City of Heroes: Live Forum Archive

To high security on account

Alvdraken

By Alvdraken,
Posted on: 2011-05-22 12:46 in Player Questions

 

Posted

Quote:
Originally Posted by Hube02 View Post
My IP address changes every single time I turn on my computer
Why does your IP address change everytime you turn on your computer?

 

Posted

I believe that has to do with the internet provider/hosting service. I've heard from other players that this happens for them as well and causes similar problems. Their actual IP address doesn't change, the hosting service reports a different IP address each time they log in.

 

Posted

Quote:
Originally Posted by Hube02 View Post
Well, after needing to verify myself a few times now, all from my home, I can say that the security is ridiculous, and for multiple reasons, requiring me to complete this every time my IP address changes. My IP address changes every single time I turn on my computer, not to mention that eventually, someone else on my hosting service will get that IP address which makes the entire act of checking my IP address COMPLETELY USELESS!!!!!!!!

Obviously whoever thought this up hasn't got a clue how IP addresses are assigned.
The fact that you use a hosting service that masks your actual IP address is not NCSofts fault. Furthermore it's not their problem.

 

Posted

Quote:
Originally Posted by Red_Raccoon View Post
Why does your IP address change everytime you turn on your computer?
Because my IP address is dynamically assigned by my service provider when my computer conects to them. I get the next available IP address. This is how most internet service providers assign IP addresses. Even if you connect through some type of modem, each time the modem reboots it is assigned an IP when it connects. This IP address may or may not be the same as the last time you connected.

For example My service provider's IP address may start with something like 192.169.XXX.XXX
The last 2 numbers (XXX.XXX) in the IP however can be anywhere in the range of 0 to 255 (or there about, some are not available) but that is approximately 256 different values in each for a total of approximately 65,536 possible IP addresses that can be assigned to a computer/modem. Even if you eliminate the ones that can't be used there are still around 60 thousand possibilities. The service provider needs to assign a different one to each connection, so this is why there are so many.

The only way this security does anything is if you have a static IP address, and the only people that generally have static IP address are those that require a static IP address and this usually costs more money than an average internet connection. For example, my work has a static IP address. The reason is that we host web sites and the web sites need to always be found at the same IP address. Private individuals do not, as a general rule, have static IP addresses for their computers.

So, at a minimum, ignoring the fact that IP addresses can be faked, if my account was hacked this system would narrow the list of people that could do so to those that use the same service provider.

Now, if you add on top of this the fact that an IP address can be faked, this makes checking the IP address of the person connecting even more useless. Anyone that is going to attempt to hack into an account is going to be aware of the fact that IP addresses can be faked and how to do it.

Add all this together, and recording what IP addresses I connect from, becomes a completely useless act.

 

Posted

Quote:
Originally Posted by Forbin_Project View Post
The fact that you use a hosting service that masks your actual IP address is not NCSofts fault. Furthermore it's not their problem.
I'm not talking about the fact that this may be an inconvenience to me to have to keep setting up new IP addresses. The fact is, that there is no way to grantee that any IP address is always used by the same person, so there is no way for them to tell on their end if I am the person I say I am by looking at my IP address.

 

Posted

Quote:
Originally Posted by Hube02 View Post
I'm not talking about the fact that this may be an inconvenience to me to have to keep setting up new IP addresses. The fact is, that there is no way to grantee that any IP address is always used by the same person, so there is no way for them to tell on their end if I am the person I say I am by looking at my IP address.
And with the amount of credit card fraud and identity theft going on over the internet it's not unreasonable for a company to set security requirements to minimize fraudulant charges. They get a financial penalty for each fraudulant charge they make to a Credit Card company and or bank that they didn't catch.

They are in business to make money not pay fines to banks and credit card companies.

 

Posted

Quote:
Originally Posted by Hube02 View Post
Because my IP address is dynamically assigned by my service provider when my computer conects to them. I get the next available IP address. This is how most internet service providers assign IP addresses.
No, it's not. In fact, it's pretty rare these days. Has been for years.


Quote:
Originally Posted by Hube02 View Post
I'm not talking about the fact that this may be an inconvenience to me to have to keep setting up new IP addresses. The fact is, that there is no way to grantee that any IP address is always used by the same person, so there is no way for them to tell on their end if I am the person I say I am by looking at my IP address.
It's not a guarantee, no, but it most cases, it's reliable enough to be used as a layer of security. There's no way to be sure that someone else isn't using your debit card and pin number at the store, but that's no reason to do away with that security measure. Same applies here. Just because a security measure isn't perfect doesn't mean it's useless. Also, just because your ISP uses an outdated method of assigning IP addresses that causes NCSoft's security measures to be an inconveniences you also doesn't mean they should do away with the security measures.



Virtue Server
Avatar art by Daggerpoint

 

Posted

Quote:
Originally Posted by Tyger42 View Post
No, it's not. In fact, it's pretty rare these days. Has been for years... just because your ISP uses an outdated method of assigning IP addresses...
Really, that's news to me. I'll have to tell the dozens of ISPs that I work with that they are all doing it wrong and that they need to give business class accounts away to all of their customers in order to get up to speed.

And from the OP
Quote:
because the security behind my accounts has become more diffecult then my banks
There is a reason that the I.S. people at the banks don't do this as a general rule, because they know that it's not very secure and only adds a minor hurdle to the equation that is easily bypassed.

I happen to be a Web Applications Developer and I deal with security concerns like this on a daily basis. I would go into an explanation of how easy it would be to hack through the IP thing specific to CoX, but that would be too far off topic and I don't think that anyone would really like me to make public the details on exactly how to do it. In order to stop hackers you need to think like a hacker and know the tools that they use. I test my own work and the work of others by devising ways to break it.

 

Posted

Quote:
Originally Posted by Tyger42 View Post
No, it's not. In fact, it's pretty rare these days. Has been for years.




It's not a guarantee, no, but it most cases, it's reliable enough to be used as a layer of security. There's no way to be sure that someone else isn't using your debit card and pin number at the store, but that's no reason to do away with that security measure. Same applies here. Just because a security measure isn't perfect doesn't mean it's useless. Also, just because your ISP uses an outdated method of assigning IP addresses that causes NCSoft's security measures to be an inconveniences you also doesn't mean they should do away with the security measures.
Dynamic IP addresses are the norm.

Even more nowdays that the IPv4 address pool has been exhausted.

Many users on cable, have 'sticky dynamic addresses', but these are not permerment IP addresses.

As a security measure, its pretty laughable. As in, any IT security professional would laugh.
I would call it worse than useless, I would state it's insecure by asking the same trite questions that get reused and resued.
I'd state it leads NC in false security as instead of solving the issue of repeated logins accessing other people's account, they have a band aid measure.

All this has been hashed out in Discussion: New Security Update on NCsoft Master Accounts .

That said, you should know the answers to your own security questions. And most people have reported positive experiences dealing with support to regain access to thier account.

I don't suffer from altitis, I enjoy every minute of it.

Thank you Devs & Community people for a great game.

So sad to be ending ):

 

Posted

Hey, chalk up another irritated customer.

It would be less irritating if it wasn't mostly for show. Like the "do not pirate" screens that appears exclusively on the movies I own.

The only determined person this is going to stop from getting into my account is me.

 

Posted

Hey, can someone fluent in Egyptian tell me what the hell that second captcha is?



I mean, my sister is named "Ordiverm" so I had no problem with that. But is that Hieroglyphic-Tree-Dog, or Hieroglyphic-Shrub-Dog?

There are no words for what this community, and the friends I have made here mean to me. Please know that I care for all of you, yes, even you. If you Twitter, I'm MrThan. If you're Unleashed, I'm dumps. I'll try and get registered on the Titan Forums as well. Peace, and thanks for the best nine years anyone could ever ask for.

 

Posted

Hmmm...I set up my security question in such a way that my answer would never change, and I would never forget it.

I got in on my first try because my question was something only I would know, and that I am extremely unlikely to forget.

I dunno, maybe make sure you answer to the question is something you won't forget? Unless I'm mistaken, they give you multiple options for what your question is. I'm sure at least one of those questions would have an answer that won't change and will be memorable.

Quote:
Originally Posted by Dechs Kaison
See, it's gems like these that make me check Claws' post history every once in a while to make sure I haven't missed anything good lately.

 

Posted

I still think the whole thing is extremely not needed and utterly useless. Because as many have mentioned before. Most home use ISP services give dynamic IP addresses to their customers which makes this whole process rather pointless, and just extremely frustrating.

@Sparky Jenkins || Freedom Server | Union Server
Main Hero: Inferno Sparky - Fire/Fire Blaster
Main Villain: Kerry Astrid - Fire/Cold Corruptor

 

Posted

Quote:
Originally Posted by ClawsandEffect View Post
Hmmm...I set up my security question in such a way that my answer would never change, and I would never forget it.

I got in on my first try because my question was something only I would know, and that I am extremely unlikely to forget.

I dunno, maybe make sure you answer to the question is something you won't forget? Unless I'm mistaken, they give you multiple options for what your question is. I'm sure at least one of those questions would have an answer that won't change and will be memorable.
They actually asked my birthday. It wasn't even a proper security question.

The funny thing is that since I often feel like certain companies (like this one) don't need to know my personal information (more than simply getting paid for their services) years ago I just gave a dummy birthdate.

They did resolve this overnight though, so it wasn't as much of a hassle as it could have been.

 

Posted

Quote:
Originally Posted by ClawsandEffect View Post
Hmmm...I set up my security question in such a way that my answer would never change, and I would never forget it.

I got in on my first try because my question was something only I would know, and that I am extremely unlikely to forget.

I dunno, maybe make sure you answer to the question is something you won't forget? Unless I'm mistaken, they give you multiple options for what your question is. I'm sure at least one of those questions would have an answer that won't change and will be memorable.
See, the thing is Claws, I actually (usually) go down the other path.

I typically put in either total nonsense characters or at least an answer that bears no relation to the actual question being asked for these security questions.

Then I remember my USER NAME and PASSWORD. That way, there's virtually no possible way that anyone can guess my security questions to reset my passwords on me.

Which works/worked great, so long as the security question was only used for validating the reset of passwords (which I don't need).

Now that it's required just to even access my accounts, even though I know my UN/PW, I'm basically hosed.

I can't get into my accounts, I've tried multiple e-mail chains to support and since I'm unable to give them all of the info they want [it's been over 6 years since I put in the CoH id's and the actual master accounts are even older than that due to other ncsoft games] they just keep sending responses back that I haven't provided them the info they want.

I've been trying (off and on) for months now to just get my security questions cleared so that I can re-enter them. Continually noting that I don't need the user name or passwords messed with, just the stupid security question.

And the really, really annoying part is that I even know what the answer to the security question is, generally. I just don't remember the EXACT capitalization, punctuation, spelling (if I used leet speak or not, sometimes I do), and spacing of the answer.

6000+ levels gained and 8 level 50's
Hello, my name is Soulwind and I have Alt-Itis.

 

Posted

Quote:
Originally Posted by Hube02 View Post
Because my IP address is dynamically assigned by my service provider when my computer conects to them. I get the next available IP address. This is how most internet service providers assign IP addresses.
I didn't know that. If most service providers assign dynamic IP addresses, then doesn't that mean most CoV players have to go through the security questions like you did every time they log into their account? If that's the case, I'm surprised I haven't heard more of an uproar.

I've only had to go through the security protocols once, just after they were implemented. I guess that means my provider doesn't use dynamic addresses. Am I just lucky?

 

Posted

Quote:
Originally Posted by Soulwind View Post
I can't get into my accounts, I've tried multiple e-mail chains to support and since I'm unable to give them all of the info they want [it's been over 6 years since I put in the CoH id's and the actual master accounts are even older than that due to other ncsoft games] they just keep sending responses back that I haven't provided them the info they want.
Most that had issues were able to get it resolved with the past couple of packs they bought (via data from the email recipets which for the past couple of years gives the full code)? Or when you started to use the current payment method or last changed the CC number?

And have you tried asking Z for help?
Quote:
Originally Posted by Red_Raccoon View Post
I didn't know that. If most service providers assign dynamic IP addresses, then doesn't that mean most CoV players have to go through the security questions like you did every time they log into their account? If that's the case, I'm surprised I haven't heard more of an uproar.

I've only had to go through the security protocols once, just after they were implemented. I guess that means my provider doesn't use dynamic addresses. Am I just lucky?
Some use (as I believe someone else called it) "sticky IPs" - Unless you force reset your IP address you generally end up with the same IP. And most filtering of this type can learn to recognize what range of IPs make up a "region" to account for dynamic IPs.

Orc&Pie No.53230 There is an orc, and somehow, he got a pie. And you are hungry.
www.repeat-offenders.net

Negaduck: I see you found the crumb. I knew you'd never notice the huge flag.

 

Posted

Quote:
Originally Posted by DumpleBerry View Post
Hey, can someone fluent in Egyptian tell me what the hell that second captcha is?



I mean, my sister is named "Ordiverm" so I had no problem with that. But is that Hieroglyphic-Tree-Dog, or Hieroglyphic-Shrub-Dog?
Barking house?

But it's MY sadistic mechanical monster and I'm here to make sure it knows it. - Girl Genius

List of Invention Guides

 

Posted

Quote:
Originally Posted by Soulwind View Post
See, the thing is Claws, I actually (usually) go down the other path.

I typically put in either total nonsense characters or at least an answer that bears no relation to the actual question being asked for these security questions.

Then I remember my USER NAME and PASSWORD. That way, there's virtually no possible way that anyone can guess my security questions to reset my passwords on me.

Which works/worked great, so long as the security question was only used for validating the reset of passwords (which I don't need).

Now that it's required just to even access my accounts, even though I know my UN/PW, I'm basically hosed.

I can't get into my accounts, I've tried multiple e-mail chains to support and since I'm unable to give them all of the info they want [it's been over 6 years since I put in the CoH id's and the actual master accounts are even older than that due to other ncsoft games] they just keep sending responses back that I haven't provided them the info they want.

I've been trying (off and on) for months now to just get my security questions cleared so that I can re-enter them. Continually noting that I don't need the user name or passwords messed with, just the stupid security question.

And the really, really annoying part is that I even know what the answer to the security question is, generally. I just don't remember the EXACT capitalization, punctuation, spelling (if I used leet speak or not, sometimes I do), and spacing of the answer.
Eh you can get them to reset things. If your account was old enough you didn't actually have all of the security questions and the system wouldn't work for you. Basically the reset things for me so I could login and rest my security questions and viola I'm set. My answers still bear no relation to the questions but are things I can remember the answer to.

But it's MY sadistic mechanical monster and I'm here to make sure it knows it. - Girl Genius

List of Invention Guides

 

Posted

Quote:
Originally Posted by Soulwind View Post
I typically put in either total nonsense characters or at least an answer that bears no relation to the actual question being asked for these security questions.

And the really, really annoying part is that I even know what the answer to the security question is, generally. I just don't remember the EXACT capitalization, punctuation, spelling (if I used leet speak or not, sometimes I do), and spacing of the answer.
And this is a problem of your own creation.

YOU chose answers that YOU couldn't remember.

Quote:
I just don't remember the EXACT capitalization, punctuation, spelling (if I used leet speak or not, sometimes I do), and spacing of the answer
YOU chose not to keep a record of them when everyone knows that the more complicated you make your answers the more important it is to keep a record of them.

The fact that 6 years ago the answers weren't used like they are today doesn't mean it wasn't important to keep a record of them. It's not the company's fault when someone can't be bothered to take a minute out of their time to make a record of their security answers, passwords, and logins.

Sorry if that sounds harsh.

 

Posted

After being away from the game for 3+ years or so, I also came back to find all of my accounts inaccessible due to the new security protocols in place. I remembered my NCSoft account passwords just fine, but couldn't get past the secret phrase/new IP security checks.

But has already been said, just send an email to support with the info you do have. I didn't have my original serial numbers or anything like that...just my original log-in information. One of my accounts actually used an alias for the personal info and I didn't have even THAT info. But support is pretty forgiving and will reset your security questions as long as you give even the most basic of proof that you are, indeed, the right owner.