SSO login general chat thread

[stebbins2]

Of course I'm always as cautious as possible. Are you aware of anyones SSO account being hacked?

There would be no way for me to know of such an event unless it were publicly announced or I had some personal contact with the unfortunate individual.

[d0p3y2k4]

All users, please note:

• When you login the first time using Ubuntu One, your forum account is associated with your Ubuntu OpenID account. Subsequent changes to details in your Ubuntu One account will have no effect on your forum account - they will remain associated.

well that must be a bug. because it now says i am new user when i joined long time ago & my name was -jay- when i used the same email to log into

[coffeecat]

well that must be a bug. because it now says i am new user when i joined long time ago & my name was -jay- when i used the same email to log into

It is not a bug and the part you quoted is correct. The -jay- account has a different registered email address from the preferred email you had set in your Ubuntu One account. That is why the system made a new account for you.

Please post in the Resolution Centre and an admin will deal with this and sort you out. It is quite impossible to give individual attention in a long thread like this.

@everyone, if you need your account sorting out, please post in the Resolution Centre. If you want to chatter please find somewhere else. This thread was intended for people to pose general questions so that we could refine the OP. There is too much background noise in this thread for it be useful as it stands. Tomorrow I shall prune out all the off-topic chatter and individual requests.

[imnichol]

So do I need to change my password now that my forums account is linked with SSO?

[rattskjelke]

I never had a Ubuntu One account until I had to create one the other day to get back on the forums.
The way I understand it, your Ubuntu One account is used to log into the forums.
If you go to your forum profile settings there is still a place where you can change your email and password.
Does that do anything now since you log in with Ubuntu One? What happens if you try to change your email or password there?

[FWIW]

It goes without saying that you should just never ever do this.

If you think that any of your passwords is strong enough to survive MD5 brute forcing then you can take a punt and not change that password.

But you see, there's the rub. A different password for each and every on-line service is quite unmanageable. I know there are password handling tools available and so on, but that means you are tied to that password handler and cannot use some other computer to access anything unless you also know the passwords that are managed. So I use a selection of different passwords across my on-line services. The key thing here is my previous and only use of this forum was so long ago that I may well have used a different password (that I commonly used for other similar forums etc at that time) or I may not. I simply have no memory.

The big issue is that across all my current on-line stuff, I have to change all my passwords regardless of what they currently are, because I have no way of knowing which may be the same as my old ubuntuforums password. OK, there are a few that I won't have to change because they are definitely different, but you get the idea.

[Yellow Pasque]

Now the very down-to-earth and practical question: in the former life of Ubuntu forum, I could have a bookmark on http://ubuntuforums.org/usercp.php and the userid and password kept by Firefox so checking out new stuff on UF was a one click operation. Now it takes me through several pages and leaves me in UF home. So what can I do to get back to the original?

Yeah, that's my biggest complaint. I have to go through multiple pages to log in every time, when I used to be able to go directly to my subscriptions. I kind of doubt we'll get back to the fast login...

[cariboo]

Your browser still saves your SSO details, so it's just a matter of clicking the log in button, waiting for it to continue to the SSO login page, and your done, if I remember correctly, probably 3 clicks.

The reason we went to SSO login, is that the vBulletin way of storing passwords was totally inadequate, Canonical IS is actually working with the vBulletin team to hopefully fix the problem, so what happened to us, doesn't happen on other vBulletin forums

[Quepali]

Ehm... What was the password I was using on the old login, then? I have several passwords that I am reusing on different sites, and I am not 100% sure which one i used here. If I change all my passwords I am risking changing it to the one that I had here... Suggestions on how to handle this situation?

[coffeecat]

So do I need to change my password now that my forums account is linked with SSO?

I never had a Ubuntu One account until I had to create one the other day to get back on the forums.
The way I understand it, your Ubuntu One account is used to log into the forums.
If you go to your forum profile settings there is still a place where you can change your email and password.
Does that do anything now since you log in with Ubuntu One? What happens if you try to change your email or password there?

I'll add things to the OP to answer this when I prune this thread in a few hours, but in the meantime...

The forum (vbulletin) password is now an irrelevance. The only password you need to be concerned about as far as the forum is concerned is your Ubuntu One login password. All forum passwords were replaced by random ones shortly after the forum was taken down after the attack as a preliminary measure. The only reason the password fields are still visible in the change email option in the forum is that admins and moderators still need the ability to change their forum password for a legacy operation. This is being worked on by Canonical sysadmins and soon this too will become an irrelevance and hopefully then the reference to password can be removed from the change email page. In the meantime, sorry about the confusion the presence of password fields there creates.

As far as changing emails is concerned, I'll edit/amend the OP in due course to make this clearer:

Association between an Ubuntu One account and a forum account occurs as a one-time operation on first login when the openID login code finds a match for the Ubuntu One preferred email in the forum database. Or, if it does not find a match, then a new forum account is created. Once the association has been made, the two accounts are locked together and can only be disassociated by a forum admin. This means that once the two accounts are associated, you can change the email in either or both accounts and the association will stick. You can also change usernames in either and the association will still stick, although changing the username in the forum account can only be done by an admin and we place restrictions on this to prevent frivolous and repeated changes.