ID
Password
FlashGuide
FlashGuide
HA Infomation

General Discussion

  Index

  • Possible simple solution to account sharing/password security issue

    06. 23. 2011 19:52


Nachmorsi
So there appears to be a big loophole in that you can change all the account details (including email address for verification) online with just the password. This poses a huge risk for those who account share. 
 
My understanding is if you don't remember your PIN then you have to send a support ticket and send an email to "verify" you are the account holder. However, with just the password you can change the email address to your own and claim to be the actual account holder. This amounts to everything on the account possibly being deleted, swapped, etc. 
 
If that were to happen then TNF/SDE has a nice massive headache which I can't blame them for wanting to avoid. 
 
However, I think there is a simple solution that could at least partially solve this issue so that it is like it was on the old website and still allow people to account share without vastly increasing the workload of TNF/SDE. It is more a temporary fix, but it could at least save a bit of a headache. 
 
People can post in a thread/forum/support ticket on the actual account saying that they do not want their PIN to be able to be reset. People who post have their username added to a list (e.g. in notepad or excel).
 
From there on, if anybody sends in a support ticket asking for the PIN to be reset then the GM just has to open the list, ctrl+f and type in the username. If it is there, then deny the change and wait for the real account owner to contact them. If the username isn't on the list then go about as they would do usually.
 
Simple and it should restore some security pleasing both customers and representatives and there is no ambiguity about it.
 
It could also go one step further and people could add their email account meaning the 2nd pw can be reset, but only using the designated email account. 
 
What are people's thoughts on this?
 

 

  • Re : Possible simple solution to account sharing/password security issue

    06. 23. 2011 23:37


Nachmorsi
There are a few legitimate reasons to account share.

First of all, fleet leaders may need to share details if one of the squads is full or they request to be placed in a certain squad. I trust all my fleet leaders, but the fact is there are plenty of other fleets that may not be comfortable with each other - particularly new fleets.

Second of all fleet accounts can be very rewarding and also make the game less repetitive. In a game that is dominated by monotony, playing a new ship can be a breath of fresh air sometimes and encouraging to continue playing NF. It is also team-building to do so and create a common goal that is achievable by any fleet.

Thirdly, account sharing allows smaller fleets to compete with larger fleets since HA is all about numbers. I am willing to place money that 99% of fleets who have participated in HA have shared accounts.

There are more reasons to account share, but I will let other people fill them in if they feel it necessary.

The reason for the rule on account sharing was simply to stop people taking up the GM's time claiming they were 'hacked' when in reality they just shared passwords. My suggestion does not go against this and, to be honest, I think you will find that they will receive more 'I got hacked' support tickets now than before because it is so much easier to do.



It does not make sense to code in a PIN system if SDE's mentality is that account sharing is strictly illegal and as a result people won't do it. If it really is then whats the point of the PIN system? lol.

Stop being unrealistic and accept that people will account share and work from there. I honestly think my suggestion would lower the number of support tickets claiming they were hacked. If you disagree then say why.

  • Re : Possible simple solution to account sharing/password security issue

    06. 23. 2011 23:53


Foxhound31
Originally Posted by Nachmorsi

It does not make sense to code in a PIN system if SDE's mentality is that account sharing is strictly illegal and as a result people won't do it.


A pin system can also prevent a hacker from completely emptying out your account. So yes it does have a REAL purpose. Nowhere in that entire system do I see SDE legitimizing account sharing as you so claim. It is EXPRESSLY stated in the EULA, which you agree to each time you log in to the game, as well as forum posts made in the past that account sharing is ILLEGAL, and you as the player are SOLELY responsible for the security of your account.

If you share your account, you are taking a risk which the company is not responsible for.

If you go look at the account security tips page here http://fm.en.kupaisky.com/Support/AccountSecurity/Tip.aspx

The very FIRST tip is
Tip 1: NEVER share your account details
Sharing data is easily the #1 culprit behind almost all account theft or “hack” incidents. We have seen cases in which supposed “best friends” and family members have been responsible for thefts. On account of this, we strongly advise against any account sharing. In fact, it is our policy to not provide assistance for accounts that have shown previous sharing history as a result of such risks.

So stop trying to legitimize an illegal action on these forums.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 01:10


Panther_
Originally Posted by Foxhound31
Originally Posted by Nachmorsi

It does not make sense to code in a PIN system if SDE's mentality is that account sharing is strictly illegal and as a result people won't do it.


A pin system can also prevent a hacker from completely emptying out your account. So yes it does have a REAL purpose. Nowhere in that entire system do I see SDE legitimizing account sharing as you so claim. It is EXPRESSLY stated in the EULA, which you agree to each time you log in to the game, as well as forum posts made in the past that account sharing is ILLEGAL, and you as the player are SOLELY responsible for the security of your account.

If you share your account, you are taking a risk which the company is not responsible for.

If you go look at the account security tips page here http://fm.en.kupaisky.com/Support/AccountSecurity/Tip.aspx

The very FIRST tip is
Tip 1: NEVER share your account details
Sharing data is easily the #1 culprit behind almost all account theft or “hack” incidents. We have seen cases in which supposed “best friends” and family members have been responsible for thefts. On account of this, we strongly advise against any account sharing. In fact, it is our policy to not provide assistance for accounts that have shown previous sharing history as a result of such risks.

So stop trying to legitimize an illegal action on these forums.



The problem here that you can not seem to grasp is that SDE's supposed IMPROVED SECURITY on the new forums is WORSE than on the old forums.

Before you needed the SECOND PIN to do anything to the account, Change e-mail or account details.
Now you DO NOT NEED THE SECOND PIN!!

I can go onto a forum with the first password, change both the registered e-mail, the second pin and the main password by just having the original password. The TRUE owner does not even get an e-mail confirmation of the changes, the HACKER does!

Now explain to me what else you do not understand about the changes SDE have made to secirity?

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 01:15


XtremCarnage
what is the big deal about adding a pin system (trade password) in order to change email ? is it that hard to do ? does it require that much work ? So what if its illegal to account share, you are making more work for yourselves by making excuses why you cant fix it.

And in the first place you have to do this anyway, if someone hacks your account, they just change the email to theirs, then they can change the trade password using their email, log into your account and trade away all your sailors

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 01:43


KillerParot
lol what about the poor guys who have gone on a break and have left their passwords in the hands of someone else, here they are thinking they are safe because the second password is protecting their stuff, even if they use their email alot they wont get notified that somethings up.... and when they eventually come back ... their account will be wiped clean and probably deleted using the account withdraw feature lol

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 01:49


Foxhound31
I just realized that we're arguing two completely different issues.

I think some clarification is needed.

I am NOT against the implementation of a second pin in order for the e-mail change to happen etc. If something can be brought in to improve account security I am all for that.

HOWEVER, what I've been trying to say is for people that do share their accounts and end up getting hacked (even after a second pin system for e-mail etc is implemented) then that is your problem. You are responsible for your own account and if you choose to give out information to someone else and it ends up biting you back then that's your problem.

We were literally talking about apples and oranges.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 02:19


Kilaenots
Not read any of this as all the responses are too long when all it needs to say is:

Possible solution to account sharing....don't share and use your own account.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 02:39


Nachmorsi
I am understanding of TNF and SDE's view that if you share your password and 2nd pin and then magically get 'hacked' that it is their own fault. I have no issue with it them not wanting to restore things when it is their own fault.

However, given the pointlessness of the 2nd PIN system since the new website it would be nice to restore it's use as a safety barrier. I simply thought that something could be done with minimal effort that would improve security and player 'happiness' (for lack of a better word) until it is hard coded.

I have to disagree with the concept that the PIN system was implemented purely to stop people being hacked though. If people were truly being hacked frequently enough that SDE felt they should put in the PIN system then I am fairly sure that I would have heard about it over the years.

All I've heard of are people whining about being hacked, but when it comes down to investigating the issue it turns out they just shared their password.


Oh and just to confirm - I am all for it being coded so that you either need your second PIN to change the email or simply can not change the email address. My reason for suggesting this is as I said before - given how long it took for this website to be made, I don't think it is wise to hold your breath so I am suggesting an interim solution that is pretty simple.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 02:49


XtremCarnage
Foxhound31, you are basically encouraging account theft by enforcing your policy

The least you could do discourage theft by temporarily adjusting your policy whilst this security loophole exists, and when its fixed you can go back to your old policy. A little extra work isnt going to kill you. Its only gonna hurt the game when players quit due to account theft.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 02:53


Piombo
Originally Posted by Nachmorsi
There are a few legitimate reasons to account share.

First of all, fleet leaders may need to share details if one of the squads is full or they request to be placed in a certain squad. I trust all my fleet leaders, but the fact is there are plenty of other fleets that may not be comfortable with each other - particularly new fleets.

Second of all fleet accounts can be very rewarding and also make the game less repetitive. In a game that is dominated by monotony, playing a new ship can be a breath of fresh air sometimes and encouraging to continue playing NF. It is also team-building to do so and create a common goal that is achievable by any fleet.

Thirdly, account sharing allows smaller fleets to compete with larger fleets since HA is all about numbers. I am willing to place money that 99% of fleets who have participated in HA have shared accounts.

There are more reasons to account share, but I will let other people fill them in if they feel it necessary.

The reason for the rule on account sharing was simply to stop people taking up the GM's time claiming they were 'hacked' when in reality they just shared passwords. My suggestion does not go against this and, to be honest, I think you will find that they will receive more 'I got hacked' support tickets now than before because it is so much easier to do.



It does not make sense to code in a PIN system if SDE's mentality is that account sharing is strictly illegal and as a result people won't do it. If it really is then whats the point of the PIN system? lol.

Stop being unrealistic and accept that people will account share and work from there. I honestly think my suggestion would lower the number of support tickets claiming they were hacked. If you disagree then say why.

Seen nothing legit about any of this other then you say ppl will continue breaking the rules of accnt sharing

1 2 3 4