[libreoffice-l10n] Weblate locked accounts – preventive measure against brute-force attack

Hi *,

you might have received a mail by weblate saying your account has been
locked. – if you didn't then please read the message in full!

Last night weblate was attacked by a botnet that tried to brute-force
user/password combinations.

As a measure against those types of attacks, weblate automatically
disables accounts after too many failed login attempts.

To regain access to the account, you have to reassign a password using
the "Forgot your password?" link on the signin page (then enter your
email address → weblate will send a one-time-use password recovery
link where you can set a new password).

If your account was locked, then it means that the attack didn't find
a valid password and the audit log (
https://translations.documentfoundation.org/accounts/profile/#audit )

If your account wasn't auto-locked it could be one of the following cases:
* the attack stopped before your account was tried
* the attack stopped before it reached the number of failed attempts
to trigger the lock
* the attach succeeded/there was a valid login – that is obviously the
worst part

So in any case check the audit log
https://translations.documentfoundation.org/accounts/profile/#audit
and if you find a successful login from a IP  or user agent that is
suspicioius, not yours immediately report it as a suspicious activity
and also make sure to change your password on both weblate as well as
everywhere else you're using that password - you can be sure it ended
up on some valid password list that is tried in other places as well.

ciao
Christian

-- 
To unsubscribe e-mail to: l10n+unsubscribe@global.libreoffice.org
Problems? https://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: https://wiki.documentfoundation.org/Netiquette
List archive: https://listarchives.libreoffice.org/global/l10n/
Privacy Policy: https://www.documentfoundation.org/privacy