ID
Password
FlashGuide
FlashGuide
HA Infomation

General Discussion

  Index

  • Possible simple solution to account sharing/password security issue

    06. 23. 2011 19:52


Nachmorsi
So there appears to be a big loophole in that you can change all the account details (including email address for verification) online with just the password. This poses a huge risk for those who account share. 
 
My understanding is if you don't remember your PIN then you have to send a support ticket and send an email to "verify" you are the account holder. However, with just the password you can change the email address to your own and claim to be the actual account holder. This amounts to everything on the account possibly being deleted, swapped, etc. 
 
If that were to happen then TNF/SDE has a nice massive headache which I can't blame them for wanting to avoid. 
 
However, I think there is a simple solution that could at least partially solve this issue so that it is like it was on the old website and still allow people to account share without vastly increasing the workload of TNF/SDE. It is more a temporary fix, but it could at least save a bit of a headache. 
 
People can post in a thread/forum/support ticket on the actual account saying that they do not want their PIN to be able to be reset. People who post have their username added to a list (e.g. in notepad or excel).
 
From there on, if anybody sends in a support ticket asking for the PIN to be reset then the GM just has to open the list, ctrl+f and type in the username. If it is there, then deny the change and wait for the real account owner to contact them. If the username isn't on the list then go about as they would do usually.
 
Simple and it should restore some security pleasing both customers and representatives and there is no ambiguity about it.
 
It could also go one step further and people could add their email account meaning the 2nd pw can be reset, but only using the designated email account. 
 
What are people's thoughts on this?
 

 

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 10:10


Gtdawg
Originally Posted by joshmon999
Lol, Again , you didn't say whether or not the verification expires, I believe it does. So then no, you need to have the person's Login, password, their email, and password for that. Otherwise this needs to occur within the 30 min time frame. This seems to be why it was done this way. Again, I may be wrong , but I don't believe so.


You do realize that the confirmation code goes to the new email address, right? Perhaps you are unaware of that fact, because it seems as though you don't understand how the process works when changing your email.

Look at your account settings again. When you change the email, you get the confirmation code at the NEW email address. Therefore, I don't need the login and password for your email address.

I doubt someone would be so adamant in their stance without realizing that. It'd be quite embarrassing for you if you were blabbering away without knowing how it worked.

Copied directly from the page on the change email section:

Password :
New E-mail :
Confirmation Code :

A Confirmation Code will be sent out to your new email address after you click the “Confirmation Code” button.
Please contact one of our assistants if you have a problem with verifying your email address.

===
I am unsure why you believe someone would need a person's email login and password. You need none of that.

Originally Posted by joshmon999
Also, "tacit approval" ?? They implemented a system of PIN and gave their reason for it. End of Story. If you're going to put thoughts in people's heads, or say"you did THIS, so THAT must be so" is the height of logical failure. "You can make assumptions" blah blah blah. Yes, a person dead set on ignoring all evidence to the contrary can make all the assumptions they want, but it doesnt change the reality on the ground.
They've said over and over again they don't want account sharing. They try to be nice and just put a PIN in, instead of telling ppl to screw off, and to help them make a better determination of "hacking" or not, but their reasons are their own. Lol, ppl like you will always try to take kindnesses like that and turn it into "tacit" approval. Or decide what it must mean they are 'really' thinking.
Well it doesn't sound like its "tacitly approved" anymore does it?


Are you unaware of what tacit approval means? Implied approval through inferred actions. Yes, SDE has consistently stated that they do not approve of account sharing.

However, as I stated earlier, there is no clear explanation as to why the second password is needed to access the trade system, the HQ, or the item shop.

You didn't answer the questions I proposed earlier, either.

If the second password was designed to prevent the deletion of sailors (as has been stated multiple times), why was it used as an additional password for email verification on the old site? Why is it used to access the HQ, trade system, and item shop?

If it were designed to prevent the accidental deletion of sailors, then there is no reason to have it implemented in other areas, correct?

And, when looking at WHERE the second password was implemented, it doesn't take a rocket surgeon to see what it was designed to block.

You have to be quite dense to not see what the second password was designed to prevent.


Originally Posted by joshmon999
As far as the account info, again , someone correct me if im wrong, but the first thing it says when you verify is that you need to re-verify after 30 min. This prevents account theft.


How does that prevent account theft? I can enter a new email and have it verified. Then, I can change the account password. Then, I can change the second password using my new email and password. You seem to not understand how the verification works.

The confirmation code is only valid for 30 minutes.

However, there is nothing in there restricting the ability to change passwords or emails within a 30 minute timeframe.

This is the second or third time that I've explained the process. Yet, you seem to be going off on your own tangent of how you believe the system to be set up and it doesn't make any sense. You are free to disagree with my explanations of the second password, but you probably shouldn't also ignore how things work or are designed.

Personally, it looks as though my reasoning of how the second password works is quite a bit more understandable than your understanding of the verification process.

Originally Posted by joshmon999
as far as sharing in general, I think it's lame. An HA is about team vs team, player vs player. Anyone complaining about that is just sorry they cant pile another 20 + BB6 into an HA, so instead of the big power hitters they should be , they are the minimum standard for sucess, thus preserving the unspoken advantages of having the oldest accounts on the server, or old retired ghost accounts brought out for HA and alt accounts. If i have 2 accounts, how is it fair to let another person play it during HA. The rules state that fleet jumping is off limits, so they already have issues with unfailry fluffing your fleet for HA, how is this any different?
Oh. Because it benefits YOU.


It doesn't benefit me in the slightest. In fact, the fleet that I am in has been quite vocal AGAINST the idea of fleet jumping, mercenaries, and account sharing for HA purposes.

I am pushing for increased security on the website concerning the email verification process. And, this increased security would directly benefit fleets that pawn off dozens of accounts for HA purposes to other fleet memebers or other fleets.

That would be a detriment to my fleet. It would be advantageous for me to keep my mouth shut and chuckle at all the fleets that can't bring 100 people to an HA anymore without a fear of losing accounts.

Jedi struggles to bring 35 or 40 people to an HA and the only accounts used by the non-original user are usually accounts where the person has long since quit or retired from the game, but has left their account in Jedi (some owners have been gone for 2+ years).

It would be of great benefit to our fleet, in particular, if all other fleets were restricted from account sharing.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 13:41


Piombo
put it this way accnt sharing is by no means Different then CHEATING the game and player base to gain advantage over others as much as CREDIT hacks & LVL hacks ect. and to use a point like so my buds can play dif ship and have fun from there usual grind is stupid if thats the case why not be like the rest and lvl a new BO i have not read any thing in this thread to support any claims for accnt sharing ive never shared mine and never will closest you'll get to my accnt is my ID name and i dont use others ethier all your points on this matter are mute and since you all admit to accnt sharing is dumb as well its like calling the cops on your self for breaking a Law if the rules no matter how dumb say dont do it well then dont do it plain and simple if you dont do it then there is never gonna be an issue with ur accnt "HACKED" or what ever just grow up and get over it .

example ; If im in my room looking at porn and doing my thing and you knock on my door and i say dont come in im masterbating go away but you come in any way and get discusted at me thats your fault for not listening .

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 15:12


Piombo
ok here is a more apropreate example;

if your told guns hurt and kill ppl so dont play with guns and you get a hold of a gun and shoot your friend in the face or better off your self then its your fault not the guns cause you dont know how to follow rules is your failure .

rules of firearms safety,
#1 always keep firearm pointed down and away from self .
#2 always keep the firearms safety on .
#3 always make sure chamber/firearm is not loaded .
#4 always keep the firearm on the target while shooting .
#5 always keep both eyes on the target while using firearm .
#6 always make sure the firearm is properly secured/locked-up .

these things imply safety with firearms which is no different then the rules NF SDE apply to account sharing .

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 15:21


Foxhound31
Originally Posted by Foxhound31
I just realized that we're arguing two completely different issues.

I think some clarification is needed.

I am NOT against the implementation of a second pin in order for the e-mail change to happen etc. If something can be brought in to improve account security I am all for that.

HOWEVER, what I've been trying to say is for people that do share their accounts and end up getting hacked (even after a second pin system for e-mail etc is implemented) then that is your problem. You are responsible for your own account and if you choose to give out information to someone else and it ends up biting you back then that's your problem.

We were literally talking about apples and oranges.


Before some of you go right ahead and start bashing me, PLEASE for the love of GOD read what I am REALLY saying here. I am NOT against implementing a PIN, I am against people sharing their accounts, getting hacked and then crying about it.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 15:27


britain
why dont ask secondary passowrd during email changing?

I know the some fleet will ask your password, so they can let your fleet mate to play your BB6 during HA if you dont have time then......

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 15:36


Piombo
Originally Posted by britain
why dont ask secondary passowrd during email changing?

I know the some fleet will ask your password, so they can let your fleet mate to play your BB6 during HA if you dont have time then......

because that is against the rules of NF SDE and is not supported bye them and is CHEATING i dont support shared accnts either like Fox but for the Cheating aspect of it since we have events and such that ppl CHEAT by using a shared accnts to reap rewards they clearly dont desever since they dont or cant do it on there own for instince like the lvling Events we had for the MN and SN nation 1st to reach X amount lvl wins this or that has all been done thro shared accnts

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 19:19


Nachmorsi
You still haven't admitted that security has weakened since the new website, piombo. Regardless of your view on account sharing, it affects everyone - even non-account sharers.


Also, you're posts make it clear that you don't understand (or don't want to understand) the arguments being made in this thread. You would rather just spout your view that account sharers are just as bad as hackers and credit exploiters. That is fine; it is your opinion. However, SDE's opinion on account sharing is actually different to yours.

Using your own example of the SN leveling event -
"- Checks will be made to ensure the 6 qualifying sailors have not been traded in to
an account. We will not look for any account sharing during the event; however,
same policy as always - if any problems occur with the account and sharing is
evident then we reserve the right not to provide any assistance with the problem."

The rule is to cover their backsides - it is not something they actively go out and enforce.
You clearly think it should be actively enforced.

You're standing separately to not just account sharers, but TNF/SDE as well, mate.

P.S.
The first level 120 SN player in the SN event apparently did it all on his own bar maybe half a dozen games.

  • Re : Possible simple solution to account sharing/password security issue

    06. 24. 2011 19:57


Piombo
Originally Posted by Nachmorsi
You still haven't admitted that security has weakened since the new website, piombo. Regardless of your view on account sharing, it affects everyone - even non-account sharers.


Also, you're posts make it clear that you don't understand (or don't want to understand) the arguments being made in this thread. You would rather just spout your view that account sharers are just as bad as hackers and credit exploiters. That is fine; it is your opinion. However, SDE's opinion on account sharing is actually different to yours.

Using your own example of the SN leveling event -
"- Checks will be made to ensure the 6 qualifying sailors have not been traded in to
an account. We will not look for any account sharing during the event; however,
same policy as always - if any problems occur with the account and sharing is
evident then we reserve the right not to provide any assistance with the problem."

The rule is to cover their backsides - it is not something they actively go out and enforce.
You clearly think it should be actively enforced.

You're standing separately to not just account sharers, but TNF/SDE as well, mate.

P.S.
The first level 120 SN player in the SN event apparently did it all on his own bar maybe half a dozen games.

TY for your support of personal oppion and not bashing but i still dont see any issue with the integraty of the security of accnts at hand if you dont share accnts there is no worries for you ive never shared my accnt so im not even concerned if they took the 2nd PW away making it even less secure then you say it is now cause Hacking a NF PW there is a Googleplex of possiblitys of wat the PW actualy is not to mention it takes hacking programs & tools to do any of it which is illeagal if you feel so un safe with it all then just stop sharing your PW with others all in all it comes down to the point that you cant trust you own Grandmother with ur PW let alone another person on NF no matter how well you think you know them or nice they are cause the world is full of thieves and NF is no exception to them and since you have ppl from around the world on here that means your dealing with more thieves then Normal .

example ; Take a look at the Trade system in-game look at all the scammers that have posted stuff for sell there all kinds of crap being sold as +12 or +11s when they are rly +9s ect. this alone should tell you not to trust ppl in this game as much as you think you can of course ppl in this comunity will try an screw you the 1st chance they get cause nobody here expects any real punishment to befall them but im not saying you cant trust everyone just 96% of them .

P.S. if you rly want somthing done about it you gotta go through better channels then this like Mass support tickets + a thread in Suggestions to get recomendations and maybe msg Yuno him self via Twitter other ways then a Genral thread work way better .

1 2 3 4