About all the recent account security concerns

After reading the post about this in the announcement section I think our people are going about this the wrong way. We are getting more account hackings not for CoX but its because of the game Aion. There seems to be an Aion specific trojan that is getting the usernames and passwords from the keylogger and sending it to the gold sellers so they can hack the accounts. Many folks carelessly use the same username and password for both the game and the master account, which in term gets them hacked. So not only are they losing their Aion accounts but any other NcSoft accounts they may have. I would encourage those who have had hacked accounts to visit the Aion forums and read the posting there by their community manager Tamat. These keyloggers get installed when users click links to fake pr0n sites which are really the sites of the gold sellers. The community manager there also said that the attempts and phishing and hacking increased due to Aion banning alot of RMT accounts so they (RMT) are getting desperate. Right now you might think your system is clean but its not always detectable so keep that in mind.

Wow has some sort of account security service where they mail you something for your computer. I believe it plugs into the usb and generates a number or something to use whenever you login.

I really wish ncsoft offered this service because you'd never have to worry about being hacked ever again. Once you setup your account it is REQUIRED to have that device just to login.

Maybe I understood it incorrectly but I was told wow had that. Any wow players want to shed some light?

Wow, that seems a bit much for a game.
I've seen lots of online banks and brokers that use those.

That's why WoW uses them; it's virtually impossible to break the cypher that generates the next OTP (One Time Password). Without the Username, Password, and OTP, one cannot log into the account, even if compromised by a keylogger, since the OTP changes for every login session.

Edit: My biggest problem with NCSoft's security is and has always been the restriction to alphanumeric characters. One could easily build a strong password using special characters such as $%@# and the like, but PlayNC Master Accounts won't let one use anything but alphanumeric characters - making brute force or dictionary attacks more effective, to a degree.

You would not think it overkill if you spent the last 4.5 years of your life investing thousands of man hours building and maintaining your characters only to have it all stripped away in a few minutes.

This has happened thousands, I would wager even tens of thousands of times in World of Warcraft, and their response was perfect. This little thingy you buy for 7$ guarantees that your account will not be hacked, cracked or otherwise compromised by anyone not holding that device in their hand. That is a tiny cost to pay for such protection and piece of mind.

I left WoW shortly before this was released, but had i still been playing I would definitely own one even though I had never been compromised, I would rather not take the chance.

I wish all MMO's used this feature. It only takes a couple seconds more to login and it is so worth it. Would put a huge strain on the gold farmers as well.

One of my friends picked a fob up for free at Blizzcon. And yes, it is extremely hard on not only gold farmers, but also power-leveling companies that require account credentials.

Sure, it's only a game, but when 5 years of enjoyment are suddenly vaporized by an account hack (such as due to a keylogger, Trojan, or even a disgruntled friend), that fob could have been worth it, to say the least.

Hmm... At first, it sounds like it would just be an annoying extra step, but after thinking about it, I don't think I'd mind. After all, I'd rather pay $14 for account security (I have two accounts), than risk losing everything.

[ ProTip: The banner is a link to art refs!! | The Khellection | The HBAS Repository | Brute Guides (4/16/10) | How To Post An Image - A Quick Guide ]
Biggest Troll on the forums? I'll give you a hint:

I JUST had my WoW account hacked last weekend. They (the hackers) somehow got my password (and just to clarify, I work in IT, and I'm quite aware of the most common methods by which passwords are stolen, however, my computer is CLEAN - I've just spent the last three evenings running scan after scan for viruses, malware, worms, keyloggers and rootkits and there is nothing there) and once they got into my account, they associated one of the authenticator devices to it in order to lock me out. It is more difficult for them to retain access to an account now, as there is a secret question/answer for password changes, so they are associating authenticators with stolen accounts (there is a software app version for iphone, so it is easily downloadable) so the legitimate account holder is locked out of the account until she is able to spend 4 hours on hold and on the phone with account support to get the situation cleared up.

Unfortunately, Blizzard has not seen fit to require confirmation from the account holder before associating an authenticator with an account for the first time, nor is anything emailed to the account holder notifying her that a modification has been made to her account details. I find that a to be a very bad omission on Blizzard's part and will be making it a priority to do my best to see that they change that. If they had required confirmation from me, nobody would have been able to lock me out of my account at all... granted, they still would have gotten into it, but they would have had less time with it than they got.

I do, however, have an authenticator on the way to my house. I know that it is only a game, only virtual stuff and that I will likely be able to get most, if not all of it restored, but the experience has made me stressed out and made me feel a little bit ... well ... violated. I would really rather not go through this again.

Hacking WoW accounts generate big money for gold-seller/hackers - they strip your characters, personal storage and guild storage of anything of value, sell it off at the auction house, sell the gold that they get from that and what was on your character, then use your stolen account to farm and/or hawk their gold sales and power leveling services. Then they sell the personal information from those people stupid enough to buy gold with their credit cards ...

Ugh.

Edited to add: I read a WoW forum post which suggested that Blizzard should include the device in the game box. I think that's a great idea.

Storm