Login Screen security improvements

Continuing on from our initial changes to the login screen back in August, we have made further improvements to this screen and the login process.

The main improvement we have done is where you enter the wrong password and how many attempts it will allow you to do this and what the system will do in each attempt scenario.

How many times can you enter your password incorrectly before you are locked out completely?

You are entitled to six (6) attempts before the system will lock you completely. However, based on a certain number of attempts the system will sequence lockouts as follows:

Attempt 1 – when you enter the wrong password for the first time, the system will show you an Invalid Password. You have 5 more attempts left before your account is locked as shown in the screenshot below.

Attempt 2 – when you enter the wrong password for the second time, the system will warn you with the following message Your IP is being tracked. You have one more attempt before your account is temporarily locked.

Attempt 3 – when you enter the wrong password for the third time, your account will be locked for 1 minute and the system will show you a countdown timer on the login screen as below. After the 1 minute is completed, the system will allow you to re-enter the password.

Note – the process of the attempt for three (3) attempts continues for attempts 4 and 5.

IMPORTANT – as you can see in the screenshots below, when you have entered the incorrect password for the sixth time, you will see the messages saying Due to repeated incorrect password attempts, your account is now locked and disabled. You will also see a popup on the screen saying Your site administrator/s has been notified.

When you select the OK button in the message above regarding your site administrator/s being notified, the system will then prompt you to reset your password as shown below.

Important – for you to be able to reset your password, your user account in the system must already have your email address and mobile phone number set against them. If it doesn’t then the system will not allow you to reset your password. You need to then speak to your manager to get this resolved and updated so you can come back and reset your password.

If your user has been set up in the system with your email address and mobile number, then you will be able to proceed with resetting your password. If none or one of the pieces of information is missing you will see one of the following messages below:

Where you have no mobile number: You do not have a valid mobile/email on file for your account.

Where you have no email or mobile number: Please contact your site Administrator/s.

Where you have no email address: Please ask them to update your email/phone number so that you can reset your password and access the system.

What happens when you have an email and mobile set for your account?

The system will show you a new button for Reset my password as below. When you select it you will see a popup message on top of the screen saying OTPs will be sent to your registered mobile number and email address as per your profile.

Important: For the below reset password process you have a timer of 120 seconds. When you receive the OPTs enter them into the relevant fields on the Reset password Instructions popup and select the Validate OTP button.

Once you validate the OTPs, You need to update your New Password and then Confirm the new Password in the fields. When you have updated, you will be taken back to the login page to access the system.