4 ms·
You should implement automatic unlocking of the account if the auth attempt is successful and comes from the "usual" country (or from the same "usual" IP).
by mrb 14y ago
You should implement automatic unlocking of the account if the auth attempt is successful and comes from the "usual" country (or from the same "usual" IP).
- Negitivefrags 14y agoWe talked about this for a while and decided that, at least at first, we want to lock out the original owner. The reasoning behind this was that their actual password is compromised. We want to make sure that the user understands this fact and changes their password. Not only on our service, but on all the others that they may be using the same password for as well. The email does say that someone else has your password, but if you can just ignore the email then most will not actually get it or assume it's some kind of phishing email.