EVE Search - Consolidated EVE Account Security Proposal

Check My IP Information

All Channels

Assembly Hall

Consolidated EVE Account Security Proposal

» Click here to find additional results for this topic using Google

Monitor this thread via RSS [?]

Pages: [1] 2 :: one page

Author	Thread Statistics \| Show CCP posts - 0 post(s)
mazzilliu	Posted - 2009.06.19 02:31:00 - [1] This is sort of a consolidation of the following threads reguarding account security, with some ideas added and removed after initial public feedback. The first thread below discusses an alternate authentication system such as used in WOW, and the second thread discusses periodic password changes as well as the different ways that EVE accounts are mass compromised. http://www.eveonline.com/ingameboard.asp?a=topic&threadID=1088297 http://www.eveonline.com/ingameboard.asp?a=topic&threadID=1054764 some important points that i want to make clear in the beginning: 1. all the alternate authentication systems should be optional. 2. CCP need to determine the most common causes of account compromise and educate users on how to protect themselves. 3. no security should be implemented if it leads to a reasonable chance that the average user will lock themselves out of their account. so anyways heres a list of account security related features that i'd like to see implemented. i want to bring up this issue to CSM meeting #4 so id like you input before that happens. 1. implement that external authenticator listed in first thread above, but only as an option. 2. after the user's password is past a certain age(say three months?) do a popup on the EVE login screen that functions in the same way as an eve advertisement, in that it goes away after the first time. in it include the warning, with a link to additional reading that explains why this is important- so even computer illiterate people can understand why it matters. if the password isnt changed, show the notice on every 1 month anniversary thereafter. 3. Allow the option for users to change their account names just like their passwords.
Vaal Erit Science and Trade Institute	Posted - 2009.06.19 06:27:00 - [2] Cripes. Not external authenticator. Token key authenticator (sorry, if you know about computer security seeing someone use the wrong term makes me ). Password strength needs to be checked and passwords need to be rotated at least every 6 months. I'm not much of a fan of rotating passwords because people pick something very similar to their last pw and the whole thing turns out to be useless. Changing username, sure that's a great idea as well as the other minor account security proposals. I think that token key authenticators for a video game is just a waste of time/effort/money. If you are smart enough to be paranoid about security, you probably don't give out your user/pass and don't fall for phishing attacks and have anti-virus software up-to-date. The factors in losing the token key puts additional strain on the CCP customer support team, and allows you to potentially bypassing a token key authenticator via the petition system. Lastly, token key authenticators make it so people will play the game less because it is more of a hassle. So basically it will be optional and only the paranoid who know better will be protected so it won't reduced the amount of accounts being "hacked" at all. Supporting this, but the main focus should be customer account security education. As is quite clear by playing EVE or any other MMORPG, stupid people will get scammed and stolen from no matter how much you try to stop it, only by beating a player over the head with how dumb they are will help.
Treelox Seppuku Warriors	Posted - 2009.06.19 06:29:00 - [3] Edited by: Treelox on 19/06/2009 06:30:20 As long as it is ALL optional, I'm down with the plan. Since you cant protect the stupid from themselves no matter how many failsafes you force upon them OFC I have no need of this stuff, I have been practicing safe interwebz password routine changes since before PCs had mice. (OMG im old) ---edit bah forgot to clicky the thumby
mazzilliu	Posted - 2009.06.19 14:24:00 - [4] Originally by: Vaal Erit Cripes. Not external authenticator. Token key authenticator (sorry, if you know about computer security seeing someone use the wrong term makes me ). Password strength needs to be checked and passwords need to be rotated at least every 6 months. I'm not much of a fan of rotating passwords because people pick something very similar to their last pw and the whole thing turns out to be useless. Changing username, sure that's a great idea as well as the other minor account security proposals. I think that token key authenticators for a video game is just a waste of time/effort/money. If you are smart enough to be paranoid about security, you probably don't give out your user/pass and don't fall for phishing attacks and have anti-virus software up-to-date. The factors in losing the token key puts additional strain on the CCP customer support team, and allows you to potentially bypassing a token key authenticator via the petition system. Lastly, token key authenticators make it so people will play the game less because it is more of a hassle. So basically it will be optional and only the paranoid who know better will be protected so it won't reduced the amount of accounts being "hacked" at all. Supporting this, but the main focus should be customer account security education. As is quite clear by playing EVE or any other MMORPG, stupid people will get scammed and stolen from no matter how much you try to stop it, only by beating a player over the head with how dumb they are will help. yeah ive never used the token key authenticator, so i am not 100% on the specifics of it just that it allows people to protect their account even if their computer gets a virus on it, and that having it optional would be awesome. i bet if CCP worked out some deal with the vendor for kickbacks or something the costs of increased petitions could be offset, but thats just speculation. high profile targets like alliance leaders and chars with access to a lot of assets should be given the option for higher security in the face of targeted trojan attacks that they are more likely to encounter. even responsible computer users can get infected with new exploits and zero day vulnerabilities. i think the focus should be largely on education as well. putting up login screen notices with educational articles i think will go a long way to reducing costs of hacked accounts, with little effort overall. oh and i fix the name in the OP
Herschel Yamamoto Agent-Orange	Posted - 2009.06.19 17:21:00 - [5] These all seem like reasonable ideas, since the whole "mandatory password changes" thing was removed. Supported.
De'Veldrin Special Projects Executive	Posted - 2009.06.19 17:43:00 - [6] Supported with two caveats: 1) I have the option to turn off the monthly reminders (through the menu or directly on the reminder box, whatever). 2) None of this is mandatory (excepting the password strength check). This is a much better proposal Mazz. --Vel Experience is what you get right after you need it.
Oam Mkoll The Legion of Spoon Curatores Veritatis Alliance	Posted - 2009.06.19 19:07:00 - [7]
Fille Balle Dissolution Of Eternity Event Horizon.	Posted - 2009.06.19 19:40:00 - [8] A very well formulated proposal. Two thumbs up! I've always been pro authenticators. Oh and btw, could we maybe add the option to not gave a hw key generator, but a USB KEY instead? If you are confused now, allow me to explain: My GF is a scientist (a PHD at that, you may worship me now), and one of the programs she useses need a little usb stick like thing in order for it to start. Remove it, program closes. No need to generate a key, just need to "plug in the key" so to speak. I think this would be a lot easier than a hw keygen. /Supported
LaVista Vista Conservative Shenanigans Party	Posted - 2009.06.19 19:47:00 - [9] Originally by: mazzilliu 2. after the user's password is past a certain age(say three months?) do a popup on the EVE login screen that functions in the same way as an eve advertisement, in that it goes away after the first time. in it include the warning, with a link to additional reading that explains why this is important- so even computer illiterate people can understand why it matters. if the password isnt changed, show the notice on every 1 month anniversary thereafter. I bolded the part which I'm against. Please make it opt-out, at very least.
Kaylan Jahlar Minmatar Industrial Limited	Posted - 2009.06.19 20:13:00 - [10] I strongly support both suggestions! Password Expiration Notice Most common form of improved security. Any user who ever had to work in corporate IT environment is familiar with this concept, so the education phase would be minimal. The password change wouldn't be optional. A new password would have to be entered the first time the user logs on after his password has expired. The minimum requirements for passwords would be hardened (minimum length of 8 characters, alpha-numeric, special characters, mixed case, can't reuse old passwords, etc...) Password would be set to expire every 90 days Hardware Authenticator Suggested device: Vasco Digipass Go 6 (This is what is used by Blizzard for their Blizzard Authenticators) Alternate authentication method using a hardware authenticator as a second layer of security Would be completely optional. Accounts using it would have a better security, accounts not using it would have basic security. Would not replace your username or password Device is quite cheap and very easy to use Device is impossible to crack or hack and is tamper-proof I'm personally using the Blizzard Authenticator and I can say it's extremely easy to use, plus it makes a great key chain.

Kaylan Jahlar Minmatar Minmatar Industrial Limited	Posted - 2009.06.19 20:27:00 - [11] Originally by: Fille Balle A very well formulated proposal. Two thumbs up! I've always been pro authenticators. Oh and btw, could we maybe add the option to not gave a hw key generator, but a USB KEY instead? If you are confused now, allow me to explain: My GF is a scientist (a PHD at that, you may worship me now), and one of the programs she useses need a little usb stick like thing in order for it to start. Remove it, program closes. No need to generate a key, just need to "plug in the key" so to speak. I think this would be a lot easier than a hw keygen. /Supported A USB key would mean that you are required to have a free USB slot to use it. Not everybody may have a free one, so this is not a good idea. It's also much easier to hack since the USB interface gives you direct access to the data on the key, as opposed to a sealed device that can't be tampered with.
Elaron Jericho Fraction The Star Fraction	Posted - 2009.06.19 21:39:00 - [12] I support this, with the caveat that the token key authenticator is optional. I do think, though, that periodic forced password changes (once a year is fine) and password strength enforcement are reasonable.
Alt Troll SniggWaffe	Posted - 2009.06.19 22:56:00 - [13] Originally by: LaVista Vista Originally by: mazzilliu 2. after the user's password is past a certain age(say three months?) do a popup on the EVE login screen that functions in the same way as an eve advertisement, in that it goes away after the first time. in it include the warning, with a link to additional reading that explains why this is important- so even computer illiterate people can understand why it matters. if the password isnt changed, show the notice on every 1 month anniversary thereafter. I bolded the part which I'm against. Please make it opt-out, at very least. i said it worked like an EVE ad. that means it wont show up again after popping up once until something makes it pop up again and that behavior doesnt require you to click X or anything- hardly intrusive. how much more easily opting out do you want?
Drake Draconis Minmatar Shadow Cadre	Posted - 2009.06.19 23:36:00 - [14] Originally by: LaVista Vista Originally by: mazzilliu 2. after the user's password is past a certain age(say three months?) do a popup on the EVE login screen that functions in the same way as an eve advertisement, in that it goes away after the first time. in it include the warning, with a link to additional reading that explains why this is important- so even computer illiterate people can understand why it matters. if the password isnt changed, show the notice on every 1 month anniversary thereafter. I bolded the part which I'm against. Please make it opt-out, at very least. This... forcing ANYTHING on someone regardless of the reasoning behind it is not acceptable.. if the user chooses to be stupid.. let them be stupid. ========================= CEO of Shadow Cadre http://www.shadowcadre.com ========================= Dependable, Honorable, Intelligent, No-nonsense Vote Herschel Yamamoto for CSM!
Kaylan Jahlar Minmatar Industrial Limited	Posted - 2009.06.20 03:50:00 - [15] Edited by: Kaylan Jahlar on 20/06/2009 03:51:07 Originally by: Drake Draconis This... forcing ANYTHING on someone regardless of the reasoning behind it is not acceptable.. if the user chooses to be stupid.. let them be stupid. Oh for God's sake will you stop with this argument already? This is not freedom rights of the human race we're talking about, it's simple online account security! If CCP decides that account passwords have to be changed every 3 months and that passwords now have minimum requirements in length and complexity, then so be it. It's their system, it's their rules. If you don't want to get the nag, then change your password when you get it the first time, that's all. If they allow users to opt out of this hardening, then there's no point in doing it at all! If your bank was to tell you that you would have to change your online banking password every 3 months would you file a complaint? My bank did so recently, and it was their decision, I didn't have a choice. When I renewed my credit card, I got a new one with a chip and a NIP on it. Did I have a choice? No, because it was not optional. I don't see why EVE Online account passwords would should be different.
Drake Draconis Minmatar Shadow Cadre	Posted - 2009.06.20 15:21:00 - [16] Originally by: Kaylan Jahlar Edited by: Kaylan Jahlar on 20/06/2009 03:51:07 Originally by: Drake Draconis This... forcing ANYTHING on someone regardless of the reasoning behind it is not acceptable.. if the user chooses to be stupid.. let them be stupid. Oh for God's sake will you stop with this argument already? This is not freedom rights of the human race we're talking about, it's simple online account security! If CCP decides that account passwords have to be changed every 3 months and that passwords now have minimum requirements in length and complexity, then so be it. It's their system, it's their rules. If you don't want to get the nag, then change your password when you get it the first time, that's all. If they allow users to opt out of this hardening, then there's no point in doing it at all! If your bank was to tell you that you would have to change your online banking password every 3 months would you file a complaint? My bank did so recently, and it was their decision, I didn't have a choice. When I renewed my credit card, I got a new one with a chip and a NIP on it. Did I have a choice? No, because it was not optional. I don't see why EVE Online account passwords would should be different. You must lead a very sad life.... letting everyone tell you what to do and never getting any say in any matter. Unlike most people I tend to do enjoy the little freedoms that are given to me. By the way... EVE Online is not a bank... nor is it real life... so comparing it to such a thing is a stupid example. ITS A VIDEO GAME. You people seem to get it in your thick skulls that the solution to handling security is to shove it down peoples throats. I help fix computers and install new computers everyday... Security is one of my biggest concerns... and if there's one thing I learned... you do not force security on people... you ENFORCE security... you tell them "you should do this" and "This is why". Telling them like it is... well make them just flat ignore you and throw you away. Forcing password changes is stupid.... because it will force the person in question to choose weaker passwords and not give a damn. And any good keylogger will defeat that process... If you cant figure that out... then I suggest you go read up on the subject before you flap your gums at me again. It's not my fault you can't understand rationality and discernment. Yes its a good idea to have a strong password. Changing that password accomplishes nothing but annoyance. Passords still can be cracked...still can be predicted... stolen... Hell the Authenticator/Encryption key that has been proposed at least makes sense....provided I don't have to be forced to spend EVEN MORE money on it just to play a simple stupid little game (although simple is not the correct word for it) such as this. EVE Online is not my life people.... its a game... I'd like to keep it that way thank you very much.
Princess Anime	Posted - 2009.06.20 16:20:00 - [17] Edited by: Princess Anime on 20/06/2009 16:20:34 Originally by: Drake Draconis EVE Online is not my life people.... its a game... I'd like to keep it that way thank you very much. From the amount of forum posts you make and all the anger and ridiculous posturing it certainly looks like it's more than a game for you! You say you fix computers for a living, well, if we're gonna play appeal to authority, I'm a risk analyst for a large bank, and believe me, if we didn't enforce regular password changes and password strength checks we'd have hundreds, if not thousands of customers with 1 mil+ balances and stupid passwords like 123456 or their birth dates. Eve may not be a bank, but perhaps more than any other MMO, Eve assets can be considered quite valuable, specially considering they're usually the fruit of group, and not individual labor. People should pay for their own stupidity? To a certain point, yes, but people shouldn't pay for the stupidity of others. Say your CEO is dumb and uses the same password for everything, and someone gets hold of it, logs in to his account, clears the corp wallet and steals everything in the corp hangars and POSes. In the end the whole corp is paying for his stupidity, doesn't sound that fair, does it? Making sure people don't use their first password would already reduce by 50% or more the amount of accounts compromised.
Heartstone Jericho Fraction The Star Fraction	Posted - 2009.06.20 16:22:00 - [18] A much nicer proposal as long as all of it IS optional.
Drake Draconis Minmatar Shadow Cadre	Posted - 2009.06.20 16:31:00 - [19] Originally by: Princess Anime Edited by: Princess Anime on 20/06/2009 16:20:34 Originally by: Drake Draconis EVE Online is not my life people.... its a game... I'd like to keep it that way thank you very much. From the amount of forum posts you make and all the anger and ridiculous posturing it certainly looks like it's more than a game for you! You say you fix computers for a living, well, if we're gonna play appeal to authority, I'm a risk analyst for a large bank, and believe me, if we didn't enforce regular password changes and password strength checks we'd have hundreds, if not thousands of customers with 1 mil+ balances and stupid passwords like 123456 or their birth dates. Eve may not be a bank, but perhaps more than any other MMO, Eve assets can be considered quite valuable, specially considering they're usually the fruit of group, and not individual labor. People should pay for their own stupidity? To a certain point, yes, but people shouldn't pay for the stupidity of others. Say your CEO is dumb and uses the same password for everything, and someone gets hold of it, logs in to his account, clears the corp wallet and steals everything in the corp hangars and POSes. In the end the whole corp is paying for his stupidity, doesn't sound that fair, does it? Making sure people don't use their first password would already reduce by 50% or more the amount of accounts compromised. Oh how nice... you want to stop incidents like 1 guy from destroying an entire alliance due to his password being stupid? Sorry... but that's a poor excuse for this proposal. Next thing you know you'll be demanding CCP to change your damn diapers when you pick a weak POS password. Should CCP wipe your noses too? Pay your bills? Do your taxes? ========================= CEO of Shadow Cadre http://www.shadowcadre.com ========================= Dependable, Honorable, Intelligent, No-nonsense Vote Herschel Yamamoto for CSM!
SOH'CAH'TOA Pandemic Execs Pandemic Legion	Posted - 2009.06.21 03:27:00 - [20] Originally by: Drake Draconis hurrdurrhurrdurr you can make nonsensical ****post all you want but this proposal is getting presented at the csm meeting 4 anyways. every new dumb post you make itt i emptypost with a new random alt of mine to add one point of support to the thread. i guess there is nothing new really to add to this EVE account security issue itself anymore, all the points seem to have been made. but i am always on the lookout for other good ideas that can improve the security of players without making life terribly hard for them.

Mos7Wan7ed	Posted - 2009.06.21 07:03:00 - [21] Edited by: Mos7Wan7ed on 21/06/2009 07:05:13 how about a internal authenticator? an option would be to create a client instillation id and link that with the log-in info. log-in info would then be useless without the client id. the client id would be verified along with the account name and/or Password. your user name and password would not work if it was not accompanied by the correct client id. if you needed to reinstall the client you could backup the file that the client id is stored, or log in to the website and request the client data be reset and a e-mail response would be required for verification. it would then accept the next connection and use the new client id. simply copying the file that the client id is stored to another computer would duplicate the client id to that computer. those that didn't chose to link the user account with that client id, your account would not linked to any client instillation id and CCP would not actively track client id's used by your account. another benefit is CCP could block client instillation id's from the log-in server for isk spammers that have been banned. after they have chosen to be ban CCP would receive the client id the next time the account logged in and then block the client id, disconnect, and ban the account. Requiring the isk spammer not only to create a new account, a 2-3 minute affair, but also reinstall eve (takes much more time).
Kaylan Jahlar Minmatar Industrial Limited	Posted - 2009.06.21 19:40:00 - [22] Drake, whether you and other paranoid people out there like it or not, if CCP decides to enfore password resets, you won't have a choice. Flaming and insulting others that disagree with you is helping nothing either and this forum is not the place for it. I know from profesionnal experience that users are stupid and careless when choosing passwords. Forcing strong expiring passwords on them is the only way to really have a secure environment. A strong password will be almost impossible to guess and crack, so when you say they can always be guessed and cracked, you're talking out of your butt. The authenticator is just another layer of security that goes on top of that for the ones who would like it. As someone else pointed out, it WILL be presented to CCP in the next CSM anyway, so nothing you do now will change that. EVE Online may be a bank, but the accounts of users are still worth real money, and it needs to be properly secured.
mazzilliu	Posted - 2009.06.21 20:22:00 - [23] Originally by: Mos7Wan7ed Edited by: Mos7Wan7ed on 21/06/2009 07:14:48 Edited by: Mos7Wan7ed on 21/06/2009 07:12:10 how about a internal authenticator? random client instillation id's could be created during instillation, and link that with the log-in info. log-in info would then be useless without the client id. the client id would be verified along with the account name and/or Password. your user name and password would not work if it was not accompanied by the correct client id. if you needed to reinstall the client you could backup the file that the client id is stored, or log in to the website and request the client data be reset and a e-mail response would be required for verification. it would then accept the next connection and use the new client id. simply copying the file that the client id is stored to another computer would duplicate the client id to that computer. those that didn't chose to link the user account with that client id, your account would not linked to any client instillation id and CCP would not actively track client id's used by your account. another benefit is CCP could block client instillation id's from the log-in server for isk spammers that have been banned. after they have chosen to ban a spammer CCP would kick the person and receive the client id the next time the account logged in and then block the client id, disconnect, and ban the account. Requiring the isk spammer not only to create a new account, a 2-3 minute affair, but also reinstall eve (takes much more time). once implemented it would be turned off by default. it could have different levels of security. username, password, and id match, or just username and id match not requiring password for the account to log-in. I think its better then a third party option and not at all difficult for CCP to add, as their is no game play aspects to adding this to the system. forcing banned isk spammers to reinstall eve is an interesting proposition- but you can install an instance of eve while running another, i think its too easily worked around. as for client install IDs tied to accounts for legit users- what if their computer crashes? what will they use to regain the ability to access the account? the same user and password, which means that this idea is not going to increase security, but more likely increase convenience so someone doesn't have to type their password in all the time

Chribba Otherworld Enterprises Otherworld Empire	Posted - 2009.06.23 11:17:00 - [24] For the network geeks, IP-restrictions!

Venkul Mul	Posted - 2009.06.23 11:34:00 - [25] OK as long as it is not mandatory.
Admiral IceBlock Caldari Northern Intelligence	Posted - 2009.06.23 14:10:00 - [26] A note under corp. history would not be a bad idea. Something along "Clone under new management" or something. Nothing more as it would breach privacy. Please resize your signature to the maximum allowed of 400 x 120 pixels with a maximum file size of 24000 bytes. Zymurgist
Big Bit	Posted - 2009.06.23 23:06:00 - [27]
Kaito Haakkainen	Posted - 2009.06.23 23:26:00 - [28]
Johnathan Roark Quantum Industries RAZOR Alliance	Posted - 2009.08.08 01:22:00 - [29] Edited by: Johnathan Roark on 08/08/2009 01:22:32 More interested in the one time password generator Quantum Industries is recruiting!
Carniflex Fallout Research Fallout Project	Posted - 2009.08.10 08:05:00 - [30]



Pages: [1] 2 :: one page
First page \| Previous page \| Next page \| Last page

COPYRIGHT NOTICE
EVE Online, the EVE logo, EVE and all associated logos and designs are the intellectual property of CCP hf. All artwork, screenshots, characters, vehicles, storylines, world facts or other recognizable features of the intellectual property relating to these trademarks are likewise the intellectual property of CCP hf. EVE Online and the EVE logo are the registered trademarks of CCP hf. All rights are reserved worldwide. All other trademarks are the property of their respective owners. CCP hf. has granted permission to EVE-Search.com to use EVE Online and all associated logos and designs for promotional and information purposes on its website but does not endorse, and is not in any way affiliated with, EVE-Search.com. CCP is in no way responsible for the content on or functioning of this website, nor can it be liable for any damage arising from the use of this website.