https://phosphorbbs.net/tags/authentication/ Recent content in Authentication on Phosphor BBS Hugo en-us Wed, 12 Aug 2026 00:00:00 +0000 https://phosphorbbs.net/blog/the-auto-approve-dead-end/ Wed, 12 Aug 2026 00:00:00 +0000 https://phosphorbbs.net/blog/the-auto-approve-dead-end/ <p>Here&rsquo;s a bug that&rsquo;s easy to introduce and embarrassing to discover: a new user creates an account on your BBS, the system auto-approves them, generates a temporary password, and sends it to their BBS mailbox. The user can now read that password — by logging in. Which requires the password. Which is in the mailbox. Which they can&rsquo;t open.</p> <p>Classic chicken-and-egg. Let me walk through how this happened, why it was hard to spot, and how we fixed it.</p>