Someon has been attempting to log into my account all day.

Printable View

10-16-2013, 02:17 PM
PapaSteel

Someon has been attempting to log into my account all day.

Luckily, I only get booted from the server thanks to the authentication error.
However, this has happened twenty times today and it makes playing impossible, and I'm obviously more than a little nervous.

Any solution to this?
10-16-2013, 02:20 PM
Ruri

Do you have a one time password thingy?
10-16-2013, 02:20 PM
Velox

change your password obviously
10-16-2013, 02:24 PM
Alhanelem

Quote:

Originally Posted by PapaSteel

Luckily, I only get booted from the server thanks to the authentication error.
However, this has happened twenty times today and it makes playing impossible, and I'm obviously more than a little nervous.

Any solution to this?

Nobody's trying to log into your account. It's some kind of server error.
10-16-2013, 02:25 PM
Zholi

Quote:

Originally Posted by PapaSteel

Luckily, I only get booted from the server thanks to the authentication error.
However, this has happened twenty times today and it makes playing impossible, and I'm obviously more than a little nervous.

Any solution to this?

That's happening to everyone.
10-16-2013, 02:26 PM
Ruri

Not sure what the exact error is, but I would try to get the one-time password app or the keychain thing. Makes it much more difficult for users to try and get into your account.
10-16-2013, 02:37 PM
viion

Quote:

Originally Posted by Ruri

Not sure what the exact error is, but I would try to get the one-time password app or the keychain thing. Makes it much more difficult for users to try and get into your account.

sadly, with this game, it does jackall. It can be bypassed.
10-16-2013, 02:40 PM
Kn3xis

I was getting the same error, with a little less frequency. I am using the security token and I even changed my password. I already submitted a ticket to see what was happening.
10-16-2013, 02:51 PM
Zfz

Hackers are using randomized session IDs to connect with the servers! Oh noes!

I also got authentication error twice since last night. Either they changed something or the hackers really are doing mass brute force...
10-16-2013, 02:52 PM
PapaSteel

Huh. Fascinating.

Well, thanks guys!
10-16-2013, 04:23 PM
ZohnoReecho

Quote:

Originally Posted by viion

sadly, with this game, it does jackall. It can be bypassed.

Don't spread false info please. People are dumb enough for not using one (who can). Now we just need to promote the non use of the token.
10-16-2013, 07:06 PM
Jwrigh7784

Quote:

Originally Posted by ZohnoReecho

Don't spread false info please. People are dumb enough for not using one (who can). Now we just need to promote the non use of the token.

Actually, the authenticator can be bypassed. Someone pointed out a massive security flaw that bypasses the launcher and lets anyone log into any account and all they need is the session ID which is surprisingly easy to obtain. I have personally witnessed this and am shocked at such a security flaw.
10-16-2013, 07:37 PM
whoopeeragon

Quote:

Originally Posted by Jwrigh7784

Actually, the authenticator can be bypassed. Someone pointed out a massive security flaw that bypasses the launcher and lets anyone log into any account and all they need is the session ID which is surprisingly easy to obtain. I have personally witnessed this and am shocked at such a security flaw.

Apparently, they have fixed it to be IP-locked now? I don't know the specifics, but people have been reporting that when they log in from a different IP, their account gets locked until they confirm it through email etc. Similar to how things worked in 1.0. For people with dynamic IPs, maybe it will be a hassle, but I think it's a welcome change. I'm not sure how this will affect session IDs, but nonetheless, it will make logins from external areas a bit harder.
10-18-2013, 01:19 AM
ZohnoReecho

Quote:

Originally Posted by Jwrigh7784

Actually, the authenticator can be bypassed. Someone pointed out a massive security flaw that bypasses the launcher and lets anyone log into any account and all they need is the session ID which is surprisingly easy to obtain. I have personally witnessed this and am shocked at such a security flaw.

If you have something that can read that session from the process believe me that nothing can stop it from redirecting the game login page to a fake one and steal the data you insert.

Just because it can be bypassed doesn't mean you don't have to do the best to protect yourself.

It's as if I wouldn't wear a bulletproof vest because they can shot me in the head anyway.
10-18-2013, 02:25 AM
DragonFlyy

The session IDs are now being made invalid when you log off. What you are seeing is an interruption in service. If someone tried to log into your account while you are on, they get the error that someone is already logged in, it doesn't boot you out.
10-18-2013, 02:33 AM
necrosis

Quote:

Originally Posted by whoopeeragon

Apparently, they have fixed it to be IP-locked now? I don't know the specifics, but people have been reporting that when they log in from a different IP, their account gets locked until they confirm it through email etc. Similar to how things worked in 1.0. For people with dynamic IPs, maybe it will be a hassle, but I think it's a welcome change. I'm not sure how this will affect session IDs, but nonetheless, it will make logins from external areas a bit harder.

No the IP check is because they do not have a OTP attached to the account. SE has done this for a rather long time even going back to FFXI.
10-18-2013, 02:52 AM
Mordermi

Is this what is happening? http://na.finalfantasyxiv.com/lodest...1cbefd7134829f
10-18-2013, 03:28 AM
Kosmos992k

Quote:

Originally Posted by Zfz

Hackers are using randomized session IDs to connect with the servers! Oh noes!

I also got authentication error twice since last night. Either they changed something or the hackers really are doing mass brute force...

They changed something, the chances of brute forcing a significant number of session IDs are about as high as the Sun going nova, today. It doesn't have a high enough success rate to make sense to any hacker, not to mention that it gives SE an opportunity to trace them more effectively and IP ban their sorry rear ends.
10-18-2013, 03:31 AM
Quesse

Quote:

Originally Posted by Jwrigh7784

Actually, the authenticator can be bypassed. Someone pointed out a massive security flaw that bypasses the launcher and lets anyone log into any account and all they need is the session ID which is surprisingly easy to obtain. I have personally witnessed this and am shocked at such a security flaw.

Sure if your computer is hacked.

So basically if you hack someones computer, the session id becomes 'Easy to obtain'. Shocking.