![[info]](https://www.insanejournal.com/img/userinfo.gif){kind=small}
Thank you all so much for supporting InsaneJournal, I hope you have found value in our summer sale. We will continue the sale through Sunday July 7th.
InsaneJournal Announcements
InsaneJournal Summer Sale Update
InsaneJournal Announcements
Powered by InsaneJournal
and idk if support was the right route to take this, but i also raised a support request suggesting that when email addresses are changed on an account, a confirmation/notification should absolutely be sent to the old account too for security's sake.
It's not just limited to Insanejournal as the sole concern, as togetherinparis points out; if access to our emails and at least one password used in conjunction with that email is stolen, there's a good chance the person or people doing this could be using the information they're getting to try to gain access to people's accounts on other sites as well, some of which may store things like credit card information and phone numbers.
I second limiting login attempts to three attempts per X amount of hours, and requiring more complex passwords for accounts. Security of users' information and accounts should be top priority.
We had 6 hours of down time. Was that you trying to address this? If so, better and more open communication is required here.
Additionally, many of the users on this site are paying customers. As a person who runs a website, I find it very hard to believe that advertising and Patreon aren't easily paying for the servers, hosting, and minimal upkeep on IJ.
All that to say, we're very literally paying you, Squeaky. Despite this, I have seen very little evidence from my interactions with you that you're willing to go even slightly out of your way to help us out. Support requests lay unanswered for months or even years, responses of any kind/on any platform are usually slow, and they are often vague or unhelpful, and the site has seen next to no updates in a decade. All of which is frustrating. However, your seeming lack of urgency and utter lack of communication regarding a serious threat to our privacy moves past frustrating to alarming.
I know you have a life and a job outside of this site and don't want to downplay that. However, the fact remains that as I said, we are paying you to do a job and doing our best to support you. Unfortunately, our user experience and security do not seem to be things on which you place a premium. That's a problem.
Perhaps it is time to consider adding to the administrative team so that these sorts of things can be dealt with more speed and communication in the future.
For instance, if my email was acoolname@gmail.com it would say a*******e@gmail.com; I know what my email name is and I know how many characters in it, so picking it out of a list to confirm sending the password email is pretty easy, but someone who doesn't own the account would have a harder time picking.
Most sites that limit login attempts to 3-5 will usually put a hold on further attempts for the next 1-3 hours, and honestly the few times I've just completely forgotten a password and that's happened to me I was fine with having to wait to try again with the right password.