Password Reset Security Flaw

If you attempt logging into the game from a different location without a security token(aka one-time password), you are told that you must reset your password with an email sent to you containing a link that allows you to do so. But this applies only when logging onto the game, not your Square Enix Account Management System.

It's possible to login to a persons Square Enix Account thru the management system, change the password, then use that password to login w/o triggering the automatic password reset do to logging in from a different location. Also, you do not receive an email when changes to your account, including the password.

Not everyone has a security token or a device able to use one. And a lot of people won't use a token since it's a hassle. And anyone would expect to be notified when ANY change to my account is made.

so use a token?

Security token is a hassle?

Can't you emulate a smartphone on a computer for the token?

And honestly, if you get hacked and you don't have a token, you're the only one to blame.

Quote:

---

Originally Posted by gamesmart

And honestly, if you get hacked and you don't have a token, you're the only one to blame.

---

This. 99% of the gill sellers are probably using hacked accounts. Everyday when I play I get stupid tells from 934759734593479879834753489 of them. If you don't want your account to eventually get hacked and be used by a stupid Chinese gill farmer, you better get a token.

Quote:

---

Originally Posted by gamesmart

Can't you emulate a smartphone on a computer for the token?

---

Thought I would add this:

Token on smartphone = Good.

Token on computer emulation = Bad.

The whole point of the token is so that if someone hacks your computer and steals your information they still can't log into your account because they don't have your token. If you put the token on the same computer you play FF 14 on, you effectively are completely getting rid of the added security the token is suppose to give.

The security token thing is a matter of opinion. What the OP brings up is a security inequality.

Breaking through an account on Square Enix Account Management instead of the game client is, for some reason, easier because of an additional security step that isn't present on Account Management, but present on the game client.

Yes, not having the security token leaves your account at a far greater risk, but this isn't about that.

The token is far from a hassle.

OP, I would like to add that this would probably be better to post in either Technical Support (http://forum.square-enix.com/ffxiv/f...hnical-Support), or Website Bugs (http://forum.square-enix.com/ffxiv/f...4-Website-Bugs).

As general discussion is mostly composed of the community and not people who can actually do something about a problem like this.

Well if you think token is a hassle, Your choice
https://infosanity.files.wordpress.c...ecfuncease.png

The fact that they got your SE Account password and you don't use a token = you're most likely screwed even if they send you an e-mail.

Quote:

---

Originally Posted by Rendecrow

Thought I would add this:

Token on smartphone = Good.

Token on computer emulation = Bad.

The whole point of the token is so that if someone hacks your computer and steals your information they still can't log into your account because they don't have your token. If you put the token on the same computer you play FF 14 on, you effectively are completely getting rid of the added security the token is suppose to give.

---

In theory, in practice people aren't going to write exploits that depend on having the multi-factor authorization on the same machine when they have to be a minority of token users, and it's demonstrated that so many people don't even use security tokens. Low hanging fruit and all.

Quote:

---

Originally Posted by SarcasmMisser

In theory, in practice people aren't going to write exploits that depend on having the multi-factor authorization on the same machine when they have to be a minority of token users, and it's demonstrated that so many people don't even use security tokens. Low hanging fruit and all.

---

I can agree with that. Though that being said, it still would be dumb to have the token on your computer, lol. That is effectively like hiding your spare house key under your doormat. The door is still locked, but..... :P

If more people would just use the token a LOT of the gill seller issues would go away as they can't hack as many accounts. The 5 second "hassle" of entering the code is totally worth it. I don't understand people who refuse to use it.

Quote:

---

Originally Posted by Laraul

And a lot of people won't use a token since it's a hassle...

---

Do you know there is in-game bonus for one-time password users?
IMO using a token absolutely is an advantage for long term players. ^^;

Quote:

---

Originally Posted by Rendecrow

I can agree with that. Though that being said, it still would be dumb to have the token on your computer, lol. That is effectively like hiding your spare house key under your doormat. The door is still locked, but..... :P

If more people would just use the token a LOT of the gill seller issues would go away as they can't hack as many accounts. The 5 second "hassle" of entering the code is totally worth it. I don't understand people who refuse to use it.

---

It is dumb because it basically isn't multi-factor authorization anymore. But it is still better than not using a token at all.

Two factor authentication, what's hard to understand. Out of all the compromised accounts hijacked by RMT, I'd bet none used the security token. Personally, I think it's time to make two factor authentication mandatory.

Technically, PS3/PS4 playerswith a security token have 3 factor security since PSN authenticates you and your license, then SE takes your password and one time security code.

Quote:

---

Originally Posted by Laraul

Not everyone has a security token or a device able to use one. And a lot of people won't use a token since it's a hassle. And anyone would expect to be notified when ANY change to my account is made.

---

So getting a $10 token that will secure you account is a hassle? That like having a safe but leaving it open all the time cause it too much of a hassle to enter the combination every time.

Quote:

---

Originally Posted by Lexia

So getting a $10 token that will secure you account is a hassle? That like having a safe but leaving it open all the time cause it too much of a hassle to enter the combination every time.

---

The phone software token is free.

Quote:

---

Originally Posted by mbncd

The phone software token is free.

---

They said they didn't have a device that could run the software token so they would need the physical one.

I've heard many unpleasant news regarding to the smartphone token, so I'm bit scared to use it.
If you lose your phone you're in totally bad position beyond any help.

Quote:

---

Originally Posted by nuyu11

I've heard many unpleasant news regarding to the smartphone token, so I'm bit scared to use it.
If you lose your phone you're in totally bad position beyond any help.

---

That why they give you a emergency removal code so you can remove it if needed.

Quote:

---

Originally Posted by Lexia

They said they didn't have a device that could run the software token so they would need the physical one.

---

They said a lot of people don't have one, but they also said a lot of people won't use any kind of OTP because it's a hassle. It's unclear exactly what they have or what they're willing to do.

I would not however recommend buying a dongle token over getting any smart phone or iphone released in the last 10 years, for the simple fact that they can easily get one of the latter from a friend or family member for free when they upgrade to a more recent phone, and a phone is more universally useful and harder to lose. (I can't count the number of times I've spent an hour looking for something that fell behind a cupboard or something and wishing I could simply call it to find it...)

Quote:

---

Originally Posted by mbncd

I would not however recommend buying a dongle token over getting any smart phone or iphone released in the last 10 years, for the simple fact that they can easily get one of the latter from a friend or family member for free when they upgrade to a more recent phone, and a phone is more universally useful and harder to lose. (I can't count the number of times I've spent an hour looking for something that fell behind a cupboard or something and wishing I could simply call it to find it...)

---

I used a physical for long time from when the released in back in 2009 had it attached to my keyring there was no losing that without losing all my keys, leaving it on your desk is like what person below said

Quote:

---

Originally Posted by Rendecrow

I can agree with that. Though that being said, it still would be dumb to have the token on your computer, lol. That is effectively like hiding your spare house key under your doormat. The door is still locked, but..... :P

---

If you indeed lose your phone, you are able to remove the One-Time thingy on your account.
You just require to give exact information regarding the account in question. I've done this before since I restored my iPhone since it was bricked from a update. Derpy me.

People are throwing out the term hacked a lot, amusingly enough they don't get your passwords by 'hacking' you. 90% of the time people are stupid enough to click those emails that direct you to www.ffxiv.sqaureplexnix.com or whatever and go dump their username and PW into the boxes.

Protect your password.
Be careful what you do and the site you're on.
Don't go opening up every website link on every email.
Use a token for added security.

There is a perfectly safe system in place, if you fail to use it correctly, well then god help you.

Although on that note, SE SHOULD send you an email everytime your password is changed. Most companies do this.

Quote:

---

Originally Posted by Jamein

People are throwing out the term hacked a lot, amusingly enough they don't get your passwords by 'hacking' you. 90% of the time people are stupid enough to click those emails that direct you to www.ffxiv.sqaureplexnix.com or whatever and go dump their username and PW into the boxes.

Protect your password.
Be careful what you do and the site you're on.
Don't go opening up every website link on every email.
Use a token for added security.

There is a perfectly safe system in place, if you fail to use it correctly, well then god help you.

Although on that note, SE SHOULD send you an email everytime your password is changed. Most companies do this.

---

im afraid to click that link. where does it go?

Quote:

---

Originally Posted by tocsin

im afraid to click that link. where does it go?

---

I made it up :P it's perfectly safe, just an error server not found.

Quote:

---

Originally Posted by Jamein

[Snip]
Protect your password.
Be careful what you do and the site you're on.
Don't go opening up every website link on every email.
Use a token for added security.

There is a perfectly safe system in place, if you fail to use it correctly, well then god help you.

Although on that note, SE SHOULD send you an email everytime your password is changed. Most companies do this.

---

All great advice but I just want to add one more:
Use different login details for every site.

If one is compromised, you don't want them all to be. As a teenager, I failed to consider that and when my single password for all sites was used on one that turned out to not be so safe, they went through a lot of the sites I was a member of very, very quickly. I learned that lesson very quickly and have not repeated that mistake in the last 15 years but sooo many people still do...

Quote:

---

Originally Posted by nuyu11

I've heard many unpleasant news regarding to the smartphone token, so I'm bit scared to use it.
If you lose your phone you're in totally bad position beyond any help.

---

You're given a recovery code that you write down for those moments. It specifically is used to remove the authenticator for moments like that. There's really no good excuse not to protect your account.

I just can't get the software token to register right, I've tried half a dozen times and even gone via the support desk to confirm my personal details on my account are correct, the damn thing just refuses to work.

Keep meaning to get a hardware token, I've had one on my WOW account for years even though I don't play any more, and for me it's much more convenient than a soft token.

Quote:

---

Originally Posted by nuyu11

I've heard many unpleasant news regarding to the smartphone token, so I'm bit scared to use it.
If you lose your phone you're in totally bad position beyond any help.

---

Wrong.

When you first set it up they also give you an emergency code. If you lose your device (or it breaks beyond use) you go to the website and there is an option for removing the token. It asks for your login info, your security questions and the emergency key and BOOM token removed. Very easy to do. However, beyond that all you have to do is call and prove you are you and they remove it.