Curse

Feng Leung · Apr 06, 2006, 10:02 PM // 22:02

heh..i was wondering why when gaile was in LA int, that guy wanted to talk her about the tournament.

KvanCetre · Apr 06, 2006, 10:15 PM // 22:15

Quote:

Originally Posted by doskir

i have been using this method for safe passwords a long time now and heres how it works:
get a piece of paper and write every letter and the numbers 0-9 on it then randomly assign each letter and nummer a different number or letter. now create a password for each site/game by using it. ie: guildwars = df5onm68z. you can put this anywhere you want because NOBODY will know what this thing does copy it a few times and store it somewhere you wont loose it perfect password aslong you dont tell anybody that has access to it what it does

That's actually a really smart idea.

Diablo™ · Apr 06, 2006, 10:25 PM // 22:25

Quote:

Originally Posted by doskir

i have been using this method for safe passwords a long time now and heres how it works:
get a piece of paper and write every letter and the numbers 0-9 on it then randomly assign each letter and nummer a different number or letter. now create a password for each site/game by using it. ie: guildwars = df5onm68z. you can put this anywhere you want because NOBODY will know what this thing does copy it a few times and store it somewhere you wont loose it perfect password aslong you dont tell anybody that has access to it what it does

well thanks for telling everyone.. now everyone will know my password is 1337.

MMSDome · Apr 06, 2006, 10:29 PM // 22:29

Quote:

Originally Posted by Diablo™

well thanks for telling everyone.. now everyone will know my password is 1337.

sadly enough thats probably considered a common password now a days.

That is a good method from the 0-9 thing but i always throw away my notes which include tons of ip's phone numbers and passwords when they get full, so id be left without access to anything since i cant remember anything i have done in the pat year but i can remember what i ate for dinner april 14th of 1996, which really makes me angry.

Riceboi · Apr 06, 2006, 10:35 PM // 22:35

Quote:

Originally Posted by VGJustice

[EDIT] To Tufty: The way they steal accounts is by either guessing or finding out what your e-mail and password are. After that, they can change the password and the e-mail to whatever they want, and the account is gone.

You do know it takes like a week for anet to process an email change! After the week both email accounts get a email from anet about the email change, and both email accounts have to click a link to authorize the email change. If someone tries to change the password to your GW account the new password is sent to the existing email address, so you can change it back easily. I'm not saying your charaters won't be deleted or all your items gone, but you can get your account back.

Bu7ch · Apr 06, 2006, 10:37 PM // 22:37

You can have all the security in the world but sometimes human error will take over.

hellprowler · Apr 06, 2006, 11:09 PM // 23:09

Guys this has nothing to do with making a good password or not, Bani used a vurnability (sp) exploit on a PHPBB forum, which happens to be ScV's forum. Kava had same forum password as account password, so he managed to get in and well the rest is history. Obviously Kava should have made a different pass/email, but don't think Bani like guessed it or something, he had an exploit to retrieve the password.

VBulletin is a MUCH better coded forum software than PHPBB, their encryption is much better and they have less exploits. Almost like Firefox and IE (BURN!). Frankly if you're going to use a PHPBB, make sure it's all updated and you use different e-mails and passwords.

Inruin · Apr 06, 2006, 11:12 PM // 23:12

PHPBB has a lot of exploits and is quite easy to manipulate. vBulletin is a little more secure, i sure hope everyone using PHPBB catches on to the major security flaws.

RoyalScion · Apr 06, 2006, 11:13 PM // 23:13

What the hell. DICE NOOOOOOOOOOOOOOOOOOOOOOOOO.

PsychoX · Apr 06, 2006, 11:19 PM // 23:19

Quote:

Originally Posted by Inde

Most forums are now encrypted. For example, there is no way in vBulletin for me to obtain or hack anyone's passwords. The encryption is that good. I know that older versions of Invision you could. This would also be the reason that I have different passwords for everything. For my GW Account, forum account, emails, admin access, etc.

you would be suprised, vBulletin stepped it up, but they were most likely using phpBB, which just uses an md5 hash of the password.

Though, TECHNICALLY, it wasn't a hacker, it was a cracker.

Its unfortunate, but this isn't the first time something like this has happened.

Fred Kiwi · Apr 07, 2006, 12:46 AM // 00:46

Quote:

Originally Posted by Ctb

The fix for that is keeping the password written down somewhere in a physically secure location, but it's not always practical to buy a safe just to store a piece of paper (and then you still have to remember the combination anyway).

dude...its a piece of paper...no ones going to actually try and find your house and find a password. If its a burglar they're not going to think anything of it. I just stuff all my passwords into a blank case on a postit note. Its totally safe.

acidic artist · Apr 07, 2006, 02:20 AM // 02:20

the solution is SIMPLE. just add -password=(your password here) to the target line of the shortcut. as so "C:\Program Files\Guild Wars\Gw.exe" -password=blah blah

hellprowler · Apr 07, 2006, 02:29 AM // 02:29

That's not a solution acidic, as Kava from ScV was hacked not through a keylogger, but by a PHPBB exploit.

Laibeus Lord · Apr 07, 2006, 02:36 AM // 02:36

Maybe it's time that ArenaNet/NCsoft adopts GameGuard

Cymmina · Apr 07, 2006, 02:39 AM // 02:39

Quote:

Originally Posted by PsychoX

you would be suprised, vBulletin stepped it up, but they were most likely using phpBB, which just uses an md5 hash of the password.

It wouldn't have mattered how they were hashing the password in the database. Sure, an ordinary md5 hash would allow someone to figure out a few common passwords, but not uncommon alpha numeric ones.

Some of the older phpBB versions would allow a malicious user to gain enough access to the database to set the forum descriptions (I know this from fixing an abandoned phpBB install). What they would do from there is set a bit of malicious JavaScript as part of the description that would intercept the information being submitted through the quick login form (appears at the bottom of the default forum style). That JS would silently send that information (the plaintext username & password) to a script owned by the malicious user on another site and then allow the user to continue logging in as though nothing abnormal was happening. The JavaScript, being a part of the site, would also be able to read "remember me" login cookies, but I'm not sure if that information would be usable by a malicious user, since it is hashed as well. Few people suspect their own trusted forums as being malicious.

Nevin · Apr 07, 2006, 02:39 AM // 02:39

Quote:

Originally Posted by Ctb

In addition, don't use wimpy passwords. The ideal password would be a totally meaningless string of characters, but the next best thing is a psuedo-word comprised of various characters.

Example: gu1ldeeg00

It sounds kind of like a real word "guildy goo", but obviously it's just gibberish.

Another alternative that I used for a while is to put all your passwords in one place and have them be actually long nonsense strings of complex text. Then, you protect that location with one very strong password and just open it up when you need to know the nonsense string for a particular account somewhere. I used to do this with an encrypted text file on Windows using AxCrypt, but AxCrypt doesn't work right on 64-bit unfortunately.

The obvious downside there is that, while you're exceptionally safe, if you forget that one password, you lose them all for good :\

Of course, on the flip side, you only have to remember one password as well.

The fix for that is keeping the password written down somewhere in a physically secure location, but it's not always practical to buy a safe just to store a piece of paper (and then you still have to remember the combination anyway).

What happened to the good ol' highschool ilove___ passwords?

d4nowar · Apr 07, 2006, 02:51 AM // 02:51

Quote:

Originally Posted by Nevin

What happened to the good ol' highschool ilove___ passwords?

/changes password... :/

Sagius Truthbarron · Apr 07, 2006, 02:55 AM // 02:55

I make it a point to always use E-Mail+Password auto save features. I never use the same E-mail address either. Since I don't have anyone living with or around me that I don't want in my accounts, it works out fine. And if someone breaks into my house to steal my GW account, I have bigger things to worry about than losing 25k

Juicey Shake · Apr 07, 2006, 04:15 AM // 04:15

Quote:

Originally Posted by Cymmina

It wouldn't have mattered how they were hashing the password in the database. Sure, an ordinary md5 hash would allow someone to figure out a few common passwords, but not uncommon alpha numeric ones.

Some of the older phpBB versions would allow a malicious user to gain enough access to the database to set the forum descriptions (I know this from fixing an abandoned phpBB install). What they would do from there is set a bit of malicious JavaScript as part of the description that would intercept the information being submitted through the quick login form (appears at the bottom of the default forum style). That JS would silently send that information (the plaintext username & password) to a script owned by the malicious user on another site and then allow the user to continue logging in as though nothing abnormal was happening. The JavaScript, being a part of the site, would also be able to read "remember me" login cookies, but I'm not sure if that information would be usable by a malicious user, since it is hashed as well. Few people suspect their own trusted forums as being malicious.

Yes, older versions of phpBB are quite exploitable. I can log in as any member of any phpBB forum that is version 2.0.12 or below, without this one little patch. It takes a grand total of 10 seconds to do. Hopefully that's what happened to them, newer versions of phpbb being easily exploitable is bad bad stuff

calamitykell · Apr 07, 2006, 04:31 AM // 04:31

Shit. I'm using phpBB, how much does vB cost?

*has like, no money* x.x