Password and login security
Altcraft Platform protects user accounts from unauthorized access: passwords must meet specific requirements, failed login attempts trigger temporary blocking, and users receive email notifications about failed login attempts.
Password requirements
The account password must be 8 to 32 characters long and include numbers and special characters. The platform validates the password when it is set or changed and does not allow:
- reusing a password that was previously set for the account;
- using user data in the password;
- setting a password that is too simple.
When requirements are not met, the platform reports the reason: "Password must contain numbers", "Password must contain special characters", "User data cannot be used in password", "The password you specified has already been used. Please enter a different password.", "Password must be different from the previous one!".
If the User must change password on first login option is enabled when the user is created, the user will set an individual password on the first login to the platform. Creating user accounts is described in the article Users and access separation.
Changing the password
The password can be changed in the profile: My profile → Security. In the Password block, enter the current password, then enter the new password and confirm it.
If the current password is incorrect, the platform reports "Invalid current password!"; if the new password and its confirmation do not match, it reports "Confirmation password does not match your new password. Please try again.". A successful change is confirmed with the "Password updated successfully!" message.
Password recovery
If the password is lost, use the "Forgot password?" link on the login page. An email with a recovery link will be sent to the user's contact email address, allowing the user to set a new password.
Login blocking after failed attempts
To protect against password brute-forcing, the platform tracks failed login attempts by the IP address they come from. The attempt counter is shared for an IP address: failed login attempts under different logins from the same address are summed up.
When the failed attempt limit is exceeded (by default, 5 attempts within 60 seconds), further login attempts from this IP address are temporarily rejected, and the platform reports: "The limit of the number of authorization attempts has been exceeded!".
The block lasts for 60 seconds after the last failed attempt. Each new failed attempt resets the countdown: the block is prolonged for another 60 seconds. If no attempts are made within 60 seconds, login from the IP address becomes available again.
The attempt limit and the period are set in the platform configuration file and cannot be changed in the user interface. See the article Configuration file for details.
Failed login attempt notification
When a login attempt fails, the platform sends the user an email "Failed login attempt" to the contact email address. The email contains the date of the attempt, the browser, and the IP address.
If a notification arrives when no login attempt was made, the password should be changed and the support team should be contacted.
Login history
Information about account logins is displayed in the Login history block (My profile → Security). The block shows successful and failed login attempts: login date, device, browser, location, and IP address. The location is determined by the IP address the login attempt came from.
Two-factor authentication
Two-factor authentication provides additional account protection — it is described in the article Two-factor authentication (2FA).