Something that Blizzard does that I think SE should look in to.

First off this is not a bashing thread This is about security of accounts.

Ever play WoW? I abashedly admit that I did for 3 years. However there is one thing that they did that was brilliant.

If you logged out from one IP address. Then someone tried to log in say, the next state/country ocean away they would automatically lock your account until you went in and changed your password. There was no investigation and no backlash to honest players. Except that you might lose some items or money that were loaded off your character while your account was accessed.

It's certainly a more sound tactic than suspending your customers for nothing.

Se needs to find something like this to do instead of banning their paying customers to the point that anyone who heard about this sort of thing would completely avoid the game. It certainly makes more sense than letting someone log in to an account that is NA based from China or where ever these bastards hail from. It may be a hassle if it happens repeatedly but I would rather this then locked out of my account for the next 12-18 days for something I didn't do.

Since I keep seeing people say that they already do something similar let me state it here. THEY DO NOT! My account was accessed as I slept. Stayed on long enough to spam for RMT sites. Apparently enough to have players report it. I NEVER received an email from them until 2 days after the fact and my account was already suspended. In fact I just made another point. What good does a "in time key" do you if you're say asleep? At work with no access to your key. Or if they fail to notify you?

More games need to steal trions coin lock system imo, the moment your account is accessed from a location far from usual, your character gets "coin locked" and you get sent a code via email,lock is removed upon entering the code.
They can log in, but are unable to shout, mail, drop items etc.
All they can really do is earn you money O_o

Good idea, i see a lot of MMO did that. It help prevent account hacking a bit, but not really help fighting RMT. (I think that what people are being banned for.)

Quote:

---

Originally Posted by Elegance

More games need to steal trions coin lock system imo, the moment your account is accessed from a location far from usual, your character gets "coin locked" and you get sent a code via email,lock is removed upon entering the code.
They can log in, but are unable to shout, mail, drop items etc.
All they can really do is earn you money O_o

---

I agree with this.

I also think they need to take a page from Atlantica Online. You have a 4 digit code when you log in from a different computer. Its input by Mouse (so a little more difficult for key-loggers)

Rift Coin Lock was an elegant and seemingly simple solution for account security for sure.

Under impression GW2 does the same thing.

There is other ways to stop theft as well by making it pointless to hack accounts, steal gold, and re-sell it. Best way is to have SE regulate/sell their own currency and cut the criminal element out entirely. If RMTs can't make a profit and or encounter to many road blocks to do so, then they WILL move on; I guarantee it. If a game currency has RL value and there is a large demand for it, then the hacking will continue. Sadly this might mean pay to win, but I see no real good alternative.

They already do this. Well, I know they send out warnings of suspicious activity and make you change your password, anyways.

It's weird, because I tried to let my buddy log into my account during beta (he lives in WA and I live in MI) and an error popped up and SE locked my account until I changed my password. Do they not do that anymore?

As far as I was aware, this was supposed to happen until you manually disabled the option. One person I know that got hacked had actually disabled this, and as such, had no idea his account was accessed.

In Vindictus they have a secondary pin password. The pin is required to be 6-12 characters, it is a clickable keyboard only so keylogging would be impossible, also the characters on the keyboard changes places randomly so it would prevent a bot program for the pin. There have been no reports of a hacked account in that game so far with it.

Quote:

---

Originally Posted by Remn

Good idea, i see a lot of MMO did that. It help prevent account hacking a bit, but not really help fighting RMT. (I think that what people are being banned for.)

---

You get suspended if someone obtains access to your account and uses it to shout for RMT. That is currently what I am going through.

Quote:

---

Originally Posted by Amyas

They already do this. Well, I know they send out warnings of suspicious activity and make you change your password, anyways.

---

I recieved no email from SE until 3 days after my account was suspended. So I would have to say no, they don't.

Quote:

---

Originally Posted by JayvirDeforte

It's weird, because I tried to let my buddy log into my account during beta (he lives in WA and I live in MI) and an error popped up and SE locked my account until I changed my password. Do they not do that anymore?

As far as I was aware, this was supposed to happen until you manually disabled the option. One person I know that got hacked had actually disabled this, and as such, had no idea his account was accessed.

---

My account was recently accessed by an unknown person and used to shout for RMT. I didn't change settings as far as security goes. Unless they somehow managed to mask their IP as mine. Suppose it's not beyond the realm of possiblity.

Scarlet blade (i know) has the software keyboard with a i think 9 digit number that you have to input, the numbers change position randomly as does the pad where to input the numbers. I think that was a pretty cool solution to account security without the need of the token system some people apparently are against.

Quote:

---

Originally Posted by Hed

First off this is not a bashing thread This is about security of accounts.

Ever play WoW? I abashedly admit that I did for 3 years. However there is one thing that they did that was brilliant.

If you logged out from one IP address. Then someone tried to log in say, the next state/country ocean away they would automatically lock your account until you went in and changed your password. There was no investigation and no backlash to honest players. Except that you might lose some items or money that were loaded off your character while your account was accessed.

It's certainly a more sound tactic than suspending your customers for nothing.

Se needs to find something like this to do instead of banning their paying customers to the point that anyone who heard about this sort of thing would completely avoid the game. It certainly makes more sense than letting someone log in to an account that is NA based from China or where ever these bastards hail from. It may be a hassle if it happens repeatedly but I would rather this then locked out of my account for the next 12-18 days for something I didn't do.

---

Get a keyfob?

No seriously. I am sick of people saying 'SE should do this' 'SE should do that' when they already have done something.

Quote:

---

Originally Posted by necrosis

Get a keyfob?

No seriously. I am sick of people saying 'SE should do this' 'SE should do that' when they already have done something.

---

There are also people who ALREADY have them and still got hacked. The point is that there are no pro active measurements that they have taken if something DOES happen. They only react. I'm sick of people acting like it's only the fault of the player.

You know they give you security measures to protect yourself. Maybe you should use it.

Quote:

---

Originally Posted by Taeyeon

You know they give you security measures to protect yourself. Maybe you should use it.

---

Not everyone has a smartphone. Not everyone can afford to rush out and buy a security token. Not everyone who may have just decided to try out their first MMO knows of these security measures. So then, what are the options?

I made a suggestion for the safety of SE's customers and/or future customers. Could I have used the app for my phone? Yes, that was my bad. Did I go around to different sites looking for information on the game to best plot what to look for and where? Yes, that its what resulted in an extension to be added to my browser without my knowledge. Also my fault.

Does any of this mean that SE couldn't take an extra precaution for the benefit of their customer? No.

You were born with a brain, use it. If you don't like my suggestion be on your merry way. No one needs your condescending remarks.

The same type of people who dont read information that is given to them which states that for security measures they should use the one the key which is available on PC aswell I believe are the same type of people who usually dont read t&c's; although I am one of those people. They need to learn themselves, they also wouldve got an email to use the ine time key. Also people who get hacked even with the one time key deserve a medal. No one told me anything about this stuff when I first started.


Also In this day and age where kids
have iphones and what not, im sure people can spend under 100 to buy a "smartphone"

Pretty sure this is already in place? Back before I had a token in 1.x, I logged into the game from different 'countries' (I have to use vpn for gameplay smoothness) and I got temporarily blocked from even logging in until I sorted it out. During ARR beta I've seen people complain about being locked out of their account because they were trying to log in from multiple countries (trying to share account with friend during beta). I still need to use vpn (especially more so now that the server is in montreal) but ever since I used token, I dont have a country 'check' now, thankfully.

Quote:

---

Originally Posted by Taeyeon

The same type of people who dont read information that is given to them which states that for security measures they should use the one the key which is available on PC aswell I believe are the same type of people who usually dont read t&c's; although I am one of those people. They need to learn themselves, they also wouldve got an email to use the ine time key. Also people who get hacked even with the one time key deserve a medal. No one told me anything about this stuff when I first started.


Also In this day and age where kids
have iphones and what not, im sure people can spend under 100 to buy a "smartphone"

---

I absolutely hate my smartphone, the damn thing needs a recharge almost every day and becomes completely useless in if there's even a drop of water on the screen or below 0 degrees outside. Just ordered an 'old-school' phone, and it can't get here soon enough. I already have the sledgehammer waiting.

Sure, you can get a regular authenticator, but I don't really see the harm in additional precautions. To tell you the truth, I would very much prefer a system akin to Rift over the authenticator, or you know, both.

Quick question, why does the current ARR launcher not have a pop up keyboard/clicky for username/password/token whereas logging into the forum or account does?

Yes! Thank you! Its simple stuff and highly effective at lowering RMT! I personally prefer the coin lock method used by Trion where it pretty much blocked everything an RMT hacker would want... no long range chat, no access to inventory, gold, mail, gear, and a very annoying Coin Lock icon that only goes away when you enter a code thats immidiately sent to your phone and/or email when your IP changed (I may have the details wrong but you get the idea).

It can get annoying to some whose IP changes a lot (PPPoE?) but you can probably call your ISP for that. Maybe they can disable the coin lock for those who have that security app?

Quote:

---

Originally Posted by Elegance

More games need to steal trions coin lock system imo, the moment your account is accessed from a location far from usual, your character gets "coin locked" and you get sent a code via email,lock is removed upon entering the code.
They can log in, but are unable to shout, mail, drop items etc.
All they can really do is earn you money O_o

---

I agree, TRION's method is very good. Square Enix should copy it!

I entered my password wrong the website while registering FFVII and they locked me out by emailing me and telling me to change my password (even though I have a security token).

So as far as I know the system is already in place. The people getting hacked apparently got the password right the first time.

This was definitely in beta. Not sure why it'd be disabled now, but it was certainly in place during phase 3.

NCSoft does this as well. If a new IP address tries to access the game from your account it will prevent access until confirmation is obtained thru email. Steam does this as well. In fact... lots of services do.

If there is something of the sort already in place as several of you have suggested I would like to know why it didn't work in my case. I've never changed any settings on the launcher or security settings for my SE account. If it were in place and effective then myself and who knows how many others would not be having to wait for an investigation to take place.I never entered my password for SE or the game of forums on any other site.

Unless they disabled the system since the beta they already do this.

It was incredibly annoying that I had to constantly reset my password so I got the software token application instead.

Terra has some thing like this, if some one try's to log in from another IP, its locks it and send a code to your e-mail, you have to enter this code before you can log in

Quote:

---

Originally Posted by Amyas

They already do this. Well, I know they send out warnings of suspicious activity and make you change your password, anyways.

---

They sent out an automated email stating the termination of my account two days after I discovered I was hacked. No warning. No notice of a pending investigation. No evidence against me on their part. No instructions for me to contact anyone if this termination was done in error. Just an outright lifetime ban. I had to go on this forum to find a contact number since the email did not provide any way to contact Customer Support. I never visited any unofficial FFXIV sites since I only am available to play a couple hours per week. And I am aware of security measures since the agency I work for has about a dozen or so logins per employee which expire every three weeks, and require us to contact a call center with a supervisor on the line, as we state a secret hash ID, sing the star spangled banner, and hop on one foot.

If SE put even a fraction of the effort my agency has us go through in regards to security this thread would have no reason to exist. Instead, you see legitimate players get suspended for an economy SE created while the real culprits: the bots, spammers, and hackers continue on their merry way with no course of action.

Quote:

---

Originally Posted by Lucipurr

In Vindictus they have a secondary pin password. The pin is required to be 6-12 characters, it is a clickable keyboard only so keylogging would be impossible, also the characters on the keyboard changes places randomly so it would prevent a bot program for the pin. There have been no reports of a hacked account in that game so far with it.

---

Ragnarok Online 2 has a similar system - you're required to enter a 4 digit PIN using only the mouse and the keys are always randomly placed. It's a simple thing but it seems to have been effective.

Quote:

---

Originally Posted by Gilthas

Unless they disabled the system since the beta they already do this.

It was incredibly annoying that I had to constantly reset my password so I got the software token application instead.

---

If they did tis during beta then why is it not here now? That makes little to no sense whatsoever.