PATCH: AUTOMATIC IP PRIVACY & DEVICE VERIFICATION OVERHAUL
IP PRIVACY
DEVICE VERIFICATION
IP PRIVACY
- Now automatic for upgraded members. Nothing to configure, nothing to remember. Hold an active upgrade and it's on from the moment your upgrade activates.
- Your real IP never reaches our database, it's replaced with a permanent placeholder before anything is stored.
- The same real IP always produces the same placeholder, so anti-alt tooling keeps working, but nobody can reverse it, staff included.
- Switches itself off if your upgrade expires, and straight back on if you renew.
- Manual opt-out is still available under Account → Privacy.
- What this doesn't cover? Web server access logs and our CDN provider's logging sit outside the forum and rotate on their own schedule. No forum add-on can reach those.
DEVICE VERIFICATION
- Firefox users are no longer wrongly blocked. Building on the earlier Safari fix, a check relying on a browser feature only Chrome and Edge provide was logging out Firefox users and showing them the "Tor / Anti-Tracking Detected" page.
- Budget phones and older laptops are no longer flagged as virtual machines. Modest hardware alone was enough to place an account into moderation. VM detection now looks for genuine VM signatures.
- Fixed random mid-session logouts. Background requests such as images, scripts and browser prefetching were triggering the session security check. It now applies only to real page loads.
- Device management fixes.
- Revoking a device no longer clears unrelated information from your profile.
- The device limit notice correctly releases you once you drop back below the limit.
- Detection accuracy improvements.
- A report on one account could suppress alerts on connected accounts, letting linked accounts go unreported.
- Mobile devices are correctly remembered as mobile, so phones and tablets aren't matched against unrelated accounts.
- Security hardening. Hardened authentication on the internal verification endpoint, cryptographically secure email verification codes, timing attack resistant code checking, removed a diagnostic log file, and fixed a redirect handling issue.