|
Author |
Thread Statistics | Show CCP posts - 27 post(s) |
|
CCP Zymurgist
Gallente C C P
|
Posted - 2010.11.19 17:10:00 -
[1]
CCP Sreegs is here to help you protect your account. Read all about account security and what you can do to protect yourself here.
Zymurgist Community Representative CCP Hf, EVE Online Contact Us |
|
|
CCP Navigator
C C P C C P Alliance
|
Posted - 2010.11.19 17:17:00 -
[2]
Just a friendly reminder that your replies should be on topic and in relation to the blog. Spam replies will be deleted.
Navigator Senior Community Representative CCP Hf, EVE Online
|
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 17:40:00 -
[3]
Originally by: EdFromHumanResources :condi: to DJ. The "name challenge" method is a direct discouragement for returning players.
Scenario: You talk your friend into picking up Eve again after a few years away(This makes you a bad friend but that's besides the point) Your friend tries to log in to reactive his account, he cannot because he does not remember his character name. Instead of petitioning and waiting a week to get this sorted he says "**** it" and goes to play something else.
Perhaps offering people the OPTION of this name challenge or perhaps an option to email the primary email a list of characters on the account should be in order.
This method also sucks for those of us with ****ty memories and too damn many accounts with similarly named characters on them when we are trying to reactive them.
Most security measures bring with them some additional amount of work to gain access to whatever it is you're trying to access. That's just the nature of the beast. The general idea is to try to implement measures that both increase security while minimizing the size of the obstacle. The name challenge, when introduced, was extremely effective in reducing the number of hacked accounts.
While I understand that it can add some complexity for people, I think they'd be a lot more upset if they came back and all their stuff was gone. We're in a constant state of exploring solutions to this particular issue (hacking) and there may come a point in the future where the name challenge isn't necessary any more, but for now it is a necessary evil. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 17:46:00 -
[4]
Originally by: BenjaminBarker Does this mean we're never getting keyfob tokens for account security?
No this does not mean that. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 18:35:00 -
[5]
Originally by: Cid Mutation One thing I would like is to be able to not only change my password but also my ID. I know it's my account ID but I think it should be deferent. Give customer a number and link that number to the current ID.
Also when you guy found out about site being hacks you should post and tell people that if they visited those they should do a scan and change there pw like now.
And thanks for the sandbox thing :D.
I can't really speak to our capability to change usernames, though it will go on the list of items to consider. I CAN however speak to your second point. The Community Team actually DOES keep a running list of known bad sites in a sticky at the top of General Discussion which I will link HERE.
Also, you're welcome |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 18:40:00 -
[6]
Originally by: Niccolado Starwalker Edited by: Niccolado Starwalker on 19/11/2010 17:56:08
Originally by: CCP Zymurgist CCP Sreegs is here to help you protect your account. Read all about account security and what you can do to protect yourself here.
Good post.
But please answer me this question I have been asking for ages with so many others from these forums:
Why dont you offer login tokens?????
It give an extra additional layer, by giving the player a unique login code each time. That way account sharing turns difficult and if a keylogger cathes the login it wont help!
Most players who stay with EVE do so fanatically. Like me, I am 5 years behind me in EVE on 3. of december, and would without hesitation invest in a login token!
The question have gone unanswered from what I can see. Now dear CCP Sreegs! Please tell us if this might be or might not be possible! Tell us you are thinking of it! Or at least give us your toughts about the matter! It have been so quiet about this! But with this devpost and all, please! Share your toughts about this!!!
:BEGS:
I can tell you that as a Security Guy I completely understand the value of a second factor of authentication and I can tell you that it would be silly of me not to have it on my list of things which could improve security. I cannot however at this point say that it will definitely be implemented or give any timeframes for when such implementation could theoretically occur. You can trust however that as soon as we have new features to talk about from a security perspective I will run immediately to the forums to tell everyone. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 18:43:00 -
[7]
Originally by: Makurid
Just wondering how this helps the security if I can just log into EVE Gate and get a list of my characters without having to answer the challenge.
I will sheepishly mention that I don't believe EVE Gate existed at the time and then thank you for pointing this out. I'll also add a smiley face to lighten the mood. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 18:48:00 -
[8]
Originally by: Jengi Gotsen Is EvE looking into external tools (authenticating keyfobs) to keep players more secure? Are there any excessive technical hurdles that would need to be overcome to make their use a reality? WoW currently has two separate tools for authenticating and verifying identities when logging in, the authenticator keyfobs / mobile authenticators available on smart phones, as the new system whereby a phone call is made when your account is logged in from an unusual place to verify you are the one logging in.
Do you feel that EvE is falling behind the industry in that way? I understand it's hard to place WoW and EvE in the same light in terms of game play, but in security measures aren't all games equal? I would say that a single-shard system where in-game currency can be converted into actual game time, security is paramount.
You mention the name challenge feature. That's great, except for the part where I don't recall seeing that on the login screen. I'm a little more nervous about someone stealing my isk than ****posting in C&P or checking out my easily changeable API key. Are there any plans to make the name challenge show up on the login screen?
There are plans to holistically examine and improve our entire security system from end to end, which is absolutely ongoing and in many ways transparent to you. I will say that regardless of what the industry is doing we should be doing our best to keep your account safe and that's precisely where I'd like us to be and the direction we're headed in. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 19:00:00 -
[9]
Originally by: the situation if you put in those keyfob things is it gonna affect botting?
To be frank, not likely because any second factor scenario would probably be voluntary. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 19:02:00 -
[10]
Originally by: pmchem Hey DJ, if you recommend both:
Quote:
8. Change your password - ALL THE TIME BE CHANGING YOUR PASSWORD. and 10. NEVER EVER EVER USE THE SAME USERNAME OR PASSWORD ON ANOTHER SITE ON THE INTERNET ANYWHERE EVER - :mad:
As a security guy, how do you recommend people keep track of their 9000 passwords? Pen and paper or something like http://www.schneier.com/passsafe.html ?
Yes passwordsafe is pretty awesome. Keeppass is integrated into the browser and also works really well. Right up until you forget your main password or lose the database. As long as you keep track of both the master password and the database you're in good shape. |
|
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 19:05:00 -
[11]
Originally by: Lord Matrix Please restore "save password" and "auto login" functionality. It can be done without saving the actual password to the HDD, all you need is to create a HMAC with something unique to the computer as password that cannot be faked (like HDD serial number). Just an example, there are other methods as well.
In either case, if an attacker can read files on your computer he can also install a keylogger.
There is very little about what is available to an application from a computer that cannot be faked. If an attacker can read files or install a keylogger he can also obtain the same information any application would be able to obtain. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 19:47:00 -
[12]
Originally by: Rikki Sals Thought I'd mention this here: My firewall/antivirus (COMODO Internet Security) always flags the EVE repair.exe as potentially malicious code, both in my Tranquility and Singularity directories.
Signature-based solutions can provide false positives. I'll look into this. Thanks! |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 20:06:00 -
[13]
Originally by: Furb Killer
'Security experts' are already seriously advising people to write down passwords on paper since it is getting impossible to keep track of them. Specialised programs work, but as said before only if you wont lose the master pass (which isnt too hard, just write it down somewhere if you want to be sure) but also wont lose the database, which is a bit more of a problem if your hdd crashes. Aditionally you cannot login anymore from other random locations.
I'd seriously question anyone who called themselves a security expert seriously advising anyone to write their passwords down on paper for anything other than a security philosophy blog which could just as likely be discussing the merits of applied quantum computing. That, in essence, changes the factor. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 21:10:00 -
[14]
Originally by: Furb Killer
It is quite simple, you have to choose which method is the smallest security risk. And if people have access to your house already they can do anything anyway, like installing keyloggers. It is just impossible to expect everyone to have for every different site different logins, with different passes that are all 'good' passwords.
If your house were the only place you used your passwords then I'd agree. It's a difficult issue to be clear. Oftentimes the recommendation (such as use a different password everywhere) is somewhat unrealistic, which is probably what they're speaking to. I do think though that we can aim for the moon and hope at least some of us breach the atmosphere which is typically the intent. Were I to say "Eve players use a unique password to Eve and write it on your monitor" then the second some dude's dorm-mate steals his account I've given bad advice. How you remember your password is a problem as unique to you as how many passwords you need to remember. In an Eve bubble, have a unique password is the best advice I can give.
I'd rather just solve the problem better. No one solution really works for everyone, as is evident by the number of people who have a really hard time remembering the names of their characters. I'm not saying there's anything wrong with them, we're all different dudes, I have to keep a running list of things to do or I forget. I'm just saying that no solution will ever work for everyone, so we need to try to reach the largest subset of people. That's what we were aiming for with the username auth, and what we'll be focusing on with future solutions. The customer experience is ALWAYS a part of the consideration. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 21:11:00 -
[15]
Originally by: Zirator @ CCP Screegs
I was wondering if the character transfer mechanism can be changed?
I think it's pretty ******ed that I have to give up one of the 2 secret parts on my login credential to recieve a character.
Can't it be changed to either the name of a character on the recieving account or a random code that's unique for each account and that can be seen on the account management section of the recieving party.
I'm currently interested in buying a character for one of my accounts but this is keeping me from not doing it. And creating a 4th account just to recieve characters on and then transferring them to one of my main accounts isn't an option either.
Wondering if you could give us some feedback on this.
I am aware of this issue and will look into it. I can't promise a timeframe or even a change at this point however. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.19 21:15:00 -
[16]
Originally by: Milo Caman Anything in place to stop password guessing/Brute Force and such?
Last I checked, EVE didn't block logins for any amount of time if you got your password wrong 30 times.
There are protections for this. There will be more. I can't get into specifics here except to say that what you're saying is known and protections are still in place. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.20 00:47:00 -
[17]
Originally by: Zex Maxwell Edited by: Zex Maxwell on 20/11/2010 00:35:09 CCP sreegs, I like to note that if you do, do the external key thingy, keep in mind that some of us have more then one account. I really don't want to buy 3 separate keys for my 3 accounts that I own.
To other players. Lastpass is also something you guys can look into. It keeps your password in an encrypted database on the web. so all you need to know is your Master STRONG password.
Uh I forgot. there are also Facebook ads that say "CLICK HERE TO KNOW THE SERCETS OF EVE!" any way to tell facebook to pull them damn adds that the ISK sellers make?
If we were to engage in what you are proposing with two factor auth then multiple accounts would certainly be a concern. I'm not going to endorse any particular app that doesn't exist on your own machine because... well they have access to your stuff now. I'd prefer to store my stuff locally personally. I can't speak to how we might deal with any particular company's ads. That's a Legal thing. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.22 15:39:00 -
[18]
Originally by: Comstr
Will you be working against the botters and RMTers too?
Ok, I'm gonna take some time to go through and address some more of the questions here now starting with this one.
I don't have a direct role dealing with normal in-game activity. There can be a bit of crossover but we have a team of very cool dudes who handle the in-game stuff. An area of crossover may be, for instance, that we don't consider RMT and hacking to be that far removed, as I stated in my blog. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.22 15:56:00 -
[19]
Originally by: Shade Millith Recently, I was going to change my PW's, for both my accounts.
I then discovered that I would also be required to use a capital letter, in addition to a number.
So I didn't.
Putting restrictions on PW's doesn't help keep accounts secure, it just means that I'm more and more likely going to HAVE to write the PW down somewhere. Along with the 30 other PW's and accounts.
This kind of 'defence' does nothing to shield from a keylogger. And I doubt bruteforcing a PW would work at all, considering the amout of effort you're using to scream to protect our accounts, I'd imagine you'd have a limit of loggin's before an alarm goes off.
TL:DR I'm sick of your PW limitations, and I'm less secure because of them. They either don't help, or CCPs security is poorly thought out
I'm just going to use this as a general catch-all for "I hate changing passwords, they suck and it doesn't fix anything". I did explain in the blog why, not just I, but virtually everyone you have an account with somewhere asks you to change your passwords with some regularity. As you use and reuse passwords across forums and various other accounts, each account becomes only as secure as the least secure system you used it on. I can tell you that Eve alliance and corporation forums are hacked quite regularly. I can tell you that when they are hacked the password tables are pulled down, and then cracked offline. This is one example of why we ask you to change your password regularly.
The reason for increased character constraints in passwords is typically to increase the amount of effort required to crack the password. An increased number or type of characters involved in password creation means an exponential increase in the amount of time required to break that password. This is the common wisdom and ignores cryptographic attacks.
I do agree that as an industry security folks need to come up with different ways to handle this. I also agree that there comes a time when users simply won't or can't meet the requirements easily. Unfortunately, to quote Donald Rumsfeld "you go to war with the army you have---not the army you might want or wish to have at a later time." Today the password is the gateway to your account and this is the best way to secure it so it's the best advice I can give. In the future that will change somehow in some way, just not today.
For extra credit there was a study done by the Usable Privacy and Security Laboratory at Carnegie Mellon about password usage that delved into this exact topic. You may find it interesting. Carnegie Mellon Password Study |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.22 16:09:00 -
[20]
Originally by: Caoim Fearghul
Considering the angles of attack it makes perfect sense.
It requires physical real world access in order to obtain it, which means all the technological knowledge in the world, all the packet sniffing, mail spoofing and so on will not aid them in obtaining it.
It cross the digital divide and secures it from all remote access attempts.
There is no cryptology that might fail or the like.
Put the paper in a locked drawer or box for when you need to remember it, and voila, someone that can gain access to it is unlikely to be interested in, being able to realize much faster capital from say your television or computer itself. It's something I've looked at extensively when studying the evolution of espionage at university. It's for similar reasons that isolated networks are more secure than those connected to the web, there is a physical seperation that has to be overcome in order to access the information.
Edit: I'll also add that it comes with serious benefits, it is low technology and cost. Is easily implemented by any user and greatly increases the exposure cost of attempting to gain the information. After all, no system is 100% secure, it's just a matter of trying to make the cost/risk of gaining access unacceptably high for the rewards it offers. Requiring physical exposure to gain that access is a huge jump in the risk factor.
I don't disagree with what you're saying on its face that perhaps that factor would be a less risky factor. I think in general my point was meant to be that when you lock your password in a drawer and forgetting it you're merely changing the factor. I'll explain a bit:
A "Factor" is something which is used to determine the identity of the person requesting access to a particular piece of information. There are three known factors available today for use in this regard:
1. Something you know - A password for example 2. Something you have - A token, a phone or a smart card are the most common implementations 3. Something you are - This is biometrics such as fingerprint, voice or eye scanners
Passwords are something people are used to dealing with. They're mobile and a piece of paper locked in a drawer at home is not. A piece of paper in your pocket isn't really anywhere near as safe as one locked in your home. People want their Eve accounts to be available wherever they are. My belief is that it is preferable to decrease the complexity of the password factor to one that is easily remembered by most people, and add an additional factor for authentication to get the most bang for the buck.
I'm rambling I think but my point is that by writing down a password you merely change the factor which from a theoretical standpoint doesn't necessarily have the hugest impact on security. This is why when you see banks implement tokens or "Something you have", they still require you to have a password.
|
|
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.22 16:10:00 -
[21]
Originally by: Tusseluring Updating the browser and running some antivirus software isn't quite enoguh imo. It's just as important to update flash, shockwave, quicktime, java, adobe reader, all those programs that your browser might use as plugins to render webpage content.
Check out secunia.com and test their vulnerability scanner, it isn't an antivirus program, it doesn't search for malware, it scans your normal programs and plugins to check if there are security-related updates to them, and then tell you what and how to update, and how dangerous any vulnerabilities in your software are.
This is a good point and sadly one I missed when writing the blog. Thanks! |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.22 16:14:00 -
[22]
Originally by: TheLostPenguin I wonder if there's some sweapstake going on in the CCP office as to who can lose the most customers, now it's not only stupid changes to gameplay/client but you want to make it harder and harder just to get to even playing the game as well? Keyfobs and other such similiar additional measures are little more than a placebo, if they're not required to access the commercial bank accounts (held with a large international bank) where I work then I really have to question the usefullness of them, lets face it if anything needs securing it's business banking vastly more than videogame assets. By all means offer this as an OPTION to those that would feel better for using it, just don't ram it down our throats like every other dumb idea you (CCP) come up with ingame.
Also can we please have an option to disable the stupid popup asking for a char name to log into the forums EVERY SINGLE TIME I login to the forums? After all it's not like logging into the forums is the first thing I'd be doing if I'd just gotten hold of someones login details with a view to draining their stuffs, it's just an annoying nuisance that does nothing for security as I can login to the game just fine without triggering it regardless of how I'm connecting.
By all means add as many bells and whistles to security layers as you like, just let those of us that aren't complete ******s carry on using a perfectly acceptable level of security in a username/password combo and let the paranoid/stupid ones have loads of extra stuff that wont help against most attacks/will be bypassed when they give away their details anyway.
If you have any actual published data that speaks to your claim that multiple factors of authentication are a placebo I'd be very interested in seeing it, because this is literally the first time I've ever heard someone say that in my life. I'm happy to be educated however. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.22 16:16:00 -
[23]
Originally by: Iokasti palaiologou First of all let me congratulate you on the analysis, and welcome to our little-big universe CCP Sreegs.
I am kind of wonderign though. Today with not so much money we can have a web cam or even a fingerprint scaner or a microphone. I feel that biometrics should-could be used as means for our own security. i realise that this is a big issue for some, but at least CCP as poven to be trustworthy.
I would like to see some implementation of one sort or the other of such means in order to enchance our security.
Also i would like to ask AGAIN for wallet divisions that COULD have password protection as well.
That alone should ruin the day out of every second hacker....
I don't think we'll be considering the use of biometrics for Eve logins any time soon. I'm pretty sure there are technological as well as legal hurdles on a global scale that make this an undesirable solution to the problem. I use them personally to increase my authentication factors, but I'm not aware of anyone anywhere using them to authenticate a videogame account. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.22 16:17:00 -
[24]
Originally by: NOGC BLAST CCP Sreegs, you mentioned something called Sandboxie... where do we get it, as there could be many fakes out there, and i would like to avoid that. I'm sure others feel the same.
Sandboxie |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.22 16:18:00 -
[25]
Originally by: Callidus Dux Point: 10. NEVER EVER EVER USE THE SAME USERNAME OR PASSWORD ON ANOTHER SITE ON THE INTERNET ANYWHERE EVER - :mad:
I want different account names and an other password for EVEGate than I use in EVE itself. I am not so dumb and log in from a computer which is not my own or under my control.
Quotation from EVEGate: EVE Gate increases your ability to participate in and further enjoy EVE Online from virtually anywhere.
Thats nonsense If i must use my real EVE-Account data. Or did I miss something? This is also one point, wherefore I do not use EVEGate. I have installed EVE on my computer. I can do everything in EVE. Therefore I do not need EVEGate. Log on from an unknown system seems to be a bad idea when I am forced to log with my real account data.
Please correct me if I am wrong. :-/
We own Eve Gate so I'm not sure what you're asking? If you'd clarify I'd like to understand it. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.22 16:20:00 -
[26]
Edited by: CCP Sreegs on 22/11/2010 16:30:19
Originally by: Gabriel Ironfist Will you allow us to change our Usernames as well like the passwords? that would add another layer of security...
I will look into this. I don't expect a quick answer because of how this data is handled. If we make this change you guys will be the first to know about it. |
|
|
CCP Sreegs
C C P C C P Alliance
|
Posted - 2010.11.23 16:19:00 -
[27]
Originally by: Hoshi
That just means you don't get the problem.
I used to use the same password for eve as I use everywhere else but a while ago I changed it to something that I use only for EVE. Now luckily I did this before you changed the requirements to include a capital letter and a number because had that requirement been there at that time I would not have changed my password and because of it I will never under any circumstances change my password for eve again.
Should you force me to I would just stop playing eve instead because having to write a password like that several times per day is not worth the hassle to me. Security is always a walk on a tightrope with security on one side and inconvenience on the other and your password requirement fell off on the wrong side.
I think you'll find that if you read the rest of the response you quoted we've both said essentially the same thing. Today passwords are what we have, so I can't speak to how you can better secure your account today based on what may be in the future. This is today not the future. |
|
|
|
|