Loony said:
Enter the e-mail address and the password you selected during registration.
E-mail Address: <--- it is there in the window
Password: - there were 8 asterisks, as I had expected.
Just to verify.
Double check that the email address field is entered properly.
If it shows up automatically for you, it must be stored in the
browser somewhere. That is unimportant if the email
address is valid.
When I enter this page, the username and password fields are
completely blank. That means my browser made no assumptions
about what I wanted to type in there. My browser is not
using automatic form filling, to fill the fields for me.
https://login.aarp.org/online-community/loginform.action
But the password field is important. When you see ********
I hope you're not immediately clicking the slate grey colored
"Log In" button. You should backspace over the password or
otherwise erase it, and enter your password again. If your
password was fewer or more than 8 characters, that would be
great, as then you could be sure you're sending a "fresh"
password and not one stored in the browser. So say your
password was "Loony", when you're finished you'd see the
five asterisks. That helps prove you're not sending the old
password.
(e-mail address removed)
*****
The thing is, there are a couple ways the password could be
memorized by the browser, from previous typing it in.
The username/password could be stored in a cookie, which
the aarp site uses to auto-fill the fields for you. Or,
the browser itself can memorize passwords and keep them
in a local cache. (In Firefox, this is controlled in
Tools : Options : Security : Remember passwords for sites )
Sometimes a browser has an automatic "form filling" feature
which is similar, in that it keeps the info you typed from
a previous session, and fills in the fields again.
Because of those possibilities, in this case you want to make
sure the fields have been "freshly typed", to override
anything stored in the browser.
This problem is going to be hard to debug, because https
protocol is secure, and if you watch the packets with a
packet sniffer like Wireshark, there is really nothing to
see in there. It'll look like "digital noise". If they
weren't using https, but were using http, you could
use a packet sniffer, to see the username and password
in flight as they leave the computer. And that would be
a way to double check it is working.
Tech support at aarp, should be able to look at the
login server when you enter your username and password,
or at least, in non-real time, check the logs, to see
what password was last entered with that username. If
they see the "stale" old password arriving, it means the
browser is sending the "stale" version, rather than the
new version you freshly typed.
I doubt the login window would completely paint, if there
was a protocol problem. And that's why all I can suggest,
is somehow the password is still "stale".
Also, do you know whether the site insists that cookie
storage be enabled ? When you log into a site, the
browser needs a means to prove you're authenticated for
each additional page you visit on the site. There
are a couple ways they can do that, and one of those
ways would require cookie storage on your disk, to be
enabled. If you've tried to completely disable cookies
in Tools : Options or done things like turn off Javascript
or use NoScript Add-On, those might interfere with things
a bit.
I still think your real password is not being sent.
But I don't know a way at your end, to prove it!
Paul