Notifications.

[Avacado]

It is not uncommon for me to access this website from 6 different systems each day. Despite turning off ALL email notifications, I keep receiving an email EVERYTIME I login and I am really getting tired of it. Some days I receive over 10 login emails. Is there anyway I can turn this off? It's driving me nuts.  

Edited March 2, 2021 by Avacado

[ENTERPRISE]

Moved to Suggestions. 

 

So I have looked into this, it is not a bug but is a part of the security platform. At this point in time there is no granular option to disable this on a per user level as it is a global setting. Unfortunately I cannot turn it off globally for obvious security reasons. Looking into it, this has been bought up a few times over with the developers of the core platform and it has been raised internally. 

 

I will pop my head in and see if they have made any progress that would allow users to disable the login notifications on their specific accounts.

 

For now all I can suggest is using an email filter to pick up the login notifications and pop them neatly away into another folder. The alteration to the core platform however is out of my hands but I will see if I can bend their ear a little more.

 

Cheers,

E

[ENTERPRISE]

To help get more traction on this, for those who would like to see this feature, please up vote it here in the Poll : https://invisioncommunity.com/forums/topic/460959-option-to-turn-off-login-notifications-at-user-level/ 

[ENTERPRISE]

Yeah, so I do not think it will be getting an alteration anytime soon I am afraid. Filtered emails is the only option I can offer at this point as the core development team for IPB see this as a security risk, even though I would argue that if users wanting to disable were forced to use 2FA that it would still be an acceptable level of security. 

 

Alas, out of my hands.

[tictoc]

Thanks for sending it up the chain E.

 

I just set custom rules for my inbox, and then clean them out periodically.

 

I will say that the "security" concern is an interesting take on user security.  I guess it's nice to know when you've been pwned, but by the time you see the alert, the damage has likely been done.  2FA and/or hardware tokens are really the best, easy to implement solution.

 

In my experience, most user facing security items that are likely to cause user fatigue, are not worth the time to implement.  If something hits a user's inbox multiple times per day, then the natural thing to do is to ignore the alerts, rendering them useless.  This is similar to password fatigue, where you require the user to change their passwords frequently, which annoys the users, and then you start to see things like oldpassword1, oldpassword2, etc, or just shorter and easier to remember (i.e. insecure) passwords.  

 

FWIW Google, Microsoft, and a bunch of other large corps do the same thing with logins.

[BWG]

What emails? Oh, the ones in my spam folder! 

[ENTERPRISE]

51 minutes ago, tictoc said:

Thanks for sending it up the chain E.

 

I just set custom rules for my inbox, and then clean them out periodically.

 

I will say that the "security" concern is an interesting take on user security.  I guess it's nice to know when you've been pwned, but by the time you see the alert, the damage has likely been done.  2FA and/or hardware tokens are really the best, easy to implement solution.

 

In my experience, most user facing security items that are likely to cause user fatigue, are not worth the time to implement.  If something hits a user's inbox multiple times per day, then the natural thing to do is to ignore the alerts, rendering them useless.  This is similar to password fatigue, where you require the user to change their passwords frequently, which annoys the users, and then you start to see things like oldpassword1, oldpassword2, etc, or just shorter and easier to remember (i.e. insecure) passwords.  

 

FWIW Google, Microsoft, and a bunch of other large corps do the same thing with logins.

 

Yeah to be honest, it is a nice feature but to be honest it is like closing the stable door after the horse has already bolted. I think the idea of allowing users to disable it ONLY if they had 2FA enabled was a good compromise, but I guess not.