ID
Password
FlashGuide
FlashGuide
HA Infomation

General Discussion

  Index

  • Possible simple solution to account sharing/password security issue

    06. 23. 2011 19:52


Nachmorsi
So there appears to be a big loophole in that you can change all the account details (including email address for verification) online with just the password. This poses a huge risk for those who account share. 
 
My understanding is if you don't remember your PIN then you have to send a support ticket and send an email to "verify" you are the account holder. However, with just the password you can change the email address to your own and claim to be the actual account holder. This amounts to everything on the account possibly being deleted, swapped, etc. 
 
If that were to happen then TNF/SDE has a nice massive headache which I can't blame them for wanting to avoid. 
 
However, I think there is a simple solution that could at least partially solve this issue so that it is like it was on the old website and still allow people to account share without vastly increasing the workload of TNF/SDE. It is more a temporary fix, but it could at least save a bit of a headache. 
 
People can post in a thread/forum/support ticket on the actual account saying that they do not want their PIN to be able to be reset. People who post have their username added to a list (e.g. in notepad or excel).
 
From there on, if anybody sends in a support ticket asking for the PIN to be reset then the GM just has to open the list, ctrl+f and type in the username. If it is there, then deny the change and wait for the real account owner to contact them. If the username isn't on the list then go about as they would do usually.
 
Simple and it should restore some security pleasing both customers and representatives and there is no ambiguity about it.
 
It could also go one step further and people could add their email account meaning the 2nd pw can be reset, but only using the designated email account. 
 
What are people's thoughts on this?
 

 

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 03:17


mako089
I guess the hard headed people are refusing to see what some of us are saying. We understand there is a danger
in account sharing. We actually keep our main accounts safe and out of the hands of other people. We have set
up designated accounts that can be used by fleet members so they can try out different ships such as subs instead
of leveling one then wanting to shoot themselves for going down that road. We have players who may have never
played a TW or CVs and the shared fleet accounts allow them to "test" those out. This also applies to different
nations. This is not something we have to do but it's a service we provided to our fleet members and I think
they have appreciated getting a "preview" of what certain ships and nations can do. In our case, we're upset we
won't be able to provide this service as easily as before.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 05:22


Gtdawg
Originally Posted by Foxhound31
A pin system can also prevent a hacker from completely emptying out your account. So yes it does have a REAL purpose. Nowhere in that entire system do I see SDE legitimizing account sharing as you so claim.


If a PIN system can also prevent a hacker from completely emptying your account, why isn't the PIN system in place on the forums to prevent someone from changing the verified email, password, and trade password?

It used to be implemented in-game and on the forums. Now, they don't have it on the forums, yet they tout these new forums as improved security.

You are right, of course. A PIN system DOES increase security. That's why it is quite odd that they would have it in-game, but tell people that on the forums "you shouldn't share your password".

If the entire argument is "you shouldn't account share, because it is illegal", then they should remove the trade password from the game. It will be the same level of security as the forums, which SDE and TNF seem to imply is good enough. As long as people don't share their account, they should be good.

Of course, that isn't the case. On the old forums, you had to use both passwords to change the verified email. That would imply that SDE, at one time, felt it was important enough to require them.

-------
As for the part about legitimizing account sharing, you are making a very tenuous argument by purely relying on the words of a EULA that wasn't written for this game and a singular post from one person.

If you look at the actions of the developers of this game, they instituted a secondary password that bars people from using items, entering the HQ, making trades, and deleting sailors. It was sold as a prevention from accidentally deleting sailors, however, given what it blocks someone from doing, it was most definitely designed to allow access to an account while having the sailors and items be secure on that account without worrying about them being deleted, stolen, whatever.

That is tacit approval of account sharing. You can yell until you are blue in the face that it is illegal to account share, but, as long as the second password is in place as currently designed, account sharing is still given an avenue.

If account sharing were illegal, they would remove the second password from the game and institute a secondary warning message before sailors are deleted which would accomplish their originally intended action while also removing barriers from an account currently in place.

Arguing that account sharing is illegal while the levels of security for accounts is different between the forums and the game is a pointless argument.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 05:35


Nachmorsi
it is that, mako. However, it isn't just us and pretty much the reasons I listed are applicable to a large variety of fleets. Allowing our fleet members to try other ships is probably more limited to our fleet (hence why I didn't list it) since I think we share a lot more than other fleets especially given the size of our fleet.


Piombo -

If you really want to be a part of 'EULA police" then take a look at the section on user name rules and go wild.

You are missing my point, but instead of arguing how about we look at how it affects *you*.

If you actually were hacked (maybe someone was pissed off at you or was simply bored) and someone worked out your first password.

As it is now, your PIN is pretty much pointless. The hacker can change your email address and reset the PIN with just that password until SDE web developers re-code that section.

With my suggestion you re-gain the security benefit of having the PIN number until the re-coding.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 05:58


JosephLittle
Keep beating up that straw man Foxhound, I bet it feels good.


http://en.wikipedia.org/wiki/Straw_man


Edit: To put it this way,

No one should be happy their accounts aren't as safe as before, regardless if they have shared out their password or not.

Downgrading account security levels KNOWING people (used to) share accounts is downright irresponsible and unprofessional.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 06:54


joshmon999
Uh, actually , it's funny someone would actually USE the Straw Man Gambit, by actually saying someone else is using it, lol. Straight up, he said he was behind the second password being used for general security reasons, but if your point is involving account sharing then refer to EULA.
Some remarked above "the designers claimed it was for security , but we all KNOW it was for account sharing" Ok, so you can read the minds of the Devs..... and that makes your argument correct.
Also it was said that the EULA wasnt written for this game blah blah..... Who cares dude? Cry more. I run a business that uses about 5 types of contract. Guess where I got them? From a generic contract site. Tweaked them to fit my needs and they work great. The point is, it says what it says, and always has, so if you dont agree with the EULA (which has been there since the first day you ever logged in and hasnt changed) then move on.
Since it seems like It only matters mainly to the segment of the game that is pretty much singlehandedly responsible for ruining it's playability and mass appeal in the first place (lag issues aside) I could really care less. Dont share accounts and STFU. Noone cares about your crying. Noone cares about your opinion. Noone is going to sort through endless messes trying to sort out your 'hacked accounts anymore'. And I'm glad. More power to SDE. I'm sick of reading about it, hearing about it. And I am CERTAIN I am not the only one.
Honestly, I just reread what I typed and cracked up. The idea of you people telling devs what they intended or not, or negating a contract you sign every time you log in because its somehow 'invalid'. Bet you still believe Obama wasn't born in Hawaii, lol.
Oh, and feel free to correct me, but doesnt the account verification only last for 30 min? After that, you need to re-verify to change account info. So yeah , I guess if a person is able to log onto your account within 30 min of you verifying it for one reason or another then they could scrw you. But is fairly unlkikely, and I thought that was why it was designed that way in the fiest place. Again correct me if im wrong. So basically, as long as you dont use the same password for email as NF you are all set.
As far as the "changing something when they KNOW ppl are breaking the rules anyway being irresponsible" I laughed out loud at that one. "Hmmm I want to change things a bit, but I won't because people refuse to accept that certain things are not allowed or even encouraged."
News Flash: Maybe they didnt institute the PIN to facilitate sharing, maybe they did it to avoid a few hours a week straightening out moronic account sharing people's messes. Now you want to use that as evidence they secretly approve of account sharing?

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 08:20


Gtdawg
"Since it seems like It only matters mainly to the segment of the game that is pretty much singlehandedly responsible for ruining it's playability and mass appeal in the first place (lag issues aside) I could really care less"

How do you make that determination?

I let someone on to my account some 3+ years ago to play in an HA when I wasn't around. However, you can ask anyone how often I share my account. I can guarantee there is not a single person on the server (in or out of my fleet) that knows the password to my account.

I am not the least bit affected or worried that my account is more vulnerable since I don't share my password.

However, I am disappointed that it is so easy to change a verified email and steal someone's account.

That you have determined that I am part of the group that has destroyed this game...not even sure where you got that.

-------------
Also, yes, if you look at what the trade password controls, you can make an assumption on what it was designed to do.

It was stated that the second password was to prevent the accidental deletion of sailors. If that is the case, why is the second password used to restrict access to the trade system, the HQ, and the item section?

And, why was it used as a second password for email verification on the old website?

Can you answer either of the two questions in a reasonable way that doesn't imply that the second password is to restrict access to shared accounts to make it easier to borrow/share accounts?

As for the EULA, I pointed out that it was humorous that people were parroting the EULA when it wasn't written for the game. The TNF mods are adding nothing to the discussion other than repeating a company line that isn't even SDE's line. We could point out the parts that mention gold or some such and declare the game broken since it doesn't include that stuff, right? I mean, it says it right in the EULA...so where is it? Or, is it ok to disregard certain parts of the EULA just because?

I have no intention of ever submitting a ticket about my account being hacked because I know it won't ever happen. Considering I've given my account password to one person in 5 years, I'm not too worried about it.

I have no idea what the Obama being born in Hawaii thing has to do with anyone.

====================
"Oh, and feel free to correct me, but doesnt the account verification only last for 30 min? After that, you need to re-verify to change account info. So yeah , I guess if a person is able to log onto your account within 30 min of you verifying it for one reason or another then they could scrw you. But is fairly unlkikely, and I thought that was why it was designed that way in the fiest place. Again correct me if im wrong. So basically, as long as you dont use the same password for email as NF you are all set. "

If you have someone's password, it is possible to change the verified email on the account without any notification going to the original account holder.

Once you do that, you get the new confirmation code.

At this point, you can change the password with the NEW verified email. The original account holder wouldn't know that his password was changed.

Then, with the new password and new verified email, you can change the trade password.

A person has successfully stolen an account and they have no recourse whatsoever (GMs will just say don't share) and they were never notified that any of this was happening.

On the old site, you had to put in the password and the trade password to change the verified email. There is no reasonable explanation to lower the security level on the new site and then proclaim the new site as having improved security.

===========
"News Flash: Maybe they didnt institute the PIN to facilitate sharing, maybe they did it to avoid a few hours a week straightening out moronic account sharing people's messes. Now you want to use that as evidence they secretly approve of account sharing?"

That's what tacit approval means, dude.

If they instituted a second password system to improve the security of an account because they didn't want to deal with hacked account support tickets, then that means they approve of account sharing. It means they are actively working to make accounts more secure during account sharing.

If they didn't give their tacit approval, they wouldn't have ever put in the second password and they would continue to tell people "Don't account share. We won't fix it".

If the second password is still in the game, that means they feel it is needed for improved security to prevent certain actions that occur during account sharing. If they feel it is needed in-game, why do they feel it is NOT needed on the forums?

If they feel the only level of security needed is the password (as they do on the forums), then they should remove the second password in-game and just tell people not to share accounts.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 09:23


richardphat
The new website reduce the security level of the game, not enhanced it.



How hard is it to understand that simple sentence?

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 09:29


joshmon999
Lol, Again , you didn't say whether or not the verification expires, I believe it does. So then no, you need to have the person's Login, password, their email, and password for that. Otherwise this needs to occur within the 30 min time frame. This seems to be why it was done this way. Again, I may be wrong , but I don't believe so.
Also, "tacit approval" ?? They implemented a system of PIN and gave their reason for it. End of Story. If you're going to put thoughts in people's heads, or say"you did THIS, so THAT must be so" is the height of logical failure. "You can make assumptions" blah blah blah. Yes, a person dead set on ignoring all evidence to the contrary can make all the assumptions they want, but it doesnt change the reality on the ground.
They've said over and over again they don't want account sharing. They try to be nice and just put a PIN in, instead of telling ppl to screw off, and to help them make a better determination of "hacking" or not, but their reasons are their own. Lol, ppl like you will always try to take kindnesses like that and turn it into "tacit" approval. Or decide what it must mean they are 'really' thinking.
Well it doesn't sound like its "tacitly approved" anymore does it?
As far as the account info, again , someone correct me if im wrong, but the first thing it says when you verify is that you need to re-verify after 30 min. This prevents account theft.
as far as sharing in general, I think it's lame. An HA is about team vs team, player vs player. Anyone complaining about that is just sorry they cant pile another 20 + BB6 into an HA, so instead of the big power hitters they should be , they are the minimum standard for sucess, thus preserving the unspoken advantages of having the oldest accounts on the server, or old retired ghost accounts brought out for HA and alt accounts. If i have 2 accounts, how is it fair to let another person play it during HA. The rules state that fleet jumping is off limits, so they already have issues with unfailry fluffing your fleet for HA, how is this any different?
Oh. Because it benefits YOU.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 09:45


V2CxBongRipz
Originally Posted by Foxhound31
Originally Posted by V2CxBongRipz
Originally Posted by Foxhound31
the million dollar answer...

Don't account share :P



The million dollar answer... say something productive or gtfo. I mean seriously you guys represent SDE and this is the kind of crap you post.


ACCOUNT SHARING RULES
=============================================================
=============================================================
=============================================================

Dear Members of Navyfield,

I would like to remind players not to share accounts or use the same password in any other
public place which may be the same as your account for Navyfield.

Those of you who continue to share accounts, Moderators and GMs of SDE cannot assist
players any longer in recovery efforts. Consider this your final warning!!

This will extend to lending of sailors and ships to other players in the game. All trades
are final!!

For a reminder for those who haven't read the EULA:

D. During the registration process, you will be required to select a user name and a
password that are specific to your Account (collectively referred to hereunder
as "Password"). Your Password is to be kept confidential at all times and you are
solely responsible for the security of your Password and your Account. You may not
disclose your Password to anyone, or allow your Password to be used by any one
beside yourself or your one (1) minor child to play the Navy Field. Any damage or
harm that may result to your Account, or to the Navy Field, due to lost or deleted
characters due to your disclosure of your Password, or due to the discovery of your
Password by a third party, is your sole responsibility. Note that your user name shall
be subject to the naming guidelines contained in this Terms of Use Agreement.

E. SD EnterNet does not recognize the transfer of Accounts between individuals.
Sharing of accounts and account passwords is forbidden, to do so allows SD
EnterNet and TeamNF to terminate your account rights. This action is in response
prevent theft from such sharing. Additionally, note that there are no refunds if you
decide to "terminate" your Account early as the Service will be available for your use
until the time that you have purchased on the Service expires.

That is all.
=============================================================
=============================================================
=============================================================
=============================================================
=============================================================

If you want to take the risk with your account and share it that is YOUR PROBLEM.


It is too funny that you quote a EULA that TNF dosnt enforce. Even funnier is that TNF will only quote the EULA when its convenient to them. Have you ever heard of someone having their account terminated for account sharing? TNF's stance has always been that they wont help you if you share your account with someone and they take your stuff. Thats fine though we've always had a certain amount of security. Before the second password atleast the account itself was safe. With the second password someone could easily lend out an account and not worry about things going missing. Now what? All someone needs now is your first password and they have everything. We have actually gone BACKWARDS in security to the point that our accounts are less secure now then they have been since I started playing.

Also something that should not be overlooked is people that are away for any reason such as school, military service, or just put the game down for a period of time. What happens if those people have given their password to someone in the past? Are they all of a sudden SOL if the account they thought was secure all of a sudden ends up stolen?

Oh an something else I wonder... How secure is this website really? If someone can hack the Playstation network for account details whats to stop someone from hacking this website? I would assume Sony's network would be more secure considering they have more money to throw at that. All a hacker needs is the passwords and he has all.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 10:03


nikitas
I can't get the thinking of some people.
Whether you agree with account sharing totally, agree in some circumstances or disagree totally, whether the excuse for the trade password is hacking and not account sharing, cant you just see this:


For WHATEVER reason SDE coded a trade password for ingame. This added some security, it is a good thing.
With the new website, if someone with ANY way gets your first password, he changes your email to his (and you are not informed about this), and with the email changed he can change your trade password...

So, the trade password that SDE worked on so hard and for so long, is now just useless... Can't you see this?

P.S. I have never shared an account with anyone, but I know, understand and accept that some may do this inside fleets for fun, help etc

1 2 3 4