By
AliasiSudonomo,
Posted on: 2011-12-23 13:04 in CoH and CoV General Discussions
|
Originally Posted by GuyPerfect
This is a logical fallacy, but I forget what it's called.
|
|
Originally Posted by Celestial_Lord
Security by obscurity is no security at all.
|
|
Originally Posted by Party_Kake
Security in general is a joke.
Clearly you haven't heard the reports of people who didn't have authenticators who got their accounts hacked THROUGH the use of an authenticator. in World of Warcraft. Or the people who had authenticators, who still got hacked. |
|
Originally Posted by Snow Globe
Misleading Vividness?
|
|
Originally Posted by Hyperstrike
It's called "Unauthorized access".
|
|
Originally Posted by Zombie Man
What exactly are the huge profits a hacker is going to get from hacking CoH again?
|
|
Originally Posted by Snow Globe
Um, I was answering Guy Perfect's post
|
|
Originally Posted by Celestial_Lord
It can't be that much of a money pit. I currently subscribe to four MMOGs, including this one. Three of them offer authenticators. Two of them offer physical dongle authenticators. CoH is the only one that doesn't offer any kind of authenticator.
Physical authenticators aren't expensive... the most I've had to pay for one was $12, and that included shipping. |
|
Originally Posted by Celestial_Lord
It can't be that much of a money pit. I currently subscribe to four MMOGs, including this one. Three of them offer authenticators. Two of them offer physical dongle authenticators. CoH is the only one that doesn't offer any kind of authenticator.
Physical authenticators aren't expensive... the most I've had to pay for one was $12, and that included shipping. |
|
Originally Posted by Nalrok_AthZim
First, the company has to pay for the OTP (one-time-password) service. That can be anywhere from $1000 a year to $1000 a month to $1000 a week depending on just how many keys you need. Then, you can have each key fob custom designed to fit the CoX theme (anywhere from $20 to $30 to $40 per key fob depending on manufacturer and design used) or you could go blank for about $18 a key fob. Then you have to repackage the game with the fobs. This requires new packaging to indicate the new security (mostly in the System Requirements). Then you have to recall all previous versions. THEN you have to ship and stock the new boxed versions. THEN you have to ship new fobs to each player subscribed to your game.
Please note that I didn't include the time, money and manpower it would take to integrate the new security measures into the game's databases and interface (this includes login/store screens, the NCsoft website (another deal to be made since NC owns Paragon), and server-client authentication handshaking). I also didn't include the myriad of customer support issues the current service reps would have to be trained on. The cost can add up very, very rapidly. Unless you understand the processes and stages involved in making such a 'minor' addition to the game, and unless you've had first hand experience modifying a large-scale MMO, you can't ask for something like this and treat it like a minute issue. |
|
Originally Posted by Nalrok_AthZim
First, the company has to pay for the OTP (one-time-password) service. That can be anywhere from $1000 a year to $1000 a month to $1000 a week depending on just how many keys you need. Then, you can have each key fob custom designed to fit the CoX theme (anywhere from $20 to $30 to $40 per key fob depending on manufacturer and design used) or you could go blank for about $18 a key fob. Then you have to repackage the game with the fobs. This requires new packaging to indicate the new security (mostly in the System Requirements). Then you have to recall all previous versions. THEN you have to ship and stock the new boxed versions. THEN you have to ship new fobs to each player subscribed to your game.
Please note that I didn't include the time, money and manpower it would take to integrate the new security measures into the game's databases and interface (this includes login/store screens, the NCsoft website (another deal to be made since NC owns Paragon), and server-client authentication handshaking). I also didn't include the myriad of customer support issues the current service reps would have to be trained on. The cost can add up very, very rapidly. Unless you understand the processes and stages involved in making such a 'minor' addition to the game, and unless you've had first hand experience modifying a large-scale MMO, you can't ask for something like this and treat it like a minute issue. |
|
Originally Posted by houtex
Much ado about not a whole lot here people.
1) If the Co* database is hacked... you will lose, perhaps a couple of days of playing time. Maybe. The database IS backed up... this is how things CAN BE brought back. It has already happened. So if the ENTIRE database is hacked... you clean up the mess, close the hole, and restore the servers from a couple of days ago... maybe not in that order, but pretty much. 2) If the User accounts are hacked, more games can be purchased, or perhaps items. Either of which can be used for 'gone to the americans!' type horrificness. But again, that's where backups could be important, as well as a good Customer Service to fix that issue. And change your password, yo.  3) If the credit card information database is hacked, this also can be dealt with. Everyone gets a freebie short credit alert plan, as Paragon Studios and NCSoft should make it so, and then it's not terribly hard to get a police statement, send it off, and protect yourself for 7 years. This, in effect is what I did... SOMEONE got my info, and opened a couple of accounts. I caught them doing it pretty quick, and shut it all down in about 1 day. It's scary, sure, but once you've been robbed at knifepoint, had the house burgled, and had your personal information violated... it's just not a huge deal anymore, to me. Let 'em get my CC info. It won't work in 1 day, if it works at all for ya. I'm watchin youuuu... /Of course, this is my 'merican experience, so if you're not 'merican, then your issues with this kind of stuff might differ. //Really tryin' to not need any credit anything, so I can't care much anymore about my credit score these days... ///Hopefully soon(tm) it'll all be over, and I'll never need Credit again. ////That's a day I'll be gettin' drunk about. |
|
Originally Posted by Nalrok_AthZim
First, the company has to pay for the OTP (one-time-password) service. That can be anywhere from $1000 a year to $1000 a month to $1000 a week depending on just how many keys you need. Then, you can have each key fob custom designed to fit the CoX theme (anywhere from $20 to $30 to $40 per key fob depending on manufacturer and design used) or you could go blank for about $18 a key fob. Then you have to repackage the game with the fobs. This requires new packaging to indicate the new security (mostly in the System Requirements). Then you have to recall all previous versions. THEN you have to ship and stock the new boxed versions. THEN you have to ship new fobs to each player subscribed to your game.
|
Those authenticators are generally just little doo-dads to make you feel more secure. What we really need are authenticators that jab your finger for a tiny bit of blood and run a DNA scan before allowing you to log on. If you have an evil twin this won't be much use, but it's surefire for the rest of us.
|
Originally Posted by Stormbird
If I'm reading this right, you're suggesting that the entire game would have to be reworked and the fobs would be forced on everyone. (Again, how I'm reading it.)
I can point to a certain game with glowy weapons that came out this month and say "no, it doesn't" to that. (As well as others - I don't *believe* the 80-billion-sub giant forces them on everyone, for instance, even though they're offered.) They tend to be optional. Not that I'm arguing *for* them, by the way. I think they'd be highly annoying. I just wanted to point out (again, if I'm reading you right) that you're wrong in saying they'd have to be forced on everyone. Of course, without that, you've got less of a base of income to pay them off with, too. (as well as paying for more support and the inevitable replacement.) |
|
Originally Posted by Hyperstrike
Decent summary. One I was too lazy to go into.
Kudos! |
|
Originally Posted by Celestial_Lord
It can't be that much of a money pit. I currently subscribe to four MMOGs, including this one. Three of them offer authenticators. Two of them offer physical dongle authenticators. CoH is the only one that doesn't offer any kind of authenticator.
Physical authenticators aren't expensive... the most I've had to pay for one was $12, and that included shipping. |
Just to point out, that AFAIK, most if not all of the other MMO's that use an authenticator also have a an android/windows mobile/iphone equivilent. I dont know if they are necessarily suitable for multiple accounts, but as far as i can tell, as long as you have one authenticator, you can use them across *all* of your accounts (once you have linked the hardware to each account).
Also, the authenticator has *not* been essential for the other MMO's... infact more people probably use the android/iphone version instead of the actual keyfob version.
Side note: I find it quite strange that each authenticator can cost *so* much (i would assume that the price quoted above was on "small orders" of keyfobs... small being 1000 units or less).
Side note 2: The only MMO that i have seen actually release with a keyfob authenticator in a box is the recent big space sword wielding one, and that was only in the Collectors Edition (the £130 cost) version.
Does any game that NCSoft runs use an authenticator? If there isn't one, there's your answer.
|
Originally Posted by KayJMM
So I should send you the bill to send one here on Brazil?
It will be something like $12 for the authenticator. $30 for shipping. 120/200% of those 42$ on taxes, plus 20$ of administrative customs. Would you pay those 110$ to 200$ for me? Ahhh... dont forget that I have two accounts... That means 220$ to 400$. |
|
Originally Posted by White Hot Flash
Does any game that NCSoft runs use an authenticator? If there isn't one, there's your answer.
|
Bear in mind, what people get by stealing account login is not generally the same thing as what they get by hacking the game service.
When they get your personal account or game authentication information, they have access to your account info and/or virtual goods. Last time I checked, the NCSoft North America account management site did not display my whole credit card number. Mostly, achieving this level of access gives them access to your characters and those characters' inventories. CoH is not high on the list of MMOs where you can sell those goods for lots of money. It's not proof it will never happen, but other more populous games are likely better targets from a profit/time perspective.
If the attackers penetrate the NCSoft back-end, having a client authenticator does nothing for us. They can steal personal account details in bulk, and if they are not sensibly encrypted, this can be used for identity theft. This is (normally) harder to pull of, but also vastly more potentially profitable in the real-world for the attackers. Getting all our game login information is a pittance compared to getting our personal, real-world information.
The value for NCSoft in adding client account protection to CoH in particular seems low, and conceivably would be negative. If they added it to all their titles (and they have some big ones that seem like they might be juicier targets) it might make sense for NC to bundle CoH in with it. Otherwise, it seems likely to be overkill.
|
Originally Posted by Celestial_Lord
As you can see by the bolded part, I already answered that.
|
Also, a reason for the account hacking is 'things that can be sold for people who want to buy gold'.
The goldfarmers haven't been particularly successful in CoX that I can tell. There was a burst of them back when free trials were first enabled, and you occasionally see one spam the Help channel these days, but it's so easy for someone to aquire a valuable-on-the-market recipe and get more than enough influence to keep them in SOs there's not a whole hell of a lot of a point.
Authenticators help but they aren't a silver bullet. You see a lot of account hacking in WoW even WITH authenticators because World of Warcraft has millions of subscribers and is a very juicy target for hackers and spammers. City of Heroes is much smaller and the Paragon Shop quite possibly satisfies many of the people who DO like to pay-to-win. 
It's not security through obscurity, it's just the simple logic that you don't mug the gradeschooler for their five bucks of lunch money when there's a bank across the street.
|
Originally Posted by Mr_Morbid
Those authenticators are generally just little doo-dads to make you feel more secure. What we really need are authenticators that jab your finger for a tiny bit of blood and run a DNA scan before allowing you to log on. If you have an evil twin this won't be much use, but it's surefire for the rest of us.
|