User Accounts password expiry/force changes

[MØ®®ØW‡ÑЙ]

Functionality to be able to make time limits for expiry of passwords for user accounts [your password is about to expire in <amount of days> please change] user is able to retrieve their password and create a new one this will limit amount of user passwords being *coughs* hacked! or misused. Timelimit variable dependant on whatever hub owner sets to min:30days - max:365days, possibly ability to /force complexity passwords also.

[LadyStardust]

I guess a few hubowners would like it
But what about password expiring when user is offline or away from a keyboard? And after account/password will expire he will be dropped from a hub and come back with no account or in this case won't be able to login on his nick hub at all...

[TraN]

I think that could be done using the allready existing account expiration date, and a simple check box "Warn before expiring" or something, and when the chosen expiration date is getting close, the user will get a pm on login to change password... when that is done, time could be added to the expiration date... well, maybe im totally wrong, just an idea

[MØ®®ØW‡ÑЙ]

A notification could possibly still be left on the user account and during the login process enter* old password *enter* new password could take place or in that instance if the person forgot the old password maybe have a "useful hint" sent to client like when joining sites etc or net accounts? maybe is possible!

[FlipFlop™]

Nice idea!

Currently the expiration date is used to be able to create a temporary account, but that's probably less useful than the option for expiring passwords. It could be used for password expiration instead, and without notification, will result in a blocked account anyway

I think the easiest and most userfriendly version would be to just allow the user to enter with old pass, but spam him in mainchat to use +password <blabla> to change his pass once expiration date is close. No hard expiration that way, but nagging might work, this is useful for high profiles only anyway i think.

Btw: sending hints to a user who has forgotten his pass is just dangerous imho, makes it easier to guess a password when attempting to hack an account.

Edit: Making it a hard expiration should be possible, so a hubowner can enforce the passchange and keep security 'up to date'.