Curse

Xenex Xclame · Jun 26, 2011, 10:54 AM // 10:54

Unless the number changed position every time, then it was pretty pointless, the same way keyloggers work for keyboard the same way a different program can track the mouse.

Bad solutions for this "problem" isn't a good thing IMO and pincodes when you login and pincodes when you use storage and pin codes when you want to delete, If the person already hacked into your account what makes you so sure he isn't going to be able to hack the pin too.The types of extra security you find in most Asian games are annoying more then anything , at least to me.

I'm all for A usb authenticator though and don't mind paying extra as long as there is a Non authenticator and a authenticator included box the included one obviously priced ~$5 more, I don't want to go trough extra steps to get it, like having to buy it from NCSoft or the in game store.

rb.widow · Jun 26, 2011, 11:07 AM // 11:07

The easiest way to do it would have been if they had made it ( like it was suggested along time ago ) a way to put a lock on the char's for say xx days at at time, when the char is locked, you cannot salvage the armor from it, delete it, etc etc etc.

It will not be done in GW maybe better security in GW2 will allow for it, the main issue was around the NCMA website, there was a security issue with it, and they refused to admit it until it was to late, if the only way you could change your details was via the game itself, you would have alot less issues as soon as you give someone the ability to change details from 2 different sources, sooner or later something bad will happen.

But like its been stated, hopefully for GW2 they will do away with the NCMA completely and everything will be done via the game client.

gremlin · Jun 27, 2011, 03:18 PM // 15:18

For there to be a change in GW or GW2 the company has to believe there to be a problem.

At the moment the majority view seems to say its the players fault so I doubt any change will be made and gw2 will probably use the "tried and trusted method"

I would encourage all players of the upcoming game to leave them no excuse whatever to say its your fault.

Hobbs · Jun 27, 2011, 03:57 PM // 15:57

Quote:

Originally Posted by Reverend Dr

This is a terrible horrible thing. I laugh at every website that refuses to allow symbols in passwords.

My bank doesn't allow symbols in for my online banking account.

To Chicken To Die · Jun 27, 2011, 04:12 PM // 16:12

4-13 characters are more then enough if you dont get involved with gold buyers or use the same combination on anything else or play on a open network.

So either farm your own gold or change your password combination to something unique or stop getting free internet from the people living next to you.

Hephaestus Ram · Jun 27, 2011, 04:14 PM // 16:14

Quote:

Originally Posted by Hells Fury

This is why i like login delay or lock after X times attemps , like on guru.
Is that hard to implement to game?

This would be blatantly unfair to us drunks, so I protest.

When I've been drinking (which is most of the time) it takes me as many as 10 tries to get
my password right.

BTW I DO have symbols in my PW, and I've changed it since linking my account.

gremlin · Jun 27, 2011, 11:55 PM // 23:55

Quote:

Originally Posted by Hephaestus Ram

This would be blatantly unfair to us drunks, so I protest.

When I've been drinking (which is most of the time) it takes me as many as 10 tries to get
my password right.

BTW I DO have symbols in my PW, and I've changed it since linking my account.

Drunks those with bad eyesight or badly controlled fingers like me could make a macro of their password.

Should make it less hit and miss to add the pw, unless you like the game of remember the pw of course

cataphract · Jun 28, 2011, 06:18 AM // 06:18

Quote:

Originally Posted by To Chicken To Die

4-13 characters are more then enough if you dont get involved with gold buyers or use the same combination on anything else or play on a open network.

Everything under 8 characters isn't really a password at all. Also, those 8+ character passwords have to be complex and different passwords have to be used for different accounts and/or services.

Quote:

Originally Posted by Hephaestus Ram

This would be blatantly unfair to us drunks, so I protest.

When I've been drinking (which is most of the time) it takes me as many as 10 tries to get
my password right.

Use the on-screen keyboard with accessibility options turned on. Buttons should prove hard to miss.

BladeDVD · Jun 28, 2011, 07:15 AM // 07:15

Or add the -email -password -character switches to your GW shortcut and you don't have to worry about typing it in at all.

Be sure no one you don't trust can access your PC before doing this of course.

Silmar Alech · Jun 28, 2011, 09:58 AM // 09:58

Quote:

Originally Posted by cataphract

Use the on-screen keyboard with accessibility options turned on. Buttons should prove hard to miss.

I know you didn't meant your post to be a security hint, but your point reminds me that keyloggers are able to record the Windows built-in on-screen keyboard just like a real keyboard, so that's no security enhancement.

I know this because I once tested a professional computer monitoring application - that was even able to record clipboard actions, i.e. the text strings what were pasted from the clipboard into a password prompt.

There are virus scanner applications who also provide an on-screen keyboard, but I haven't tested them with the logging software. They may or may not be safer, I don't know. The best damage prevention is to never catch a keylogger in the first place by always having uptodate virus scanner software and not downloading/starting stuff from shady internet websites or given to you by other people.

bsoltan · Jun 28, 2011, 02:45 PM // 14:45

I copy and paste mine from an encrypted database. I don't even know what that password is. Seems safe to me.
I'm sure I've seen someone mention 'keyloggers' that could take a screenshot on a mouse click.

As long as you're using a password of reasonable length with a mix of alphanumeric then making it longer and more complex really doesn't matter. As mentioned, no one is going to be brute forcing your GW account. They'd already need to know the email address and character name before they even started.

As is the case with any computer security, vigilant and sensible browsing and downloading is what keeps you safe more than the strength of a password or anti-virus software.

Don't go to dodgy sites or click on suspect links, don't enter your information from a link on an email be absolutely sure about what files you're downloading. Oh and use individual passwords/login information for important things or things you care about.

Urcscumug · Jun 28, 2011, 03:04 PM // 15:04

Quote:

Originally Posted by cataphract

Everything under 8 characters isn't really a password at all.

The length of the password is not the issue. The issue is (1) how many times and how fast you are allowed to try to guess them by brute force, or (2) how easy it is for the password to be guessed or found by others.

ATM cards have a very simple password (4 digits) because the ATMs have pretty harsh rules about wrong passwords, such as 3 consecutive mistakes and the card is blocked. As mentioned above, the GW client has a staggered penalty for mistaken passwords, so the minimum length of 6 characters is not that big a deal. Of course, if you use 123456 or aaaaaa or qwerty or 112233, that's pretty much asking for it...

For the second issue, it's about things you mentioned: using the same password in other places, writing it down (on a post-it on your desk or in a file on your computer), having malware sniff it off your keyboard or off the network etc.

While malware is harder to deal with, it's more likely than break-ins happen due to a very short or easily guessed password or using it on all the websites. And this is not just a problem with GW, when you use the same password everywhere bad people are likely to also be able to get into your online email accounts, Facebook etc. etc.

Voodoo Rage · Jun 28, 2011, 05:01 PM // 17:01

It's almost impossible to brute force a random password. I assure you that passwords are either taken off of other websites or via malware.

Kunder · Jun 28, 2011, 10:15 PM // 22:15

Quote:

Originally Posted by Voodoo Rage

It's almost impossible to brute force a random password. I assure you that passwords are either taken off of other websites or via malware.

Or, as we have learned from Sony, they can be left in plain text on a publicly accessible platform

Ximvotn · Jun 29, 2011, 03:57 AM // 03:57

Quote:

Originally Posted by Kunder

Or, as we have learned from Sony, they can be left in plain text on a publicly accessible platform

It wasn't exactly connect by FTP and there's everyone's information. The problem lies in the directory itself with the sensitive account information not being encrypted or secured at all.

To Chicken To Die · Jun 29, 2011, 11:06 AM // 11:06

Quote:

Originally Posted by cataphract

Everything under 8 characters isn't really a password at all.

Only if you have a hacker thats try to geuss your password starting with AAAA going up to 9999. lol. With keyloggers or using the same combination on other sites it wont matter if you have a 1 or 64 character password with numbers or even symbols.

cataphract · Jun 29, 2011, 12:20 PM // 12:20

If you keep your computer, firewall and antivirus software up-to-date and don't leave your username on the internet that brute-forcing attacker is the biggest threat you'll have. And he'll have a tough time breaking the password.

Ximvotn · Jun 29, 2011, 12:45 PM // 12:45

Quote:

Originally Posted by cataphract

If you keep your computer, firewall and antivirus software up-to-date and don't leave your username on the internet that brute-forcing attacker is the biggest threat you'll have. And he'll have a tough time breaking the password.

I agree with most of this. However, for a virus to be in an online database, it must be caught first. This is where there is room for error and scrutiny of security. There's a chance your or my antivirus could be slower to updating their virus definitions then other antivirus software.

Evil_Necro · Jun 30, 2011, 06:23 AM // 06:23

Hi there.. I just about to start playing after about 1 year hiatus (I logged for 3 hours during Halloween though), and was welcomed by non friendly incident.

My friend just got hacked by his guildmate. He logged in after couple of months and found in the guild announcement that this one guy was swearing and claiming that he hacked many accounts of the users belong to that particular guild. Me and my friend panicked because he "borrowed" my stuffs like ectos, weapons, dyes, etc last year to play with his gf. I let him borrow because he's one of my best friend, eventhough I'm in Japan and he's in mexico. Never met him in person, but in the past 5 years (we met through GW), our relationship has been very close.

After a while, he gave me the bad news.. all's gone, including my ectos.. (not much, around 80, but I got it through legit hard work.) I was upset because he didn't return my items when he stopped playing, but also more upset seeing my friend's items had been salvaged/taken. He's the type of player that is very dedicated (rank 11, almost max for luxon allegiance title), and just playing what he love. He don't really have any money but never even asked for my money. Other than some titles, his other dedication that was ruined by the hacker was, his vabbi armor. He saved up for months through drops/quests, and was very proud of it. It was salvaged by a hacker..

He can logged in yesterday, and we even met and talked IG. Then after finding out about the incident, he got mad and emailed support. I don't know what triggers it, but today his account was blocked. The reply from Anet was:

"We appreciate your patience during our investigation. Your account was blocked because it was accessed by gold sellers in May of 2011. I recommend that you immediately scan your computer for viruses as this intrusion may have been caused by a keylogger being downloaded onto your computer. Make sure your anti-virus software is up to date before scanning, and then be sure to change the passwords to your NCsoft and Guild Wars accounts immediately after.

While I would like to replace your items, the Guild Wars Support Team does not have the capability to replace characters or items, whether they are lost through the actions of unfriendly players, deletion accidents, or through other means.

Here are some tips to help you protect your account and keep your computer secure."

So, we don't even know what happened here. Why is it that yesterday he can logged in? Why today his account was blocked?
Anyway.. I don't mean to complain, I just want to share story here that has little relation with this topic.

Maybe Anet can do Apple-like-solution by giving number of authorized PC. Like 2 PCs or something..

Oh well..

Dami · Jun 30, 2011, 07:08 AM // 07:08

The only thing that annoys me is this :- if i'm on my lappy and then i log on with my main pc i get a code 007 on my lappy, nothing to say i'm logged on anywhere else, so i have no idea if code 007's are real d/c's or someone on my account. I'm no computer buff so i understand these things would be have to be coded etc, but it would be nice to see a different message IF the account suddenly became logged in at a different terminal.