FYI: check and change login passwords ASAP

https://eu.finalfantasyxiv.com/lodes...afd7028035bce5

Quote:

---

We are currently experiencing an attack by a third party that is attempting to gain access to the Square Enix Account Management System by using a combination of email addresses and passwords that appear to have been obtained from other online services of other companies.

Using the same email address and password combination for your Square Enix account as you do for other online services increases the possibility of a third party gaining unauthorized access to your Square Enix account.

Furthermore, even if your email address and password combination is not identical to those used for other services, there is still a high risk of your account being compromised if your password contains easily discernible patterns or sequences of characters, such as your date of birth.

Should you happen to be using the same email address and password combination on your Square Enix account as you do for another service, or if you are using a password that can be easily guessed, we strongly recommend changing your password immediately.

---

I seriously recommend you check your security settings, and if you havent changed your passwords recently, do so.

If you dont have a one time password setup, it might be a good idea to get that done.

Quote:

---

One-Time Passwords are temporary verifications which authenticate a user for a single login, making them highly effective against spyware such as keyloggers. We strongly recommend the use of One-Time Passwords in conjunction with your login ID and password for increased security against unauthorized access. A free software token app is available for smartphones (iPhone and Android)

---

and lastly, in regards to this

Quote:

---

Should we continue to experience rising numbers of unauthorized access attempts, a password reset for all Square Enix accounts may be initiated.

---

Over to you.

A mandatory password reset for all accounts would probably be a good thing regardless. People tend to be careless with passwords. It's about 3 minutes of inconvenience to help improve security.

i bought the physical authenticator token many years ago, no idea why anyone would not use one

Mine is done and I have the auth setup as well.

I dont know if anyone here is aware, but one of our major telcos, Optus, was hacked and a huge amount of personal info was compromised.

Wont try and tell you what to do, but I STRONGLY advise you to go check your pw details and if needed, change them. Better a few minutes now, than a huge hassle later.

Quote:

---

Originally Posted by VelKallor

If you dont have a one time password setup, it might be a good idea to get that done.

---

If you don't have a one time password setup, you need your head examined.

Seriously.

Account theft in online games was rampant in the 00s (EQ, WoW, EQ2, FFXI, LOTRO, etc). There's a reason OTP-protected accounts aren't stolen. It works. Unless you provide someone your OTP (when you clearly shouldn't), it simply won't happen.

Considering the time players put into their accounts, I don't care what the reason is that they choose not to use the OTP. Any reason to lose your account by not protecting it simply is invalid.

If only SE would finally send me my new security token I ordered like a month ago, since mine ran out of juice.

Quote:

---

Originally Posted by ryouma17

i bought the physical authenticator token many years ago, no idea why anyone would not use one

---

Because not everyone else can access those, as we're not from the US/EU?

Quote:

---

Originally Posted by Lelila38

If only SE would finally send me my new security token I ordered like a month ago, since mine ran out of juice.

---

There's the SE OTP app, but you can also use third party autenticators now too.
The physical keychain is nice though. But all my XI friends are currently in the process of losing their battery power finally.

Keep in mind, the picture below is what the REAL log in to the Lodestone looks like https://na.finalfantasyxiv.com/lodestone/

FAKE SITES will have jibberish letters like .xya inserted and the OTP on the same page as your name login and password.

https://i.imgur.com/TfnTNsZ.png

Glory be to the OTP! \o/

Quote:

---

Because not everyone else can access those, as we're not from the US/EU?

---

I am in Aust , I have the software token / one time pad for mobile.

This attack is a pretty simple one. It's just plugging in details scraped from other hacks and leaks over the years.

If you use a password manager, and don't reuse your passwords you are as safe as you ever are.

Quote:

---

Originally Posted by AngelCheese77

Keep in mind, the picture below is what the REAL log in to the Lodestone looks like https://na.finalfantasyxiv.com/lodestone/

FAKE SITES will have jibberish letters like .xya inserted and the OTP on the same page as your name login and password.

https://i.imgur.com/TfnTNsZ.png

---

Holy tabs Batman!!

Quote:

---

If you use a password manager, and don't reuse your passwords you are as safe as you ever are.

---

Perhaps

Better safe than sorry later, Shibi. Password security is a big deal.

Can't recommend password management software enough for something like this too.

Using OTP with FFXIV login is painful, bad enough you need to enter password every time, but OTP also. There's a thing called OAuth that issues security tokens once you pass all authentication checks so you don't need to provide this stuff every time, apparently Blizzard can implement this but not SE. Cumbersome login processes always forces bad security habits by users.

Quote:

---

Originally Posted by Aurikai

Using OTP with FFXIV login is painful, bad enough you need to enter password every time, but OTP also. There's a thing called OAuth that issues security tokens once you pass all authentication checks so you don't need to provide this stuff every time, apparently Blizzard can implement this but not SE. Cumbersome login processes always forces bad security habits by users.

---

Convenience and security are ever on opposite sides of a spectrum.

Quote:

---

Originally Posted by SaberMaxwell

Convenience and security are ever on opposite sides of a spectrum.

---

No they aren't, OAuth is easily fixes this, this isn't host based security, doubt you have a clue about IAM systems, so not surprised you would say something that naive.

Lots of banks and other institutions use that same technology to ease logins, even Office 365 does, even Blizzard, so you're just making excuses for SE spending poorly on security because you lack knowledge of how it works.

Quote:

---

Originally Posted by Aurikai

No they aren't, OAuth is easily fixes this, this isn't host based security, doubt you have a clue about IAM systems, so not surprised you would say something that naive.

---

My guy, I merely stated a pretty standard security adage which holds true almost no matter what. It's why "layered defenses" are better no matter what kind of system you're trying to create. No need to get hostile.

"No authorization or authentication standard is guaranteed to protect your information. If your information is available online, it’s susceptible to being stolen. If hackers breach a server of any service that you use, they could potentially take your login information or personal information, like name, address, and credit card information. [...] What makes OAuth great is that it restricts how many third-parties know your passwords. No, that doesn’t mean your personal information is 100% safe. But, by reducing how many entities have your passwords, you’ll lessen the chance that your passwords will get compromised."

Quote:

---

Originally Posted by SaberMaxwell

My guy, I merely stated a pretty standard security adage which holds true almost no matter what. It's why "layered defenses" are better no matter what kind of system you're trying to create. No need to get hostile.

"No authorization or authentication standard is guaranteed to protect your information. If your information is available online, it’s susceptible to being stolen. If hackers breach a server of any service that you use, they could potentially take your login information or personal information, like name, address, and credit card information. [...] What makes OAuth great is that it restricts how many third-parties know your passwords. No, that doesn’t mean your personal information is 100% safe. But, by reducing how many entities have your passwords, you’ll lessen the chance that your passwords will get compromised."

---

No you stated a blanket statement that had nothing to do with the topic at hand, which was OAuth would make it easier for users to login. Saying nothing is 100% secure is like saying you should never drive or fly because cars aren't 100% safe, it's pointless thinking and completely dismissive. You can make excuses for SE not implementing that technology all you want, nothing you've said has provided any relevant counter arguments for why they shouldn't.

Quote:

---

Originally Posted by Aurikai

No you stated a blanket statement that had nothing to do with the topic at hand, which was OAuth would make it easier for users to login. Saying nothing is 100% secure is like saying you should never drive or fly because cars aren't 100% safe, it's pointless thinking and completely dismissive. You can make excuses for SE not implementing that technology all you want, nothing you've said has provided any relevant counter arguments for why they shouldn't.

---

Saying "convenience and security are on opposite sides of the spectrum" isn't defending SE, take a step back, you're attacking someone who isn't against you.

Quote:

---

Originally Posted by Aurikai

No you stated a blanket statement that had nothing to do with the topic at hand, which was OAuth would make it easier for users to login. Saying nothing is 100% secure is like saying you should never drive or fly because cars aren't 100% safe, it's pointless thinking and completely dismissive. You can make excuses for SE not implementing that technology all you want, nothing you've said has provided any relevant counter arguments for why they shouldn't.

---

The authentication method may be one you prefer, but it is not the be-all-and-end-all you assume.

The major problem with OAuth as used by Blizzard is that it requires you to have a cell phone or tablet in order to use it. If you don't have one (and it appears to be required for the 'instant' authentication you appear to be pushing), it becomes much more cumbersome to use than a physical authenticator.

Quote:

---

Originally Posted by Boblawblah

Saying "convenience and security are on opposite sides of the spectrum" isn't defending SE, take a step back, you're attacking someone who isn't against you.

---

Then why make that generalized statement at all? It's not relevant to the discussion which is WHY SE hasn't implemented this for users convenience.

Quote:

---

Originally Posted by DPZ2

The authentication method may be one you prefer, but it is not the be-all-and-end-all you assume.

The major problem with OAuth as used by Blizzard is that it requires you to have a cell phone or tablet in order to use it. If you don't have one (and it appears to be required for the 'instant' authentication you appear to be pushing), it becomes much more cumbersome to use than a physical authenticator.

---

OAuth has nothing to do with the authentication, you can do OAuth with username and password, it's merely a framework for exchanging temporary tokens to KNOWN devices. The fact that I even need to explain this, shows your way out of depth and shouldn't be arguing this. It's used on every single mobile app you have that doesn't require login every time, most bank websites, and a lot of other companies. I guess you guys know more Microsoft, Okta, Apple, Google, and thousands of others who use this technology every day, apparently Sony is the leader in technology according to your standards.

This is why hardly participate on these forums, SE can do wrong to most posters here, no matter the facts stacked against them.

Quote:

---

Originally Posted by Aurikai

OAuth has nothing to do with the authentication, you can do OAuth with username and password, it's merely a framework for exchanging temporary tokens to KNOWN devices. The fact that I even need to explain this, shows your way out of depth and shouldn't be arguing this. It's used on every single mobile app you have that doesn't require login every time, most bank websites, and a lot of other companies. I guess you guys know more Microsoft, Okta, Apple, Google, and thousands of others who use this technology every day, apparently Sony is the leader in technology according to your standards.

This is why hardly participate on these forums, SE can do wrong to most posters here, no matter the facts stacked against them.

---

*looks down at the tokens*
*looks up*
Aren't these just fancy internet cookies with some extra steps, m8?

Quote:

---

apparently Blizzard can implement this

---

Blizzard couldnt..sorry make that WOULDNT....implement the appear offline feature they promised for five years ( the fact that they blatantly LIED to their players about it didnt help ), have pathetic privacy controls ingame, have a system that allows ANYONE to add you as a friend and track you anywhere, cant or wont implement an account wide ignore system, ties all games to their launcher and FORCED a mandatory voice app on the launcher that CANT be turned off and until a huge uproar, then fixed that voice app to NOT screw with global volume settings, said app was also tied into the entire system sound settings, caused massive system errors because it was a resource hog.

The fact they they had a/ not tested it to prevent that issue and b/ did not allow players to opt OUT of having it installed in the first place says it all.

Quote:

---

Originally Posted by VelKallor

Blizzard couldnt..sorry make that WOULDNT....implement the appear offline feature they promised for five years ( the fact that they blatantly LIED to their players about it didnt help ), have pathetic privacy controls ingame, have a system that allows ANYONE to add you as a friend and track you anywhere, cant or wont implement an account wide ignore system, ties all games to their launcher and FORCED a mandatory voice app on the launcher that CANT be turned off and until a huge uproar, then fixed that voice app to NOT screw with global volume settings, said app was also tied into the entire system sound settings, caused massive system errors because it was a resource hog.

The fact they they had a/ not tested it to prevent that issue and b/ did not allow players to opt OUT of having it installed in the first place says it all.

---

All of this. Add the Cosby suite stuff in and the way they treated their staff and Blizzard should never be hailed for anything ever again. Ever.

Quote:

---

Originally Posted by VelKallor

Blizzard couldnt..sorry make that WOULDNT....implement the appear offline feature they promised for five years ( the fact that they blatantly LIED to their players about it didnt help ), have pathetic privacy controls ingame, have a system that allows ANYONE to add you as a friend and track you anywhere, cant or wont implement an account wide ignore system, ties all games to their launcher and FORCED a mandatory voice app on the launcher that CANT be turned off and until a huge uproar, then fixed that voice app to NOT screw with global volume settings, said app was also tied into the entire system sound settings, caused massive system errors because it was a resource hog.

The fact they they had a/ not tested it to prevent that issue and b/ did not allow players to opt OUT of having it installed in the first place says it all.

---

Besides the voice app we sadly have those exact same problems here. And the best way to deal with it here is an 3rd party app.

my long time friend is otp he protects my account from harm.

OTP tokens are great. I'm a proponent of the physical token. My original FFXI token from 2008(?) was just replaced a few months ago. One of the original tokens that my wife got from the FFXIV 1.0 release is still working just fine. I have it on a badge pull connected to my monitor. I'll never use it away from my PC, so I keep it there. Doesn't get lost. None of those "I replaced my cell phone and didn't disconnect the app from my FFXIV account" problems either.

I don't like the app since my cell phone leaves the house. I could see that being misplaced, dropped, broken, etc. However, NOT using the OTP is asking for trouble.

Quote:

---

Originally Posted by dspguy

OTP tokens are great. I'm a proponent of the physical token. My original FFXI token from 2008(?) was just replaced a few months ago. One of the original tokens that my wife got from the FFXIV 1.0 release is still working just fine. I have it on a badge pull connected to my monitor. I'll never use it away from my PC, so I keep it there. Doesn't get lost. None of those "I replaced my cell phone and didn't disconnect the app from my FFXIV account" problems either.

I don't like the app since my cell phone leaves the house. I could see that being misplaced, dropped, broken, etc. However, NOT using the OTP is asking for trouble.

---

Mine is about to run out of battery too. How did you actually replace it? What's the procedure? I heard that you need emergency password removal to remove the token, but I think that's only apply to software one, and not physical? As physical token user, I don't remember having seen them at all. It's not the number at the back of the token, is it?

Quote:

---

Originally Posted by AngelCheese77

Keep in mind, the picture below is what the REAL log in to the Lodestone looks like https://na.finalfantasyxiv.com/lodestone/

FAKE SITES will have jibberish letters like .xya inserted and the OTP on the same page as your name login and password.

https://i.imgur.com/TfnTNsZ.png

---

Clear your tabs, you madman.

Quote:

---

Originally Posted by Canadane

There's the SE OTP app, but you can also use third party autenticators now too.
The physical keychain is nice though. But all my XI friends are currently in the process of losing their battery power finally.

---

Dang. I guess I'm next then. 15 years later and I still use mine.

Quote:

---

Originally Posted by Mika_Zahard

Because not everyone else can access those, as we're not from the US/EU?

---

Smartphone app? Because not everything needs to be a physical token fob. You do have a smartphone, yes? If not, you can even use an emulator.