Discussion: New Security Update on NCsoft Master Accounts
By
aleph_EU,
Posted on: 2011-03-01 17:02 in News, Events and Announcement Discussion
Quote:
The problem is though, is that if a system allows punctuation to be entered, then the rule should be *stuck* to (for entered data).|
Originally Posted by Jordan_Yen
Ok, then I return with this. Are you really less secure having leeway on the challenge answers? If you pick something stupidly obvious (like answering any question they ask you with the truth), how does it change anything?
The only reason they'd be close in the first place is because they already know the answer and they'd get it anyway with a few more tries. I see this as helpful to regular people and not any easier for the bad guy. I'm thinking there should be no functional difference between the listings of Oreily that I posted above. |
Your O'Reilly/OReilly/oreilly/o'reilly example is poor in this case. Because otherwise *for a computer system* you are telling it accept a lot of different answers for one (for something that respects punctuation AND case).
If on the other hand the system is to not allow ANY punctuation and to IGNORE case, then yes, they are the same... (assuming that the system just ignores punctuation and doesnt replace it with a space).
Now, for a HUMAN to confirm these details (depending on their own rules) if you say "O'reilly".
What is the difference between
Thomas
Thomas
There is a difference, and a computer system will pick up on the difference, although visually there is no difference. If someone wants to make their security answers harder, they should be allowed. BUT the problem is that you are taking that option away from them.
*edit* dammit, the forum software didnt allow my example to show properly, but it *does* have several spaces after it when i edit the post....
Quote:
Getting the security questions wrong does generate an auto email that <x> IP address attempted to log in and an instruction to contact support if this was an error.
|
Originally Posted by GadgetDon
A failed attempt to enter the security questions causes an email to be sent to the address on record, warning you of the failed attempt and a link to reset the security questions.
|
SAVE CoX info:
Titan Network efforts
Saving CoX events/FB info
Quote:
Right, so all it needs is the link to reset the security questions.
|
Originally Posted by Capa_Devans
Getting the security questions wrong does generate an auto email that <x> IP address attempted to log in and an instruction to contact support if this was an error.
|
My arcs are constantly shifting, just search for GadgetDon for the latest.
The world beware! I've started a blog
GadgetMania Under Attack: The Digg Lockout
Quote:
*shudders at the horror of all the Blizzard spam he gets with phising emails set up to look just like that*
|
Originally Posted by GadgetDon
Right, so all it needs is the link to reset the security questions.
|
Quote:
Yes, the potential of phishing clearly means a 45 minute call to a toll number is a superior solution.
|
Originally Posted by Gangrel_EU
*shudders at the horror of all the Blizzard spam he gets with phising emails set up to look just like that*
|
My arcs are constantly shifting, just search for GadgetDon for the latest.
The world beware! I've started a blog
GadgetMania Under Attack: The Digg Lockout
Quote:
|
Originally Posted by Zombie Man
This is my experience, too. I know I answered the challenge question correctly. After about 5 tries, it locked my account.
When I tried to use the 'reset my password' route, that was blocked because... my account is locked. (Never mind that this is the industry standard for verification.) I've used Support before, so, I have a Support Account already... which has my main email on file. But I can't get into my Support Account because... it has locked my account which is associated with that same email. It did give me the opportunity to reset my password for my Support Account... and never sent me the email with the new password. So now, I've created a new Support Account with a different email (really, I need to maintain extra email accounts to deal with Customer Support?) and am waiting to hear from them. This should be good... the level of utter incompetence displayed so far should provide some continued entertainment. Though, nothing would be as entertaining as trashing NCSoft's name through the mud in every gaming website in existence if this doesn't get fixed. Great way to appear as stupid as SOE. |
UPDATE:
I was asked to provide these:
-- What first and last name did you use when you created the account?The only one I didn't have was the original Unique Account ID because, you know, SEVEN YEAR OLD EMAILS.
-- What physical address did you use when you created the account?
-- What date of birth did you use when you created the account?
-- What are the 20-digit serial codes for all games you added to the account?
-- What is the Unique Account ID for all the game accounts you added to the account? (This was sent to you via e-mail on the date your game account was activated with a subject header of 'Game Account Activated'.)
-- Original billing information: If activated using a credit/debit card, please provide the last 4 digits of the credit card used ONLY. If activated using a game time card, please provide the 20-digit game time card code used to activate the account. If activated using PayPal®, please provide the Transaction ID or the Invoice ID associated with the original activation purchase.
I gave them 10 serial codes for my two accounts. There's more, but, I figured that should be enough.
I get the email back:
At this time, we would like to assist you with logging into this account as an exception. For future inquiries, you may be required to provide additional information to verify ownership of this account.Thanks? As an exception? Is that a veiled threat you won't help me again unless I pony up everything you asked for?
So, they cleared the passphrase question.
I go to my Main Account. The challenge page has just Date of Birth and the Captcha.
And I keep being told I have the wrong information.
I think I know my DoB. I've entered it into my Master Account at least 50 times with all the purchases I've made.
Well, I sent another email back saying I still can't get in. We'll see what happens.
BTW: All the information they asked for to verify who I am could be found in a hacked email account. If they're only going to verify ID based on access to an email account, they could have done what is the industry standard: sent a new password to my email account.
Tell you what, let me use my credit card information to 'buy' access to my account for $0.00. Then you'll know it's me. At least my credit card company can remember what my date of birth is.
Dear Mods: Can you please pass on my feedback to the people who made these changes: "Sheer idiocy and gross incompetence."
Speeding Through New DA Repeatables || Spreadsheet o' Enhancements || Zombie Skins: better skins for these forums || Guide to Guides
Yes, I'd like to know who exactly at NCSoft I can call and express my extreme displeasure with about this change. I'm failing to understand why they didn't choose to let us log in, then let us choose brand new security questions and go from there. I "failed" the questions, but only tried once as I have no reason to go into my NCsoft account for another year or so. I can assure you I have no clue what I typed into the fields when I was bored one day and decided to play the Lineage 2 beta for a couple hours 7 years ago :P
well im currently locked out lol, thing is I remember the password but alas it refuses to budge on letting me into my account!
In-game and now on Twitter @Tsumiju Zero "The Nightmare of Dra'Gon"
"The flow of battle can only be influenced, not by realtime tactics, but by strategy."
Proud resident of the Union EU Server.
B.A.F. Trial Guide
Okay after NCSoft Support cleared my questions AGAIN, I was able to log in and authenticate.
Even so THE DAMN CAPTCHA STILL ERRORED OUT the first time and I KNOW that I entered it right.
I'm betting that this is a rather BIG part of NCSoft's problems (other than people who maybe entered bogus info for questions previously because they weren't going to give NCSoft real, salable information when they didn't know they were going to be longtime addic...subscribers).
My eyesight is BY NO MEANS poor. And even the CAPTCHA didn't mung the letters and numbers up badly enough that they were unrecognizable. I even took the time to double and triple check them one by one. AND IT STILL FAILED that first time.
Clicking on the linked image above will take you off the City of Heroes site. However, the guides will be linked back here.
Ok got the one-time link for the questions and its all good 
...Thanks NCsoft Support 
great job!!!
www.paragonianknights.com
Prestige Award
My DA page
@Fire Chief
BTW, one thing I want to make clear, and I suspect most people in this thread would say the same thing.
Once I got to a real human, the support person was very helpful, acted quickly and professionally in spite of being, I'm sure, under as much stress and frustration as I was. From all the experiences I have NC Soft support, the amount of respect I have for them even exceeds my disapproval and disgust at the brain-dead idiots who pushed this system through without apparently either forethought or concern about the results it has had for the customers.
My arcs are constantly shifting, just search for GadgetDon for the latest.
The world beware! I've started a blog
GadgetMania Under Attack: The Digg Lockout
Reading about your problems with the new security is interesting without a doubt! Some of you guys are in some tough situations. My challenge questions were my birthday on both my EU and NA accounts. Are you getting questions other than that?
I have to agree that they should have announced this in advance. This game is rate T for Teen, how many of the userbase are using someone else's credit cards? The long term ramifications for this are horrible. Basically if you started an account in your early youth and then and you "grow up, " you'll have to start another account from scratch again. This blows.
I guess if they roll it back, then too many are using someone else's :-) Let's cross our fingers!
Quote:
Worst. Security Questions. Evar!|
Originally Posted by Avatea
Password Hint Questions
What was your first pet's name? [text box] (limit 32 characters) What is your mother's maiden name? [text box] |
These answers (as well as birthdays, anniversaries, Father's middle name, etc.) can usually be easily found on a quick trip to Facebook and Ancestors.com. If you don't want your friends (or enemies) who know you play COH to be able to socially engineer their way into your account, do NOT use this kind of easily searchable personal information for security questions.
Thanks to GM Toby answering my email when I sent the info. Took about 2 days but I guess they had lots of tickets. Thanks again. Everything is all back to normal.
Arc ID 104041 Attack of the Mini Phalanx Solo Friendly; Custom Characters; Comedy.
Arc ID 292449 The Shadow of Eihbon Solo Friendly; Canon Related; Magic.
Your new security feature is TERRIBLE! I am now locked out of my master account on my home computer. I was asked 2 simple questions. Mothers maiden name and date of birth. I know full well that I answered those correctly, but was given the incorrect message, I tried a couple more times thinking maybe I got the 2 words in the captcha wrong, only to get locked out entirely. The implentation of this feature is god awful. At a loss as to what to do now. A pox on all your houses!
Quote:
Well I see a bit of where you're coming from, but when I code these kinds of things, I can just:|
Originally Posted by Gangrel_EU
The problem is though, is that if a system allows punctuation to be entered, then the rule should be *stuck* to (for entered data).
Your O'Reilly/OReilly/oreilly/o'reilly example is poor in this case. Because otherwise *for a computer system* you are telling it accept a lot of different answers for one (for something that respects punctuation AND case). If on the other hand the system is to not allow ANY punctuation and to IGNORE case, then yes, they are the same... (assuming that the system just ignores punctuation and doesnt replace it with a space). Now, for a HUMAN to confirm these details (depending on their own rules) if you say "O'reilly". What is the difference between Thomas Thomas There is a difference, and a computer system will pick up on the difference, although visually there is no difference. If someone wants to make their security answers harder, they should be allowed. BUT the problem is that you are taking that option away from them. *edit* dammit, the forum software didnt allow my example to show properly, but it *does* have several spaces after it when i edit the post.... |
$altered = converttolower(stripspecialandspaces($input))
if ($altered == $stored) huzzah();
I know this system would work assuming they ran the same code on the original submissions and the test later. And I'm not yet seeing an appreciable difference in security as a result if that's what you're saying.
D
Quote:
That's why I said early on to never answer these truthfully |
Originally Posted by TheUnnamedOne
Worst. Security Questions. Evar!
These answers (as well as birthdays, anniversaries, Father's middle name, etc.) can usually be easily found on a quick trip to Facebook and Ancestors.com. If you don't want your friends (or enemies) who know you play COH to be able to socially engineer their way into your account, do NOT use this kind of easily searchable personal information for security questions. |
In fact, I have an article about it on my website:
http://www.thegeekprofessor.com/guid...privacy-alias/
actually two:
http://www.thegeekprofessor.com/guid...rd-protection/
I would like to thank GM Charles, for their assistance in handling my issue here! I was able to log in an set everything as needed.
Pinnacle & Virtue:
A bunch of Heroes - Alpha Team, Legion of Order.
A bunch of Villains -Black Citadel , Pinnache.
Quote:
Oh i know that it can work... but unfortunately it would make MY security questions... well less secure (especially considering that for both of them it has at least a space and 2 capital letters in it)|
Originally Posted by Jordan_Yen
Well I see a bit of where you're coming from, but when I code these kinds of things, I can just:
$altered = converttolower(stripspecialandspaces($input)) if ($altered == $stored) huzzah(); I know this system would work assuming they ran the same code on the original submissions and the test later. And I'm not yet seeing an appreciable difference in security as a result if that's what you're saying. D |
Yep, my security questions were NOT what Avatea had put up.
At first I was surprsied that this thread isn't longer. But people don't log into their master accoutns every day. Half my SG didn't even notice it yet. But they will and this crap will get worse and worse. I can not believe what an amazingly bad move this was. Stop making people send tickets and just fix the stupid login!
Listen to the mustn't, child, listen to the don'ts, listen to the shouldn'ts, the impossibles, the won'ts, listen to the never haves, then listen close to me. Anything can happen, anything can be. ~ Shel Silverstein
Quote:
BUT... strangely enough, i never my security questions up for that, and infact the login page NEVER asked me for it.|
Originally Posted by TheUnnamedOne
Worst. Security Questions. Evar!
These answers (as well as birthdays, anniversaries, Father's middle name, etc.) can usually be easily found on a quick trip to Facebook and Ancestors.com. If you don't want your friends (or enemies) who know you play COH to be able to socially engineer their way into your account, do NOT use this kind of easily searchable personal information for security questions. |
I know someone who set one of their security questions as "ZOMG??"
Granted they set it up 7 years ago, but hell, they got boned on it right now.
Now, imagine if your account *had* been compromised legitimately. Yep, you would have had ALL the same problems
Note: A friend of mine lost access to his NCsoft *master* account quite a few years ago, and as a result also his CoX account. A friend has set up the account, and without notifying anyone, changed all of the login details.
So whilst my friend could still play the game (as long as the account didnt slip), he couldnt change any of the details, and obviously not knowing the security questions, couldnt login to resolve the problems. Even worse... the 2 people arent talking to each other anymore...
NCsoft (and this was about 3 years ago) wouldnt budge on letting him into the account, even though he was the one who was paying for it.
This is why NCsoft also dont like people setting accounts up in someone elses name generally speaking
Talk about frustrating. I don't remember my stupid password hints from years ago and although I tried contacting support it won't let me do that either since it says I need a separate account to do that but that my email address is already in the system even though I don't remember ever using one and nothing happens when I try to get it to send me an email with my new password so I can start the whole bloody thing over again. For all I know it's trying to send me an email to an old address which is long defunct. That would make as much sense as any of the rest of this crap.
This is pointless, in no way "secure", and simply stupid. It doesn't increase the security, it's simply a huge pain in the rear everytime I want to log into my master account. I made this account over 5 years ago, and I've no idea what information is entered in there or what security answers are there. I had to bat with the support back and forth for 5 days to finally get my account unlocked.
Their requests to unlock your account for you are simply ridiculous. They're assuming that in all these years I"m still using the same e-mail and the same credit card. Even if I still am using the same e-mail, I'm not going to be keeping e-mails from all that long ago....Just, lol.
Plus, I'm on a DSL connection that provides a Dynamic IP address. Which means everytime I connect I get a different IP address. Which means...everytime I want to log in my master account I have to re-verify myself because I'm using a different IP address. Which makes this whole thing even more ridiculous.
No, just no. Take this back, I was happy that way it was. "More security" yeah...right. This is just "more pain in the butt".
I've never had more trouble on ANY website than I do on the NCSoft websites.....I've been trying to buy the animal pack since they day it came out and it keeps giving me the "we can't process your purchase right now" stupid error. Please don't make this website any more tiring and annoying than it already is.
@Sparky Jenkins || Freedom Server | Union Server
Main Hero: Inferno Sparky - Fire/Fire Blaster
Main Villain: Kerry Astrid - Fire/Cold Corruptor
Quote:
I wonder how much this is costing them.
|
Originally Posted by Falke
At first I was surprsied that this thread isn't longer. But people don't log into their master accoutns every day. Half my SG didn't even notice it yet. But they will and this crap will get worse and worse. I can not believe what an amazingly bad move this was. Stop making people send tickets and just fix the stupid login!
|
Making it have "leeway" though I *dont* agree with fullstop. That just makes it more insecure (same as having all passwords lowercase even if you entered it as a mixture of upper and lower case).
Some people also complain about passwords requiring at least 1 number, and at least 1 uppercase letter. I can see *why* they would complain about it, but as you never know where that number/uppercase letter will appear, it doesnt necessarily make it exponentially faster to break brute force wise.
More leeway during a transition period where suddenly information entered seven or more years ago and never had to look at since becomes the block to entering the site AND you must get the caps exactly right - absolutely required. I gave one proposed solution, here's my revised proposed solution:
A failed attempt to enter the security questions causes an email to be sent to the address on record, warning you of the failed attempt and a link to reset the security questions. All automated, no need for support intervention (which will save NCSoft money), minor hassle for the user, the only "hole" is if the email address has also been hacked. This solution will require minimal programming time (they already have the ability to send a link to reset the security questions used by the support staff) and make everyone a lot happier.
If they want to be strict about it, only allow this method of getting in to be used once. If they want to be completely paranoid, only make it available to accounts that have neither updated their security questions since the new system went into effect or the security questions have been successfully answered.
But here's why the whole thing is completely misguided even if more notice had been provided and thus we all had time to know what our answers would be, why "no leeway" is the wrong attitude.
(1) We're not dealing with military secrets here, we're not dealing with social security numbers or bank accounts or credit cards. For some people, the concern about their characters may be as high as their social security numbers or bank accounts or credit cards, and an option to require high security to enter the master account is. For most people, though, it's just an additional senseless hassle. And so the question is, when does the hassle become more than the value of what we're getting?
(2) It's still simple text. Vulnerable to phishing attempts, vulnerable to keyloggers, potentially vulnerable to traffic watching. Worse, it's presented as "real world information" for which the right answer could be determined through facebook/twitter/other sources. Yes, really security conscious people could provide false answers, but most people AREN'T really security conscious.
(3) You're dealing with humans. Humans really, really, really hate passwords, which is why most passwords are pretty simple and pretty breakable. They have pretty bad memories, and this system is particular finicky (Was it Boston, Boston Parkway, Boston Pkwy, Boston Pkwy.? Did I use caps or not). Barring the minority of people with superior memories, humans respond by writing down passwords giving a single source of failure. One person had them stored in gmail - which doesn't have this level of security.
So they're putting paying customers through a lot of hassle that, in the end, will offer little extra security but probably future hassle. There's a term for that. "Bad choice". Particularly since there's always other things people could be doing with their money.
My arcs are constantly shifting, just search for GadgetDon for the latest.
The world beware! I've started a blog
GadgetMania Under Attack: The Digg Lockout