Forgotten password e-mail ?

I just received an automated message, from admin@littlegolem.net, sending me my login name and password, because the site received my request for it.

The problem is, I never requested such information. I KNOW my login name and password. (In fact, I rarely ever need to sign in. I almost never disconnect from the site.)

Glitch? Did anyone else receive a similar e-mail? Or did someone else request that information?

Just received the exact same e-mail... one minute later.

That seems to be an indication that someone tried to sign in as you. I have not received such an e-mail.

Which reminds me that a feature that I'd like to be added to littlegolem (or i should say fixed) is the use of https instead of http, especially at the Login and Edit user profile pages.

I've just received, too, the same mail as Ed...

I got the same message twice in a row too.

Yeah, i got that message too.

My list of games also changed to 2 lines pre gme insead of 1. I don't like it, take up way to much space. Harder to veiw them all. Happened about the same time as the e-mails. I wonder if they are related.

No such mail here, but I encountered an 'internal server error' and five minutes later I was back on, but the above mentioned changes had taken place.

@bill: do you have games against ypercube? that may be the cause of the two lines :)

btw, i didn't get the email

I do. The long name change did it, huh?

I received it also. LG isn't the most stable platform.

yes, bill, name column got wider, and hyphen in dates made them two-lined :)

btw, i fully agree with yper new name

I also got the e-mail, twice.

No such mail here, but I encountered an 'internal server error' and five minutes later I was back on, but the above mentioned changes had taken place.

hahaha, i've just received it :)

I received it for my inactive nick (Tasmanian Devil), but not the current one. :-)

I got the very same email also and am concerned that someone is trying to hack into my login!!! :(

Maybe the e-mails are sent to all users, and that those with a higher player id just have to wait a bit longer.

don't think so :)

I received the same email twice...

now the second one :)

oddly enough, in the meanwhile i changed my password... however in the mail LG sent me the old one :/

Still no mail, but Ed van Zon a couple of weeks ago paid my membership via his computer (I can't pay via the net) and since that time our games don't count for the rating because "both have the same IP address". Which isn't true of course.

same here

Same here. Twice, to boot.

They'll have an access peak soon ;)

15 minutes ago I received a mail with my password. So someone tried to et it. I played chess here many months ago. I just looked at the chess tournament, where I saw a guy with the name "kill any israeli" registered. The TD should stop this.

wilfried

some TD should stop israeli aggressions too :(

Perhaps the Blogg is a better place to discuss politics? Or maybe even another site?

Anyway, I got this e-mail too, twice. And my wife got it, too. I really wonder what this is about...

Still no mail, I'm left out :(

I just got the e-mails for my current account with player id 13910. With id 18176 you may have to wait still a little while, but I think you will get it eventually.

RE:" I Kill any Israeli" was formerly "No Problems", player #17954. EVERYONE should issue a complaint against this player and they should immediately be banned from the site. This is NOT the place for political statements.

I also got two password request emails as well.

I received two e-mails with my current password. Someone must be running a script to request them.

I received two-emails back to back as well. I haven't logged into this account for a long time (probably over a year).

I got two emails

Nechevo, welcome back!

I got the same message twice in a row too.

Same thing - two emails so far...

This is a serious security flaw and should be fixed, as soon as possible!

While it's not hard for anyone to create and run a script that asks for all users' passwords emailed to them, it would be not easy to eavesdrop the sent emails. But the emails, and the Login page, and all other pages are sent as clear text.

Therefore, if someone achieves (hard it may be but not impossible) to eavesdrop at emails or the pages that the LittleGolem Web Server serves, he will have access to all users' passwords...

so did I

got the email here too

i get it too, i would like to change my name, but it is not possible for me. i dont know always that problem. i hope they didnt want to check my mailing address to send spam or something.

I got an email too.

me t(w)o(o)

He's not the only one, I received it also:

Little Golem - forgotten passwordâ?

Van: admin@littlegolem.net

Verzonden: donderdag 15 januari 2009 22:01:46

Aan: *changed this part*myownemailadres@hotmail.com

Your password from LittleGolem. This mail was generated on base your request from page www.littlegolem.net/jsp/login/forgotten.jsp Your login:rowanpassword: *changed this part* my_own_pass Thank you for using www.littlegolem.net !

I received 2 of them, one at 22:01:46 and one at 22:49:12 . I did NOT ask for this (and definetly not twice), I do know my own password, I have allways known my own password and most likely I won't ever forget it either (untill I'm like 138 years old).

"He's not the only one"---this is manifestly clear ;-)

I got two too.

yup, I got two as well

Well as I did not receive it I was jealous and investigated a bit:

- to get a mail, you need to put your real mail address on your properties, which is always dangerous if you don't need it and don't want to be spammed. So for the test I put a valid address.

- the easiest for someone to make a skript is to use the nick (LG real name) as a tentative login for the http://www.littlegolem.net/jsp/login/forgotten.jsp page.

So I think everyone on the above list who got these e-mails use their nick as login, which is cumbersome as you can't change your login, and google keeps traces of your old nicks.

- as yper said, LG keeps your password not encrypted in a database, as many sites do.

- if you don't want to have bad surprises, you should change your password to a strong one which is not the one you use for your bank account, your paypal account or your mail. And don't worry, if you forget it, LG can send it back to you!

Carroll, I don't have a public email address, my login has little to do with my visible name "Michael X", but I got several such emails.

I didn't try yet, but I guess you do not need much information to trigger a random mail.

rowan, I hope you use more than the one and only private password, especially for sites like these, where a) the password is not encrypted b) there's not a too big loss in case of ..

this mail was generated -one base your request to send forgotten password.
your login ( puskas )