TonyV

I just don't ever see this happening. There's too much opportunity for shenanigans to happen that cause real monetary damage to people.

That being said, we've been asking forever for them to give us some means by which to gift things like game time, Paragon Points, or whatever out of game. Their consistent answer has been "We know that people want to do this."

But you will affect far more legitimate users than shady ones. Dynamic addresses are extremely common. In some environments with load-balanced proxies, tying sessions to an IP address can completely break a site for legitimate users because successive requests can actually come from different IP addresses. Been there, done that.

Believe me, I've seen this firsthand. Depending on an IP address to be stable from visit to visit is ineffective and will only tick off legitimate users who have to continually log in (kind of like, you know, the OP who started this thread). If you're protecting something so secure that you're willing to tie the session to an IP address, you need to not count on persistent logins and validate the username and password on each visit. Otherwise, seriously, don't bother. If it's not a critical enough application that you don't want to account for someone being able to spoof an IP address, then it's not critical enough to be a pain in the butt for anyone with DHCP-assigned dynamic address or who uses a laptop at multiple locations.

Spoofing an IP address isn't that hard. If I have access to your network behind a NAT router, it's really easy. Or if I'm using the same proxy as you (e.g. on a corporate intranet), I likely don't even have a choice and must have the same IP address as you. And of course, if I have access to any upstream router, it's trivially easy, as I can simply man-in-the-middle you.

Using an IP address for any validation or authentication purpose whether it's the only method used or part of another method is dumb, period. It only accomplishes making things more difficult for legitimate users without much, if any, added security. The correct way to handle session hijacking attacks is to use a token that periodically expires, and to record old tokens to look for replay attacks. If you see one, you invalidate all of the user's sessions and, depending on how paranoid you want to be, alert the user that something fishy happened. (Though you might want to build in a little bit of tolerance in case a user did something like recently restore their system.) If you do this, it doesn't make a hill of beans difference if you're dinking around with IP addresses or not.

They can, and they do, and they should within reason. Unless they have a disproportionate number of players on systems olde and broked, I'd think they probably have a moving target time window that they aim for with their minimum system requirements; e.g. "a mid-range system as of four years ago".

Most of the nitty-gritty details of the graphics were developed sometime between 2001 and 2003, and probably more parts of the code than people realize are now a decade old, when an average system had maybe 1 GB of RAM, a single core processor running between 1 GHz and 2 GHz, a 200 or 300 GB hard drive, an on-board crappy video adapter or maybe a dedicated AGP video adapter with 64 MB or 128 MB RAM, ran video at around 1024x768, and were probably running Windows 98 or Windows 2000 (or *gag* Windows ME) with DirectX 8.

It's not unreasonable to not continue to support such a setup, especially since probably less than 0.5% of the players have a system less than twice those specs today. At some point, folks really are going to have to upgrade their systems. I'd be tickled pink if every five years or so, the game has an engine upgrade significant enough to basically raise the minimum specs up to what the average was when the last engine upgrade was.

I corrected my post early this morning...

It's actually not. I don't want to go into a lecture about hacking, but if someone has enough access to your computer to steal your session cookie, they have enough access to spoof your IP address. (Or worst-case scenario, actually run a hidden web client on your machine using your legitimate IP address.)

Depending on invalidating sessions based on IP address only thwarts legitimate people accessing your site. And I honestly don't think it's mobile phone users who are affected most; mobile IP addresses actually stay more stable than you probably think they would. It's mostly people who use laptops and/or tablets from more than one location. Log in from home, get a session cookie. Log in from Starbucks, *bam!*, session invalidated.

To be brutally honest, I sometimes think that Paragon Studios staff get jerked around by their service providers--even within their own company--a bit too often. I'm not saying that security is easy; even the Titan Network sites got hacked last October. Still, these are issues that a lot of companies deal with every day, and obviously, they don't all require Fort Knox security. It's just easier for someone to tell the non-web experts, "Um... yeah, it's a security issue," than to code a site using security best practices.

EDIT: As pointed out by Father Xmas below, the login transaction on the forums is actually handled via HTTPS, so mea culpa on the following two paragraphs; they are incorrect. Nevertheless, I'll leave them in as quoted text, lest anyone think I'm trying to appear like I'm never wrong about anything.

Giving them a benefit of a doubt, though, I don't recall anyone saying the session thing was because of a security concern; I don't recall them really ever giving a reason for it. If it was to fix some issue in the back-end that was causing errors, that's different, but I surely do wish they would fix whatever bug that's preventing us from being remembered. I happen to also access these forums from a mobile device, and it is extremely inconvenient having to type my password (which is unique and relatively strong, using alphanumeric characters) on itty bitty mobile screen keyboards.

P.S. For what it's worth, the game itself uses encryption, so when you log in to play, your information is being transmitted securely and can't be picked up "off the wire" like logging into the forums can.

It's to hammer home the point. I didn't make that observation originally, my mom did. She would tell her friends that sometimes she felt sorry for me because I was in a house full of women, and she always threw in, "even the dog is a girl." God bless her soul, though, she did her best to get me around male influence. She encouraged me to hang out with my friends a lot, signed me up for Big Brothers, encouraged me to join sports teams, etc.

To this day, though, sometimes people think I'm gay and I'm convinced it's because when you grow up living with six women, you can't help but pick up some feminine mannerisms. I don't mind, though. I love my family an awful lot, every one of those goofy X chromosomes, and wouldn't have traded them for the world.

And hey, it's worked for me so far. Belle loves the fact that I never leave the toilet seat up.

Okay, you're just being unreasonable. For example, here. What are you saying, that women don't find rock-hard abs sexy? That they prefer beer bellies? Those sexy spare tires?

You completely missed about five things I said in my reply. To boil it down for you again, it is that the stuff that you probably think is sexy in men? It's not easily conveyed in a poster. I get it. You value a good sense of humor over rock hard abs. Okay, how are you going to convey Synapse's funny side in a piece of comic artwork marketing material? How are you going to show off Manticore's wealth and social stability, draw him standing on a pile of money? How do you convey in a drawing Positron's sensitive side, have him holding a flower out to Numina with Nemesis all around him attacking the city?

Again, when we're talking about Penny Yin's (or anyone's for that matter) pose in game artwork and marketing material, we're talking about a purely visual medium. You don't get to explain their back stories, their personalities, their social position, those nuances that make them more human and likable. You draw them with features that most people find sexy. Big busts for women in "come hither" poses, large muscles for men in "I'm a rock, you can count on me" poses.

That's not my "theory," I merely pointed out that some comic books go there. Big busts pass muster in a T-rated game. A sizable schlong, not so much.

...And this is your problem. You keep thinking in terms of the game being targeted at men and/or at women. The game makes no such distinction. The game is targeted at comic book fans. Period. End o' story. By virtue of the fact that most comic book fans are guys, I can see how this is confusing for you, but it's not like Brian Clayton goes to David Nakayama and says, "Gimme something that will hook teenage boys." Whoever is telling whomever what to draw is infinitely more likely telling them, "Gimme something that looks like mainstream comics today." Voila.

So just to remind you of the context from which this replay came, I said:

So you're telling me that I don't know what they're complaining about, I say that it seems to be portraying women in comics in an oversexualized manner, then you tell me no, to go Google 'sexualization of women in comics' and figure it out. I don't think I'm the one here who's not getting it or being "well-meaning but facile."

If you honestly tell me that you don't think that the likes of Robert Downey, Jr., Chris Hemsworth, and Jeremy Renner were picked because of their sex appeal, or for that matter, the likes of Hugh Jackman, James Marsden, George Clooney (Batman), Ben Affleck (Daredevil), Brandon Routh (Superman), even going all the way back to Buster Crabbe as Tarzan and Flash Gordon in the 1930s, with all due respect, I think you're crazy.

You actually make two good points here. First, my contention that the game is merely reflecting comic book culture is validated.

But second, you do realize that there are plenty of female fans of mainstream comic books, right? I personally know several. I've seen girls swoon for the likes of Superman and Wolverine. Yes, they're a minority, but I don't think it's because of the oversexualization of females in comics. As Arcana pointed out above, women are sexualized in many aspects of our daily lives, including magazines that are targeted at women (Vogue, Cosmo, etc.). It's because we still live in a culture in which certain activities are deemed "appropriate" for certain genders. Playing with Barbie dolls is for girls, playing cops 'n robbers is for boys. Fortunately, some of those barriers are coming down as, for example, boys started playing with "action figures" and girls started reading comic books. As time goes on, I think things will even out even more.

And again, that's 100% incorrect. Marketing wants as many people to buy the game--male or female--as possible. But make no mistake, it is aimed squarely at the comic book demographic. That doesn't mean that only comic book readers play the game, of course, any more than only people who are war buffs play Call of Duty. But that is its chosen genre, and it is what it is.

Just for the record, Penny Yin is not showing very much skin at all. She's wearing a skin-tight leotard, as you can clearly tell from the difference in the color of her legs and her facial skin tone. The only skin she's showing is her face and her midriff. Her arms, chest, and everything from the waist down is completely covered.

Is her costume practical? Enh, probably not so much for close-quarters battle. Still, I would think that, for example, Synapse's is even less so. If anything, her leather gloves and boots give her more protection than Synapse. About the only thing I find weirdly impractical about her costume compared to the men in the game are her boots. Skimpy outfits I can at least excuse to allowing more agility and flexibility. But wearing high-heeled boots, that's just crazy. (But then, I think that women in high heels look pretty silly in real life, too.)

And part of what makes an alpha man an alpha man is physical attractiveness to women.

Look, I know that most women and most men are wired up a little differently, and I know that in general women aren't as concerned about physical appearance relative to other aspects of a man's character as men are about women's physical appearance, but it's incredibly naive to think that women aren't attracted to a fine specimen of a man. I'm not a woman, but I have four sisters and grew up in a household with up to six women (seven if you count my aunt's female dog) and me being the only male at one point, so I don't feel like I'm coming out out left field here. I've seen my fair share of female lust from prepubescent schoolgirls right through women in their golden years to know that it's not always about the money, it's not always about the sense of humor, it's not always about the intelligence. Sometimes it's about raw sex appeal.

In a piece of comic book artwork, it's hard to convey other aspects of sexuality that women generally find attractive, things like wealth, respect, humor, sensitivity, etc. In the stories themselves, sometimes we get a sense of that; indeed, in some of the game arcs and CoH comic books we get some of that as well. But in a poster such as the forum background, it's a purely visual medium. As such, artists are going to go with what is generally thought of as raw sex appeal whether it's a man or a woman being drawn.

What is it that you think they're complaining about? It seems to me to be that women are portrayed unrealistically in comic books, typically in an oversexualized manner. My contention is merely that almost everyone is portrayed unrealistically in comic books, typically in an oversexualized manner.

Because if you go out to the average person on the street and say, "Hey, name a comic book, any comic book," they're not going to name one of those books you just talked about. They're going to name one I mentioned above. Superman. Batman. X-Men. Spider-Man. This game isn't intended to emulate every possible genre, it's shooting squarely at the mainstream.

Nevertheless, it's flexible enough so that if you want to play average schmo-turned superhero-type characters, you can. But just don't expect the game's ad copy and artwork to reflect that. Putting out artwork that doesn't clearly evoke "COMIC BOOK!" in average people's minds would be marketing suicide.

It seems to be a common misconception, one I see crop up every few months with these "the women are too sexy!" threads. People seemed shocked that City of Heroes is a game that emulates an art form in which most of the women (and men too, for that matter) are unnaturally sexy. They seem to want the game that allows them to fly, take city-destroying damage, and shoot bolts of electricity, fire, ice, energy, quills or even "darkness" out of various places in their bodies to be, well, more realistic.

That is hilarious! Boy, you really know who your friends are when they POST SCREENSHOTS OF YOUR RATING TO THEM!!!

Crud. I was hoping this was going to be followed by an explanation about how I would look good in a princess hat.