blayde

You asked what the difference was.

I asked what the difference was between SOL having the email and having the phone #, not a general difference.

I answered that.

No, you didn't.

Replies: Not_a_ID

Not_a_ID 🚫

@Dominions Son

I asked what the difference was between SOL having the email and having the phone #, not a general difference.

SO probably checks their phone from time to time, and they don't want to explain the authentication # text messages.

Replies: bk69

bk69 🚫

@Not_a_ID

ProTip: deleting message histories is a useful habit if you have a SO who snoops through your phone

awnlee jawking 🚫

@Dominions Son

Has anyone ever gotten spam emails out of SOL having their email address?

Yes, before the site's new messaging system.

AJ

REP 🚫

@Switch Blayde

Span emails are less intrusive than spam phone calls.

Spammers don't need your phone number to call you. They use robo calling and block dialing.

GalTab 🚫

@Dominions Son

Do you really not know why? No offense, but i'm not explaining a request I made to someone else. He can ask me why if he truly doesn't know why.

shutterbug 🚫
Updated:

Laz: From a standpoint of maintenance, Yea the single Sign-in makes sense for the stories sites but for the BookAppy, keep it seperate due to merchant needs.

I've always suffered from CRS syndrome, so have used a PW manager for 20+ years and for critical (Merchant/Recovery email) I've used as complex a pw as possible. For sites like SoL/FineStories and such, not so strong since I wont be bothered by them being hacked/compromised.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@shutterbug

Since you rely on a password manager, then the difference between story sites (sol, fs, etc...) and Bookapy is irrelevant. Currently they should have the same log in through the syncing system and it's a weaker system.

I'm not about to split Bookapy from the common log in page.

I'm adding the 2FA stuff and extra security because of Bookapy and the benefits cascade to the other sites.

There is no drawback to having the same stuff on all sites. All the big online services do that (Google, Microsoft, etc...)

Michael Loucks 🚫
Updated:

My two cents - I would strongly prefer Time-Based One-Time Passwords (TB-OTP) 2FA using a standard authenticator. That's pretty much impossible to spoof or defeat, unlike security questions or text message/email codes. My password manager has that built-in and it syncs between all my devices.

Lazeez Jiddan (Webmaster)
Updated:

A preliminary beta of the new log in system is now online.

Give it a whirl and let me know if something doesn't work as it should or doesn't make sense.

it only works with SOL, FS and SFS. Doesn't work with Bookapy nor the clitorides site yet.

try it here:

https://storiesonline.net/sol-secure/user/login.php

🤞

Replies: Ernest Bywater

Ernest Bywater 🚫

@Lazeez Jiddan (Webmaster)

I just tried to use the link given and it wouldn't log me into anything, so I tried the create an account option. While it said it would send me an email, at no point did it ask me for a password. It just seems to sit there and do nothing. It doesn't even spin.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@Ernest Bywater

You should read what it says.

When you enter your email address for a new account, it checks if the email address exists. If it exists it asks you for a password, if not, then it sends you a code by email and asks you immediately for that code. If your address is valid, you should receive that code. Once you enter the code it allows you to proceed to the password selection.

I've fixed the looping problem with new accounts.

Please try again.

Replies: palamedes

palamedes 🚫

@Lazeez Jiddan (Webmaster)

I tried to log on and received the code entered the code and the screen flashes and asks for the code check my email and their is a new email with a new code. Every time I try I just keep getting a new code and I have tried to even copy and paste the code sent.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@palamedes

I tried to log on and received the code entered the code and the screen flashes and asks for the code check my email and their is a new email with a new code. Every time I try I just keep getting a new code and I have tried to even copy and paste the code sent.

Were you trying a straight log in, or new account? were you trying to log in with the same email address as SOL?

palamedes 🚫

I tried the link given and tried to create an account and after about 30 seconds I received this

This page isn't workinglogin.wlpc.com is currently unable to handle this request.
HTTP ERROR 500

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@palamedes

Did you try with a valid email and one that you've never used on any of our sites?

Lazeez Jiddan (Webmaster)

Maybe I should have started with this link instead:

https://storiesonline.net/sol-secure/user/login.php

Click the above link to test with log in to storiesonline.

palamedes 🚫

I am using the same email that I use for SOL.

I tried to do a straight log in first with no luck under google chrome and every time I now go to to the link you gave I get the screen asking for the code.

I then closed chrome and tried with Edge and create an account.

Both browsers now open to the screen asking for the code and if you enter the sent code and new code appears in email.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@palamedes

Both browsers now open to the screen asking for the code and if you enter the sent code and new code appears in email.

What does the message on the screen say? Did you click 'Forgot password'?

I tried straight log in, tried reset password and tried new account and it all worked as expected. So it's a little puzzling if I don't know all the details.

Replies: palamedes

palamedes 🚫

@Lazeez Jiddan (Webmaster)

I did click forgot password because the password I used failed. I was able to log out and log back into Finestories with the same password that I tried and thought I forgot. Here is what appears on my screen when I go to https://login.wlpc.com/

WLPC log in System
Confirm Account
We emailed you a verification code. Please check your email.
Please enter the code from the email.

Code:
Go

Resend Code
Copyright© 1999-2020 World Literature Company

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@palamedes

WLPC log in System
Confirm Account
We emailed you a verification code. Please check your email.
Please enter the code from the email.

Code:
Go

Did you receive a code?

If you did, it didn't work? as in it didn't cause the system to ask you for a password pair?

Replies: palamedes

palamedes 🚫

@Lazeez Jiddan (Webmaster)

Sorry I failed to restate that .

Yes I received a code and when I enter the code by typing or copy paste the screen flashes and returns to asking for a code and there is a new code in my email.

I just looked at my email and there is mail with codes even though I'm not requesting them.

2 email time stamped 7:34pm, 6:55pm, 6:54pm, 3 emails 6:49pm, 6:48pm, 6:47pm, 6:15pm, 6:14pm

I've counted 26 emails

after entering the code it never asked for a password just keeps asking for the code sent to email and it seems I'm getting codes sent even when not requesting or having the web page loaded.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@palamedes

The multi-email thing happens if you double click the button instead of single click.

After much investigation, it turned out that your account is one of those that are the reason why I'm doing this.

You have have used the same email address at Scifi and SOL, and have the same internal unique ID, but on Finestories, it's a different unique ID.

Before I go ahead with the new system, I will sync all the storiesonline IDs data to the ID server and then push the ID server's data to the two other sites.

Few accounts will lose their SFS and FS libraries, but they're minimal. Less than 100 out of over half a million accounts.

It's good that you tried. I appreciate it, but your account is one of those that will have to wait until all is ready and I do the data clean up.

Replies: palamedes

palamedes 🚫

@Lazeez Jiddan (Webmaster)

OK Thank You. Sorry for adding to your grey hairs.

Keet 🚫

At https://login.wlpc.com I can enter my email address and when I click the arrow the page apparently submits the request but nothing else happens. The page remains the same displaying the email address I entered. I received no email.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@Keet

Were you trying to log in or To create a new account?

The form's text didn't change at all?

Replies: Keet

Keet 🚫
Updated:

@Lazeez Jiddan (Webmaster)

Trying to log in. The page didn't change after clicking the arrow but I saw at the bottom (Firefox) that something was submitted.
I realized I was already logged in on another tab so I tried again after first logging out and closing the other tab. The result remained the same. The entered email address stayed on the page after clicking the arrow and nothing else changed. I received no email.
ETA I tried both Firefox 52.8.0 on Debian 7 Wheezy and Firefox 68.12.0esr on Debian 9 Stretch. Same result on both.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)
Updated:

@Keet

Trying to log in. The page didn't change after clicking the arrow but I saw at the bottom (Firefox) that something was submitted.

That will teach me to develop my code and test it mostly using Safari. I had to fix all the forms in order to make them work on Firefox and Chrome.

They should work now. Please try again.

https://storiesonline.net/sol-secure/user/login.php

Also, if you try it and it works, let me know so that I would have an idea of how many tried.

Replies: bk69 Keet Ernest Bywater

bk69 🚫

@Lazeez Jiddan (Webmaster)

Yup. Works now.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@bk69

The difference in behaviour between Safari (the way it makes sense) and Firefox and Chrome (the way it doesn't make sense) was a puzzler.

Chrome and Firefox were behaving correctly according to html specs, but the specs don't make sense.

I'm using an image to submit, which is allowed by the specs, where you can use an image like a button, but the specs say that the image can't have a value so the form was being submitted without knowing what the user clicked.

Safari treated the picture like a button including it having a value.

Anyway, it seems to be working for more users now.

Replies: bk69

bk69 🚫

@Lazeez Jiddan (Webmaster)

Chrome and Firefox were behaving correctly according to html specs, but the specs don't make sense.

Ah. You missed the simplest explanation.

The specs were created by a committee.

Keet 🚫

@Lazeez Jiddan (Webmaster)

They should work now. Please try again.

https://storiesonline.net/sol-secure/user/login.php

Also, if you try it and it works, let me know so that I would have an idea of how many tried.

Not quite right yet:
1 - If you click in the empty email field the page blanks out.
2 - I pay for the proxy (anonymous) site. Clicking the link you provided redirects to the anonymous version, when already logged in and probably when not logged in but with a existing cookie. That page is unknown. That is expected for now but you might want to fix it so it goes to the correct site.
3 - I cleared all cookies etc and then tried logging in using login.wlpc.com to get a clean start. That works and it presents me with a page with account data and at the bottom I can choose which wlpc site I want to enter. Choosing StoriesOnline sents me to StoriesOnline.net but for me it should be the anonymous proxy site. Checking the subscription details should give you that information.

I didn't try the 2FA yet.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@Keet

1 - If you click in the empty email field the page blanks out.

Inadvertently left some test code that caused it. Fixed.

Ernest Bywater 🚫
Updated:

@Lazeez Jiddan (Webmaster)

I clicked on this link and got sent to

https://login.wlpc.com/?r=nHTfZtjnE21SCOIe%2FUQ5ZATHKS6mXVTPMw527Hrj%2FthX%2Bt1g7eKifwRBxtCMFeZZ3Sj%2FedKS0dXJtatVfXCugw%3D%3D

which had a screen with a window to enter an email. I clicked in the box to enter the email and got sent to this page

https://login.wlpc.com/index.php

which is totally blank

However, if I click the link and just start typing (which is counter intuitive) it takes the text and then handles it well to allow for the log in process.

Maybe there needs to be something to not accept 'left' clicking in the field as an instruction to process it.

edit to add: used Firefox 80.0.1 on Zorin 15.2 Linux

irvmull 🚫
Updated:

Same here.

Log in: Entered email, clicked, could see that something was sent (or received). No email arrived.

Create a new account: using an email unknown to SOL, agreed twice to the terms, again received no email at that account either.

(Firefox 68.0.1)

In both cases, there was no visible change to the input form, and the email addresses I typed in remained visible.

irvmull 🚫

OK. I entered my email addr, went to password screen, entered password - says "invalid", so I clicked "forgot password" and set up a new one along with requesting to receive code via email.

That works, code is emailed when I log in. I can visit SOL, Finestories or Scfistories from the menu.

palamedes 🚫

Lazeez Jiddan

I seen that you you said you made changes so On a whim I tried to complete the log on. After opening the https://login.wlpc.com a code appeared in my email in like two seconds (I didn't click or ask for a code) so I tried the code and it let me create a new password.

I'm now connected with a link to Finestories and SciFi Stories

I believe it is working for me now.

irvmull 🚫
Updated:

Random security questions also seem to work, and turning off two-factor works as well - just email and password to get in.

irvmull 🚫
Updated:

What doesn't work for me is trying to create a new account (using an email address unknown to SOL).

The first time I tried, it actually sent an activation code to the new email account, but putting that code in didn't create a new account, it just repeated "invalid account", and got into a loop of some sort where I couldn't go back to the start and try again.

Perhaps worse, it wouldn't let me log in under my original (real) email and password either, just keeps showing an "Account Not Found" (before anything is put into the email field)

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@irvmull

The first time I tried, it actually sent an activation code to the new email account, but putting that code in didn't create a new account, it just repeated "invalid account",

Unable to replicate. I'll have to wait for more data for this one.

and got into a loop of some sort where I couldn't go back to the start and try again.

Clicking the Circle X cancels the action and returns to the start.

irvmull 🚫
Updated:

Clicking the address entry field (if you don't hold down the button) shows a blank page. Holding down the left mouse button shows (on mine) email addresses recently used. Letting it paste automatically works, but it is awkward. Clicking isn't needed, since the email field is already selected, but it is just natural to try to click there anyway, and when you do, the page goes blank.

Trying to create a new account put things into an endless loop where I would always get "Account not found" before I even had a chance to enter any email address.

Removing cookies allows me to get back to the login screen and log in using my real address and password.

irvmull 🚫
Updated:

It appears that you can't have two accounts on the same computer (likely cookie related).

Here are the steps in order:

I visited SOL using the new login using my normal address and password. No problem. Signed out.

Tried to create another account using a different address and password - got activation code, pasted it in. Entered a new password (twice). Got "Account Not Found".

Ok, went back to https://login.wlpc.com/ to log into original account. Log in screen says "Account Not Found" even before I enter any email address.

So effectively, attempting to add a second account locks you out of both. Ouch!

Removing all WLPC cookies removes the "Account Not Found" banner and lets you enter an email for the original account but the password that Firefox "remembers" is the password for the second (invalid) account, so you have to enter the original password by hand in order to get logged in.

To summarize:

Problem 1 - 2 people can't use SOL with their own individual accounts on the same machine.

Problem 2 - trying to do so locks you out of SOL completely until you figure out how to delete the appropriate cookies.

Replies: Dinsdale Lazeez Jiddan (Webmaster)

Dinsdale 🚫
Updated:

@irvmull

Problem 1 - 2 people can't use SOL with their own individual accounts on the same machine.

No.

If they use two different user-accounts - or even two different browsers under the same account - all will be ok. I suspect people who have multiple SOL accounts (RWMoranUSMCRet is one of 17 belonging to one person) could be screwed but I'm not an author and don't know if there are workarounds for that.

Replies: irvmull

irvmull 🚫

@Dinsdale

Two different browsers would almost certainly solve the problem. As for using two different user accounts on the same browser, have you tried it?

Replies: Dinsdale

Dinsdale 🚫

@irvmull

I only have one account, problem solved.

Replies: irvmull

irvmull 🚫
Updated:

@Dinsdale

I only have one account, problem solved.

NA

Sorry, shooting my SO isn't practical right now.

For two people who want to keep their reading list, chapters viewed, etc. separate, Lazeez has, I think, solved the problem in a less violent way. Last test, everything worked, and Firefox managed to keep track of the two accounts and their respective passwords.

Well done!

Oops! I may have posted too soon.
After logging into my regular (Premier) account, I can see the SOL, Finestories, etc "buttons" at the bottom.

When logging in with the new (non-paid) account, there are no buttons and no way I can see to get to SOL, etc.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@irvmull

When logging in with the new (non-paid) account, there are no buttons and no way I can see to get to SOL, etc.

if it weren't for this test, nobody would go to login.wlpc.com directly to create an account.

If you click this link:

https://storiesonline.net/sol-secure/user/login.php

and log in with your new account, you'll end up back at SOL automatically and if you then go back to login.wlpc.com and log in, you'll find the SOL link there.

Lazeez Jiddan (Webmaster)

@irvmull

Problem 1 - 2 people can't use SOL with their own individual accounts on the same machine.

Not true. But you would have to do a proper log out. So far since this isn't working perfectly, there are issues with the data remaining where it isn't supposed to be.

Problem 2 - trying to do so locks you out of SOL completely until you figure out how to delete the appropriate cookies.

I added a cancel button on the email form, that would remove the error message.

The password form has the email address in it, so it's up to the browser really to update the password when logging in if it's changed. I don't know what else to do to make the browser's password manager trigger the update mechanism.

Reply to topic

Forum: Site Announcements

Login System Upcoming Changes

WARNING! ADULT CONTENT...