Apparently some folks want to know exactly what took place with me and the JREF. Gotta love the skeptics. Well, here goes:
To: Lisa Simpson
From: Jim Carr
Lisa,
Are the admins messing with my account on the JREF Forums? So far today I have been logged out several times whereas I normally stay connected. When I tried to reconnect, my password was not accepted. I asked for a reset and was able to log in. I then got logged out again, and logged by back in with the reset password. I then manually changed my password back to what I had before. Again, I found myself logged out. Neither password works. I cannot ask for a reset because it now says my e-mail is unrecognized.
Regards,
Jim Carr
To: Jim Carr
From: Lisa Simpson
You asked for your account to be unregistered:
****************************************
Please inactivate/unregister (or whatever you call it) my account so that I have a status of Guest without posting privileges.
Thank you.
Jim
****************************************
If you want I will reset your account with this email address.
To: Lisa Simpson
From: Jim Carr
No, I did not. I asked for my account status to be set so that posting was disabled. I did not say for how long. I did not explain my reasons why nor was I asked why.
To: Lisa Simpson
From: Jim Carr
And why the change today? When you know I am on-line, why would you log me off and change my password without telling me? And then why would you change account e-mail address without telling me?
To: Jim Carr
From: Lisa Simpson
We did none of those things. We only did as you asked and set your account to unregistered. Again, if you wish for me to reset it, I will. If not, our conversation is over.
To: Lisa Simpson
From: Jim Carr
I am confused.
* Since you set my status to guest, I have been able to log in with a guest account, which is exactly what I requested. It has been like this for a couple of months.
* This morning I was logged out without requesting it and my old password as I remembered it didn't work.
* I requested a password reset. I received it at this e-mail address, which is the one I used to create the account.
* I was able to log in again. I set my password back to what I *thought* it was before.
* Once again I found myself logged out and unable to log in.
* When I request a password reset, it tells me that the e-mail address I enter is not found on the system even though it was there this morning.
So, either you guys did it or my account has been hacked. If it has been hacked, where do we go from here?
To: Lisa Simpson
From: Jim Carr
To be clear, I would like to be able to log in as guest again. Thank you.
Note: Lisa did not respond and did not contribute any further
To: [Using the forum software I filled out a form to inquire about my account status since Lisa didn't respond.]
From: Jim Carr
It appears my password was stolen and my e-mail address for my UncaYimmy account was changed to another address. Please set it back to [deleted] and send me a password reset. I would also like to know to what e-mail address it was changed and what IP address was doing the dirty work (if possible).
To: Jim Carr
From: Darat
Hi
I changed your email and password (the password is a random strong now and I do not know what it is). You had requested your account to be set to unregistered but were still using your account to report posts, and to be blunt I am not interested in seeing reports from non-Members.
Regards
Note: This is where Darat and I had a communication breakdown. I took this to mean that he had changed my e-mail back to [deleted] as I requested. I assumed that he told me about the password change to reassure me that nobody could be hacking my account. I took the last sentence to simply be an instruction not to report any more posts. It didn't occur to me that he would change my e-mail and password to prevent me from logging in simply because I reported four or five posts over a two month period. In my mind all he had to do was just tell me not to report any more posts. If this sounds unreasonable, remember that Lisa had just flat-out told me that nobody at the JREF had made those changes the day before. I figured Darat was making new changes at my request. As you can see below, I was still under the belief that something unkown had happened to my account.
To: Jeff Wagg, Lisa Simpson, Darat
From: Jim Carr
Account Security
As I tried to explain to Lisa and to Darat, my account appears to have either been hacked by an outsider or tampered with by the administration. Darat says that he has changed the e-mail address on my UncaYimmy account back to this e-mail, but I am still unable to request a password reset because the system cannot find this e-mail address. I am very concerned.
Even a "weak" password like the one I used has ~2.5M possible combinations ( 40^4 - letters, numbers, punctuation). Since the forum is set up to notify the user of 5 failed attempts within a 15 minute period, it is extremely unlikely that any brute force password breaking took place.
Could someone have learned this password by other means? It's possible but unlikely. First, I work from home, so I know that nobody else uses this computer, and I use no others. I use that weak password only on a couple of other forums. Those have not been tampered with. Besides, why would someone log into my JREF account that lacks posting privileges only to change my password? Then, after I reset the password, why would they then go back in later, change the password, and then change the e-mail account so that I cannot reset the password? It's highly unusual.
A more likely scenario yet certainly unproven based on what little information I have is that someone at the JREF has tampered with my account. I posted a rather scathing blog entry about the JREF Tuesday evening. Wednesday morning I find that my JREF account is no longer operating. Darat obviously has issues with me (see below) as does Lisa. I've had other moderators publicly call me "mean spirited" and "petty" among other terms. I had an appeal languish for 40 days despite requests for updates. A former moderator told me that highly unusual.
Both Lisa and Darat have refused to address this security issue other than a denial by Lisa that anyone at the JREF did it. I asked Lisa how to proceed to investigate this, but I was ignored. I asked for information about the IP address used to access my account and for the e-mail address to which my account settings were changed. That, too, was ignored.
I am appalled at this kind of treatment. The JREF should work with me to try figure out what has happened. Did Darat type my e-mail address incorrectly or was my account altered again? Has anyone else experienced a similar problem lately? Are there logs that can give a clue as to who did this such as the IP address of the machine that made the change? What e-mail was used for password resets? Is there a bug? A corrupted record?
Membership
To the best of my knowledge I am a member in good standing. I asked that my account status be set to guest so that posting was disabled. I only referred to inactivating or unregistering as "or whatever you call it" with the emphasis being on my stated intention of just disabling posting privileges. I did not give a reason for doing so nor did I give a duration. I did not make any public "farewell" post. I simply asked that posting privileges be disabled and did so quietly.
If the JREF wants to ban me, then so be it. If asking that posting privileges be disabled for an indeterminate amount of time is tantamount to revoking my membership, I was not aware of that.
Reporting Posts
I don't understand why Darat does not want me to report posts. Members have been told repeatedly that reporting posts, when not done abusively, is requested and desired by the moderators because they cannot possibly read every post. It is then up to the mods to take some action, if any, in regards to that post. By my estimate at least 85% of the posts I report receive some sort of action and at most I make one report a week. I don't see how that can be considered abusive.
Therefore, if this is some personal issue Darat has with me, that's his problem. If the policy is that those with a Guest status cannot report posts, then perhaps you should set up the software accordingly. Other than that I am at a loss as to why I would be told not to report posts.
To: Jim Carr
From: Jeff Wagg
cc: Lisa Simpson, Darat
Jim,
You requested that your account be unregistered. This is the equivalent of closing your account. You should not be able to expect to login to an unregistered account. No one has hacked your account. No one is playing games with you. Please stop with the theories. Your paranoia is serving no one.
Please express, clearly, what your wishes are. Do you want to have an account at the JREF or not? If you do, we will make your account work. If you don't, please agree to stop using said account.
Let us know,
Jeff Wagg
To: Jeff Wagg
From: Jim Carr
cc: Lisa Simpson, Darat
I have been able to log in to my account with guest status (no posting privileges) for the last two months with NO PROBLEMS WHATSOEVER. I have logged in every day. As Darat has noted, I have reported posts as UncaYimmy, which is only possible if I am logged in. Clearly this FACT is not in dispute.
Something changed, most notably my password, which prevented me from logging in yesterday. I used the built-in system to request a password reset by submitting the e-mail address I used to create the account. I was then able to log back into the system with Guest privileges.
I then changed my password *back* to my old password. When I tried to log back into the system later that day, it once again failed to recognize my password (or the reset password). So I requested a SECOND password reset. This time it told me that my e-mail address was unrecognized. Are you following me? The e-mail address was recognized just a few hours earlier, and then it wasn't. I didn't change it.
Now Darat tells me that he has changed my account settings. He reset my password to one unknown by him. He also said he changed the e-mail address back to [deleted] so that I could request a password reset. When I ask the system for a reset, it once again tells me that this e-mail address is unrecognized. Has anyone checked to see if the e-mail address was entered properly? If it wasn't changed, then whoever is using my account can request a password reset.
As far as I can tell, none of this is related to my account status being Guest unless the software was changed twice in one day. If you believe it is related to my status, then please set it back to an active member. I will then attempt to request a password reset. If that fails, we can go from there.
To: Jim Carr
From: Darat
cc: Jeff Wagg, Lisa Simpson
And just to add - I thought my email response made it very clear that I had changed both your email address and your password, and I gave you reason why I did so.
To: Darat
From: Jim Carr
cc: Lisa Simpson, Jeff Wagg
Oh, I see. Sorry, that wasn't clear. I assumed that you changed my e-mail address back to [deleted] so that I could request a password reset. Lisa Simpson said, "we did none of those things" in response to my e-mail asking if the admins changed my password and e-mail without the courtesy of telling me so. So, Mr. Wagg, it appears that my paranoia is not unfounded, is it?
In your e-mail, Darat, I thought you were telling me not to report posts. After all, that's the courteous thing to do - you had never said this was a problem before, and it's not the first post I reported since changing my account status. I am stunned that you would take these actions without the courtesy of telling me what you were doing.
To: Jim Carr
From: Jeff Wagg
cc: Lisa Simpson, Darat
There is no such thing as a "guest" status account. The logins were a result of cookies and nothing more.
Do you want an account or not?
To: Jeff Wagg
From: Jim Carr
cc: Lisa Simpson, Darat
Go look at my account information. It says Guest. When logged in as a Guest, I was able to report posts and use the ignore feature (among others). If there was no such thing as a Guest account and it was only cookies, why did Darat need to change my password and my e-mail address? Why did the Reset Password feature work? No, Jeff, I was clearly logged in.
What I requested was that posting privileges be suspended. Nowhere was I told that I would not be allowed to log in nor did I ever see that mentioned in Forum Management when others have done it. Clearly the admins knew what would happen if they changed my status. They could have changed my password or e-mail at that point, but they did not. I was allowed to log in for two months. I reported posts during this time, so it was not a secret.
Darat did not like that I was reporting posts even though the vast majority I reported as Guest were actioned by the moderators. He never said anything to me. He simply changed my password without telling me knowing full well I had been logging in. He apparently didn't tell Lisa Simpson, because she said that the admins had not touched my account.
If you are not changing your policy and telling me that my choices are either I cannot log in at all or that I must have a full membership, then I respectfully request the latter.
To: Jim Carr
From: Darat
cc: Lisa Simpson, Jeff Wagg
I did not say that I had changed your email address back to [deleted], and I have not done so.
To: Darat
From: Jim Carr
cc: Jeff Wagg, Lisa Simpson
I wrote, "Please set it back to [deleted] and send me a password reset."
You responded that you changed my e-mail address and set the password to a strong one that even you didn't know. Since I was clearly operating under the assumption that someone had illicit access to my account because Lisa Simpson told me that the admins hadn't touched it, I naturally assumed you had changed the password to prevent further illicit access and changed the e-mail back to what it should be. By saying that even you did not know the password, that reinforced that the admins were not involved. I figured I could then use the normal procedure of requesting a password reset like I had done earlier that day.
How was I to know that suddenly after two months you decided to block my access without telling me, and screwed up doing so by allowing me to reset my password?
To: Jim Carr
From: Jeff Wagg
cc: Lisa Simpson, Darat
One last chance.. no whining.. no theories..
Do you want an account or not? Yes or no.
Jeff
To: Jeff Wagg
From: Jim Carr
cc: Lisa Simpson, Darat
I told you *exactly* what I wanted in my e-mail quoted below. There is no "theory" here. It appears Darat did not copy you when when he told Lisa and myself that he was the one who changed my password and then my e-mail address after I requested a password reset. He also told me why when he wrote, "to be blunt I am not interested in seeing reports from non-Members."
To: Jim Carr
From: Jeff Wagg
cc: Lisa Simpson, Darat
Ok, no account for you then.
Darat or Lisa, please permanently disable the account.
Thanks,
Jeff
To: Jeff Wagg
From: Jim Carr
cc: Lisa Simpson, Darat
I trust, then, that you will set my status to banned. Or is there no "banned" status like there's no "guest" status? It's just cookies, right, Jeff?
You guys made so many mistakes in how you handled this it's actually kind of funny. Hell, Jeff cannot even understand a simple statement like when I said that if "my choices are either I cannot log in at all or that I must have a full membership, then I respectfully request the latter." Yeh, I know, Jeff, the reality is that you didn't read it. You were too pissed off and wanted to assert your manhood. Well, you certainly wounded me.