Friend Account Hacked

[NekoHina]

People have to be soooo careful about FC permissions, not just who can handle the gil but even more so who has permissions to “promote/demote”. This has brought a lot of FCs down because someone who is at the lowest level can promote someone to FC master (possibly even themselves) and then change everything, clear out the chest and gil, get rid of all other members and take over the FC house and even close down the FC all together. It has happened more than once because the ‘promote/demote’ permission default is a problem. So everyone please be careful, watch those those permissions and remove the ability to promote for most players.

[tdb]

someone who is at the lowest level can promote someone to FC master

Seriously? I had thought the master rank was out of limits for normal promotions and only the master could choose a successor for themselves. But even without that it pretty stupid that the promote permission allows one to grant others any rank regardless of one's own. In every other permission system I've seen it's only possible to manipulate lower ranks (so if the ranks are master, officer, member and recruit, then officers can promote/demote members and recruits but can't promote anyone to officer and can't demote other officers).

[Nakira]

Seriously? I had thought the master rank was out of limits for normal promotions and only the master could choose a successor for themselves. But even without that it pretty stupid that the promote permission allows one to grant others any rank regardless of one's own. In every other permission system I've seen it's only possible to manipulate lower ranks (so if the ranks are master, officer, member and recruit, then officers can promote/demote members and recruits but can't promote anyone to officer and can't demote other officers).

Only the FC master can pass lead. If you attempt to do so as any other rank, the tooltip tells you that you can't. Anyone else with promotion permissions can, however, promote anyone to any rank outside master.

The way it's been explained to me (and really it's the only way it remotely made any sense to me) is that other than the master rank, the rest are all considered the same rank technically by the game, the leader just assigns those ranks different permissions depending on what they want that rank to be. The order of the ranks can be changed at any point. So to the game, promotion just means they're changing their rank horizontally. Because of this, only I and my one officer (who I trust completely) have to ability to both access the gil in the FC and promote/demote. We don't keep all that much gil in the chest, but I wasn't going to take any chances.

I do think over all that it's an extremely flawed system and creates issues like this where a hacked account can cause a lot of damage, and I wish it could be changed to an actual tiered hierarchy like it should be.

[AngelCheese77]

Seriously? I had thought the master rank was out of limits for normal promotions and only the master could choose a successor for themselves. But even without that it pretty stupid that the promote permission allows one to grant others any rank regardless of one's own. In every other permission system I've seen it's only possible to manipulate lower ranks (so if the ranks are master, officer, member and recruit, then officers can promote/demote members and recruits but can't promote anyone to officer and can't demote other officers).

The issue is with how SE makes the default settings for each rank when an FC is created. They make it (IIRC) that each rank can do everything pretty much. It is on the FC creator to fix each rank's permissions right away.

[NekoHina]

The issue is with how SE makes the default settings for each rank when an FC is created. They make it (IIRC) that each rank can do everything pretty much. It is on the FC creator to fix each rank's permissions right away.

Exactly and most people do not check permissions. It can lead to some bad situations. SE should make the default with no permissions instead of all of them allowed at the start. It makes no sense.

[Canadane]

Exactly and most people do not check permissions. It can lead to some bad situations. SE should make the default with no permissions instead of all of them allowed at the start. It makes no sense.

I think SE doesn't want to baby us.
It's our FC's we run them as we wish. It also absolves SE of liability, though they'd probably have some way around it regardless of default settings.

[worldofneil]

I could be wrong here, but from memory it creates three ranks automatically and the default rank isn't a threat.

The three ranks as I remember it: The main FC leader rank, an officer rank which does have the permissions and a default rank which everyone gets which doesn't have any big permissions.

If the FC leader changes someone to the officer rank without them first changing the actual officer permissions, then this could happen.

[Zer0]

Perhaps you're too quick to believe it was a hack. It sounds like after the falling out, he stole it and claimed he was hacked.

[tdb]

It's our FC's we run them as we wish. It also absolves SE of liability, though they'd probably have some way around it regardless of default settings.

How does giving too broad permissions by default absolve SE of liability? If it doesn't occur to players to check them, doesn't that make SE responsible? Seems to me that setting safe permissions by default would be the thing to do to avoid liability.

Or did the "it" which absolves them refer to something else?