Originally by: Wollari

---

I also got already some kind of eve newsletter where all URLs have been masked using tinyurl.com

---

Originally by: Vilgan Mazran

---

SPF records have been pretty mandatory for ages. How has CCP not been getting emails rejected essentially saying "your SPF records are nonexistant or not specific enough, contact your postmaster". Like wtf :P

---

Originally by: PC l0adletter

---

Authenticators, please.

Originally by: CCP Sreegs

---

Just out of honest curiosity, what positive outcome do you think would come from detailing specific counter-hacking/botting methodologies? What would you gain from this knowledge personally? I understand that you WANT to know things, but I'm having a hard time wrapping my head around how some knowledge being public information would be to anyone's benefit and I'd like to hear an alternative viewpoint.

---

I'm gonna go ahead and hope that this devblog is evidence that you're reconsidered. Reckless, I know.

---

Originally by: Cyaxares II

---

Edited by: Cyaxares II on 21/01/2011 09:02:55

nice devblog - except for the heavy scaremongering

Quote:

---

If you got it for free there's a catch and they're probably stealing from you.

---

There are plenty of (free) AHK/IS scripts floating around that verifiably don't contain any malicious functionality on their own and it seems highly unlikely that AHK or IS itself would be specifically adapted to steal EVE account data (especially for AHK, IS might be more risky).

On top of that stealing account data is just plain bad business for most paid-for bots (especially subscription-based ones) - the only case i can come up with in which it would make sense to steal an account would be if CCP did magically manage to disable botting thus denying the bot writer any further revenue from his work.

If you want to convince us not to use bots please do it by delivering decent arguments and not FUD.

Taking a very wild guess I would guess that a similar amount of information is stolen through the official API ("all your in-game mails are belong to us") or through tools building on the API that are trojans, keyloggers, ... as is via bots.

Just provide a "Download source here" link and nobody will check if the version he could compile from source matches with the official binary, anyways.


edit: also, consider that people running bots are already willing to gamble their account based on incomplete information - otherwise they wouldn't break the EULA.
Saying "OMG you might lose access to your account" might change the perceived odds but it's a quantitative change rather than a qualitative one.

... and without naming & shaming (and providing reproducible steps to confirm the malicious behavior) you are not exactly the most credible source of information on the risks of botting to start with as CCP has a large business interest in making EULA violations look extremely risky, independent of reality.

tl;dr serious botters will carry on as before (because they know what they're doing and probably use their own software anyways), some casual botters might be a bit scared but will reaffirm each other that you're just spreading FUD in their forums and my mood is ruined by reading that silly, silly paragraph.

---

Originally by: Agent Stone

---

Edited by: Agent Stone on 21/01/2011 09:54:00
Would a security token not act as another valuable block against this? I am pretty sure people have been asking CCP to release one of these, either Smartphone based, or via the Eve Store for years.

For example, see this thread from about a year ago where people are asking CCP to release such after a similar security blog post.

Your competitors (Blizzard as an example) are years ahead of you in this regard.

---

Originally by: Sentient Blade

---

There is a potential sixth wall that I do not see mentioned which is effectively "Tell me something about myself".

Show me your birthmark... Show me the rose... drop your pants*

To put it simply, allow each player to define a few words that are tied to their account such as "turtle, antelope, gallentesux" and display this string to the person attempting to login prior to them getting to the sector factor of authentication, i.e.

<Enter name and password>
Hello [Full real name]. This is CCP server secure.eveonline.com saying "[word string]" please enter any character name to continue.

This would give an opportunity for the user to verify that the server already had sufficient details on the account to know their real life name and their secret word string, and back out, before entering the character name.

* James Bond reference

Geographic Jumping Checks

Seen as it is unlikely that the person attempting to phish for accounts is going to be living in the house next door, or even in the same country for the most part, login attempts to both websites and the EvE client should be GeoIP'd and the original registrar notified via email when 2 logins occur within a short period which come from geographically diverse locations.

In game / out of game paradox

It occurs to me that there is somewhat of a paradox in security within the EvE universe where CCP seems to condone, and perhaps even actively encourage scams and behaviour designed to strip a victim of all of their assets and enjoyment through trickery and obscufation of data, in an almost identical way to how phishing attacks work.

Is there really that much difference in the CCP financial loss / bad player experience when comparing the end results of in-game scamming vs out-of-game phishing?

How does CCP reconcile treating two mechanism with near identical end results differently?

Misc

* What's wrong with letting the EvE login screen remember passwords? If someone can read my hard disk where they're stored I've got bigger problems.

* Can we have a webpage to show all of the recent login times / IPs / Locations we've connected with? Like we do on the EvE API. Heck, mail it out distinct(location) once a month or so.

---

Originally by: DmitryEKT

---

Gmail labs has a thing you can enable which puts a little key icon next to legit emails from ebay/paypal to make it obvious they're not fakes. Have CCP thought of getting in on that?

---

Originally by: Remulon McNab

---

Quote:

---

SPF will be implemented in approximately 7 days. DomainKeys will take a bit more time as things need to be moved around in order to implement that properly

---

@CCP Sreegs
Why are you guys implementing SPF and DKIM/DomainKeys now, technology wise the start of 2010 was the year that everyone started encountering huge problems related to phishing.
So from my point of view you are a bit late, especially with all those phising mails going round.

What are the global plans to protect your customers from phishing/account security issues in the future?

Mail security & deliverability is part of my daily job and those are going hand in hand

---

Originally by: Lost Hamster

---

Originally by: CCP Sreegs

---

Block 3 - Block 3 is where we ensure that we're properly authenticating our users. Authentication from our perspective is ensuring that you are you. Not that you are someone with your password. That you, guy whose name is yours, is really you. An initial shot at this was when we began asking you to name one of the characters on your account.

---

The idea itself is not bad, however there is still a hole in the security system.

With this feature you try to protect the account management - that's fine.
However if a bad guy have access to the user name and password, then how long will it take to get a character name on that account?
I will tell you. 15 seconds.. Just log in to the game and voila.

However it's a positive note that the similar hole on the evegate site have been filed. :)

So please get a similar login screen to the game as well. With an option to save the Character name to the individual game files.

---

Originally by: Avensys

---

Edited by: Avensys on 21/01/2011 09:11:46

(posting on a different character as it's a separate point)

How does asking for a character name actually help?

Wouldn't phishing sites just ask for a character name as well (they want to mimic the "real" login process as closely as possible after all)?

---

Originally by: Sentient Blade

---

In my experience it really depends on how big a hole they can punch in the attack surface, and 99% of the time if that hole is big enough that if it provides a means of reading the hard disk then that hole is also big enough for them to be capable of installing a keyboard hook or swiping the person's paypal or banking details and using them to create a few hundred accounts.

That's a worse case scenario of course, but once it gets to the remote code execution stage there is not much more that can be done on your part - it's the actual identity of the account holder that's been compromised rather than the underlying security of EvE.

---

Originally by: Remulon McNab

---

@Sreegs
Thanks for your reply, besides SPF it might be worth in implementing SenderID besides SPF.
This improves deliverability of all your e-mail messages.

I am aware of the fact that SenderID is backwards compatible, though it's still useful as Microsoft implements it in all their mailserver software.

So far, great job!

---

Originally by: ROXGenghis

---

You could look at RSA's Site Key:

http://en.wikipedia.org/wiki/SiteKey

I've never had a problem with it as a user, but I haven't studied its protocol so I can't vouch for it at this point.

---

Originally by: Melekhar Tazinas

---

Sreegs, have you guys considered signing your emails with a GPG signature?

Not that many people use GPG-enabled email clients, but for those of us that do, there's few better means of authenticating your emails.

---

Originally by: Wollari

---

You just advised to use SPF to block spammail where other people claiming your identity. SPF is okay in general, but the way your SPF record is registered doesn't let the fakemail getting dropped.

== your spf record ==

mail:~# host -t TXT eveonline.com
eveonline.com TXT "v=spf1 mx ip4:87.237.32.0/24 ip4:87.237.38.0/24 ip4:87.237.39.0/24 mx:mail.global.frontbridge.com mx:ymir.ccpgames.com ~all"

the "~all" match generates a "softfail". Mail in general gets "marked" as possible identity problem but won't get discarded in the first instance of the mta. It's good for testing and monitoring purpose.

If you're 100% sure that no other systems (apart from the listed in your SPF record) will send emails from eveonline.com it's maybe an idea to change "~all" to "-all". This will other MTAs force to drop the mail if it's not send by an authorized system. This may cause problems when somebody is forwarding emails from one account to another. But that's a different story.

When you're happy with your spf record change it to -all and prevent us all from the spam.

happy mailing.

Removed a forum-breaking tag. Spitfire

---

Originally by: Thirler

---

Thanks for a good insight.

I have a related question, one of my corporations members got hacked earlier. He had some trouble in getting a quick reaction to get his account blocked/returned to him quickly(he got locked out), there wasn't really a petition section appropriate for this.

What is the best way to reach CCP when you think your account has been hacked? I would imagine the priority should be the same as the 'stuck' section as this can minimize the harm done and the profit for the hackers.

---

Originally by: TCL987

---

Everything is hackable, using an authenticator just makes it harder and prevents someone from gaining access to your account using a keylogger. Given enough time someone could eventually figure out the algorithim but it would take too long to be worth it.

---

Originally by: herot

---

Originally by: CCP Sreegs

---

Originally by: Sentient Blade

---

2) Playing with location IMO is part of Authentication and I'll have something more to say about that soon.

---

One also have to consider that some of us use VPN services and can therefore appear to flit around the world in a strange fashion (or even be i two places at once if we for instance log in from diffrent comupters to the forum and the game, with one machine routing through VPN).

---

In any scenario flitting around the world would probably only require you to validate yourself out of band somehow. To be frank, this is still something we're thinking through and your concern here is something we're taking into consideration.