Curse

Empress Amarox · May 08, 2009, 06:32 AM // 06:32

What do you think of logging in XTH with your real GW account?

"Players will now log in to the Xunlai Tournament House with their Guild Wars username and password."

Personally, I am very upset about this. Not only do I feel like it makes my account insecure, despite their claims of it being secure.

But, what about those of us that set up XTH accounts for friends and vote for them because they don't understand it, don't play PvP, can't be bothered or similar? Before we could do this, or let someone do this for us, with the security knowing that our account info was safe because different login information is used. This is no longer true.

I really don't like this part of the update....

PowerRAV · May 08, 2009, 06:44 AM // 06:44

Quote:

Originally Posted by Empress Amarox

But, what about those of us that set up XTH accounts for friends and vote for them because they don't understand it, don't play PvP, can't be bothered or similar? Before we could do this, or let someone do this for us, with the security knowing that our account info was safe because different login information is used. This is no longer true.

Voting for friends... Doesn't that fall in the lines of account sharing? I thought account sharing was against the EULA. Ah well probably wrong.

I for one am happy for the change, less passwords to remember.

Longasc · May 08, 2009, 06:51 AM // 06:51

I think it is a half-baken solution.

I agree that using your account name and pw to log in the XTH in a web browser is an additional security risk. But the old solution with the extra pw was not the best either.

-> A better idea would be to do the whole betting process ingame.

I do not see this happen in GW1, unfortunately.

Maybe they will do this in GW2. They do not seem to be willing to make ANY effort to do this, everyone busy working on GW2 and so on, as usual. The usual excuse is that it would take as much time, effort and money as building all the pyramids in Gizeh. This would delay Guild Wars 2 until the sun has already burned out.

I also use the accounts of two WoW playing friends to get stuff from the XTH, but as I know their account passwords I can continue this practice (note that I do not recommend this practice, they just do not care at all about GW, to my disappointment).

Wish Swiftdeath · May 08, 2009, 07:01 AM // 07:01

I think it's fine, it's 100x easier than dealing with anet's support.

Empress Amarox · May 08, 2009, 07:03 AM // 07:03

Quote:

Originally Posted by Wish Swiftdeath

I think it's fine, it's 100x easier than dealing with anet's support.

How would you like dealing with anet's support when everything on your account gets jacked (and they have a strict no replacement policy)? That's the entire point...

I don't feel safe anymore.

Karuro · May 08, 2009, 07:05 AM // 07:05

Quote:

Originally Posted by Empress Amarox

I feel like it makes my account insecure, despite their claims of it being secure.

This, basically.

upier · May 08, 2009, 07:13 AM // 07:13

Oh crap!
MY Fifefox had the password saved and now I'll need to change it!?!??!
WTH!??!?!

Red Sonya · May 08, 2009, 07:21 AM // 07:21

Man one QQ thread after another every time something changes. Personally it doesn't really matter to me. Saves me from having to remember yet another id and password.

Erkki · May 08, 2009, 07:37 AM // 07:37

I liked the old XTH log-in system better.

Quote:

Quote:
Originally Posted by Empress Amarox
I feel like it makes my account insecure, despite their claims of it being secure.

^that for me too. I just don't like the feeling of having to spread/share my account name and PW on the interwebz.

tigros · May 08, 2009, 08:12 AM // 08:12

I assume you people haven't heard of things like single sign-on's...

If you don't trust the website (that's using a secure connection with the game servers) than you should probably stop logging on the game as well, since the "vulnerabilities" are quite similar...

citizensmith1001 · May 08, 2009, 08:52 AM // 08:52

Quote:

Originally Posted by Empress Amarox

How would you like dealing with anet's support when everything on your account gets jacked (and they have a strict no replacement policy)? That's the entire point...

I don't feel safe anymore.

This^ , i agree , i dont feel safe using my ingame pass to log into the XTH ,atm im considering just not taking part in it for a couple of months , if there hasn't been any issues by then i will probably start doing it again .Personally i think that Longasc has the best idea in that it should be handled ingame by a NPC.

Fril Estelin · May 08, 2009, 08:53 AM // 08:53

It is a very good thing, not in itself, but with the added security of the XTH. They're putting back the security of your account in your hands, rather than asking you to create a new account (I mean XTH account vs. GW account). Technically speaking, we call that "minimizing the security surface".

Your feeling of insecurity is unfounded, do not think emotionally but rationaly. So let's look at the various points:

Quote:

despite their claims of it being secure

Ok so you don't trust them. Explain.

Quote:

But, what about those of us that set up XTH accounts for friends and vote for them because they don't understand it, don't play PvP, can't be bothered or similar? Before we could do this, or let someone do this for us, with the security knowing that our account info was safe because different login information is used. This is no longer true.

This actually is not related to security, but "convenience", with even a feature that is your sole responsibility, Anet shouldn't have to deal with this situation at all, you should. It actually shows something important: security comes before convience for XTH. Or else wait for the (possible) next version of the automatic voter software.

Quote:

I agree that using your account name and pw to log in the XTH in a web browser is an additional security risk.

Very true. But I think they've realised that around December (maybe before) and we now have a brand new, reshaped, more secure website.

(having it ingame is clearly possible, but maybe too much work for them? or they want to promote the website or move some of the load from GW server to webservers?)

Quote:

How would you like dealing with anet's support when everything on your account gets jacked

This has absolutely nothing to do with XTH. The tales of GW being hacked are wrong, in the sense of this happening in the wider sense. GW is a very secure piece of software. Hacked accounts mostly happen via typical social engineering techniques, such as guessing passwords (say, from your Guru profile or posts for example...), and having XTH doesn't make one inch of difference here.

zwei2stein · May 08, 2009, 09:06 AM // 09:06

I resonally dont like this change, people could trust my XTH aid more in past (stolen account info for xth was worthless). Now they are more vulnurelable to my evil side (bwahaha) and to impostors that would tinker with code.

Regardless of that, this brings serious risk of exposing account info to XSS attacks; bigger sufrace exposed to attack attempts is not desirable.

Fril Estelin · May 08, 2009, 09:06 AM // 09:06

I'll reply separately to this post because it's interesting:

Quote:

Originally Posted by citizensmith1001

This^ , i agree , i dont feel safe using my ingame pass to log into the XTH ,atm im considering just not taking part in it for a couple of months , if there hasn't been any issues by then i will probably start doing it again .Personally i think that Longasc has the best idea in that it should be handled ingame by a NPC.

It's a matter of trust, trust in pieces of software that we barely understand, because most of it is handled on a server to which we don't have access to. People distrust internet for XTH but trust it for buying stuff on amazon? The security misperception may come from stories read on Guru, and these stories may well be due to the old form of the XTH, while the new one fixes them.

It's quite rational to wait a few month until voting. But me, who's worked a lot in security, won't be doing that, UNTIL (and not BEFORE) I see evidence that it's insecure. I use Firefox with NoScript (an extension which by itself would require an entire discussion on the matter of trust, see their recent affair...), AV, firewall and antispys with fully update softwares, always checking the address of the websites.

What I see in this thread is "fear" because of change, not completely irrational, but not founded on actual solid pieces of evidence. This happens all the time in RL, I'm not blaming anyone for that (I could tell you how I was aggressed by a guy this morning who went totally berserk on me for touching his car with mine without any damage, the epitome of irrationality, but I wont

). Just trying to help here.

KrisNaga · May 08, 2009, 09:12 AM // 09:12

That xunlai house thing is a real pain in the ass, I did everything it said and I get no rewards and yes I have checked the faqs on it. It just seems like anet wants to make everything as difficult as possible and I can't be bothered with there crap anymore, they failed in this and then they failed at the free storage and now they want people to give out there real details?
I feel that it would definitely put people's accounts at risk because nothing is 100% secure and I don't see any reason whatsoever why anet should have our account names as well as our passwords, it's none of there business what our passwords are and they even say not to give them out so now there contradicting themselves.
I would avoid this at all costs, it's not worth getting your account hacked.

pumpkin pie · May 08, 2009, 09:27 AM // 09:27

i wander what would happen if someone hijack/hack into GW webpage and get all the passwords...... or if that is even possible???

I always thought we are not suppose to use same passwords and name for different webpage/games/accounts... etc.

infact didn't the webpage ask us not to use the same passwords as our game account when we sign up for security purposes???????

Wish Swiftdeath · May 08, 2009, 09:40 AM // 09:40

Quote:

Originally Posted by Empress Amarox

How would you like dealing with anet's support when everything on your account gets jacked (and they have a strict no replacement policy)? That's the entire point...

I don't feel safe anymore.

You've a good point, i guess i'd probably just quit GW anyway.

I only really log on to help noobies, do the odd GvG at 4am anyways.

Marxon Aurion · May 08, 2009, 09:47 AM // 09:47

Considering NOBODY would make the effort to hack a single person through SSL and having to do it all over again (I'm talking about needing 30 PCs or a similar amount and probably about a week non-stop for one person) for another person, this is actually more safe. I think the old system didn't use SSL no?

This crying is understandable, but this new system doesn't make your game account more vulnerable than it was before.

So, stop not feeling safe. If you're being hacked it's probably your fault anyway for logging on to that odd porn website with your email and pass.

Karuro · May 08, 2009, 10:02 AM // 10:02

Quote:

Originally Posted by Marxon Aurion

Considering NOBODY would make the effort to hack a single person through SSL and having to do it all over again (I'm talking about needing 30 PCs or a similar amount and probably about a week non-stop for one person) for another person, this is actually more safe. I think the old system didn't use SSL no?

This crying is understandable, but this new system doesn't make your game account more vulnerable than it was before.

So, stop not feeling safe. If you're being hacked it's probably your fault anyway for logging on to that odd porn website with your email and pass.

I had mine always bookmarked as https. So I guess it had? :S

Yarly · May 08, 2009, 10:06 AM // 10:06

Quote:

Originally Posted by pumpkin pie

i wander what would happen if someone hijack/hack into GW webpage and get all the passwords...... or if that is even possible???

I always thought we are not suppose to use same passwords and name for different webpage/games/accounts... etc.

infact didn't the webpage ask us not to use the same passwords as our game account when we sign up for security purposes???????

Thats right, seems rather ironic huh?

I just hope anet have made the security in the XTH stronger than fort knox now, because if theres someone out there who can hack it. You can bet your ass they will.