No exploits found in the wild.

Workaround: Only give bureaucrat access to users livind in the city (where there're much less pigs), preferably on the top floors of the skyscrapers, well above flying pigs maximum altitude.

skizzerz wrote:

Reopening as this is most certainly not invalid. It is the one major bug that MUST be fixed before the PasswordReset extension can be stable enough to be used. While every other potential abuse can be checked with logging, flying pigs can circumvent this check by simply possessing other users, which does not get logged.

Perhaps we need a way to intercept brain wave patters to determine if the user is acting of his/her own free will and block changes where he/she is not.

river wrote:

Perhaps an easy fix would be to implement Special:Log/posession. The only problem is that the flying pigs could make people forget to check the logs, rendering it ineffective.

This tool seems to protect against them http://zapatopi.net/afdb/

(In reply to comment #0)

Using the PasswordReset extension, it is possible for flying pigs to take over
a user's account using advanced memory modification techniques.

Flying pigs successfully kept out as of r47640