Signing In

This page describes what the login form answers when it refuses an attempt, and why it sometimes stops answering altogether.

Why the error message never says what went wrong

Whatever the reason a sign in is refused, the form always answers the same thing:

Wrong username or password.

It says this when the password is wrong, when the username does not exist, and when the account has been deactivated. The message is deliberately the same in all three cases.

The reason is that the login page is open to anyone on the internet. If the form answered “this user does not exist” for some names and “wrong password” for others, anybody could type names into it until they found the ones that are real, and then concentrate on those. Keeping one answer means the form gives nothing away.

Note

If you are sure your password is right and you still cannot get in, your account may have been deactivated. Check the mailbox registered on your account: an email explaining the situation is sent there. See Deactivated accounts below.

Too many attempts

After 5 failed attempts on the same account from the same place, the form stops checking passwords for 15 minutes and answers:

Too many failed login attempts. Please wait 15 minutes and try again.

During those minutes the password is not verified at all, so entering the right one does not help — you simply have to wait. The count is forgotten as soon as you sign in successfully, and attempts older than 15 minutes stop counting on their own.

There is a second, wider limit: 20 failed attempts on the same account, no matter where they come from, lock it for the same 15 minutes. This one exists because the first limit can be worked around by an attacker changing their network address, which a real user never does.

Note

Nothing needs to be unlocked by hand. If a user is locked out and cannot wait, an administrator can send them a reset link from the admin page, which lets them set a new password immediately. See Permissions .

Deactivated accounts

When a subscription expires, the account attached to it is deactivated. Signing in with it is refused like any other failed attempt, and the page says nothing about it.

Instead, an email is sent to the address registered on the account, explaining that it is deactivated and how to have it switched back on. This happens only when the password entered was correct, so someone guessing at usernames cannot use the login form to send mail to other people.

The email is sent once per day at most. Trying again the same afternoon will not produce a second copy.

Note

If you receive this email and it was not you trying to sign in, somebody else knows your password. Change it anywhere else you use it and tell your administrator.