Account Lockout

[Knight Rider Info]

The MOD I am requesting would make it so, if a user gets their password incorrect a certain amount of times (amount set by any admin), that their account would be locked out for the security of the account, and they would have to contact an admin, to switch their account status to: unlocked, after having verified the account owner's identity

During my school years (Out of school now) there was a feature for all accounts that when you got your password wrong a certain amount of times, it would display a message saying your account is locked out and to contact an Administrator to reset your password or unlock it.

This MOD would have the option to reset the User's password or to just unlock it.
Similar to deactivation but the account would remain on the memberlist.php

[Giorgios]

Sort of how vBulletin works or MyBB?
I think this would be a good add, as this would enhance the security that phpBB has.

[Ooopsie]

It's a great idea KR. I'd like something like that but have it set to lock a person out for xxx hours or days.

I'm very cautious about changing passwords. The verification is tough TBH. A password hint would be nice.

Another option I am considering is User Self Delete.

There's also an option for FORGOT PASSWORD in PhpBB3. That's more realistic to me as it emails to the last email address on file.

I'm sure Tumba has some ideas too.

[tumba25]

after having verified the account owner's identity

How should that be verified? You would have to verify the account owners identity when they register the first time to know that they are the user that want access to that account.

A password hint would be nice.

Yeah, something like "What was the name of your grandmothers sisters husbands mothers cat?" Although the user should be able to set the question and answer.

Another option I am considering is User Self Delete.

Many users get upset and want their accounts deleted just to come back a few days later. Maybe an option to mark the account for deletion and then either delete it through some cron script or manually by admin a few days after it was set to be deleted.

I'm sure Tumba has some ideas too.

The idea box is totally empty. I think the cat are stealing them.

[Ooopsie]

You're too funny Tumba.

BTW, there is a MOD called User Self Delete over at .com.

[tumba25]

BTW, there is a MOD called User Self Delete over at .com.

There is? Do you have a link to it?

[Ooopsie]

It's an RC and I have not tested it out. . I see no complaints though. Only two pages of notes.

https://www.phpbb.com/community/viewtop ... elf+delete

[tumba25]

That thing seems abandoned. But could be a great starting point.

[Knight Rider Info]

The verify identity part, would involve them emailing the forum's email address, and supplying certain info, about the account.

Such as the username, email address on the account, and D.O.B. registered with the account, and anything else the Admins deem necessary

But, it would be nice to have a MOD that does this, to prevent almost unlimited attempts at the User's Password.
Though the Captcha appears after a while, of getting the Password wrong.
The MOD, should lock out the account, after 3 wrong password attempts, with the CAPTCHA being present.