| Pages: [1] :: one page |
| Author |
Thread Statistics | Show CCP posts - 0 post(s) |
Chal0ner
Signal Cartel
EvE-Scout Enclave
172
   |
Posted - 2015.10.03 06:01:27 -
[1] - Quote
I hope; When entering a wrong password, rather than getting an error that the username/password is wrong you get a dialog where you enter your character name "Because it has not logged in from this IP before" (or somesuch). And then after entering your character name you get "Wrong password".
|
Danika Princip
GoonWaffe
Goonswarm Federation
3886
|
Posted - 2015.10.03 07:00:02 -
[2] - Quote
The hint is, when you get the box to enter a name, you just press back and retype your password instead. |
Iain Cariaba
1857
|
Posted - 2015.10.03 07:15:42 -
[3] - Quote
Danika Princip wrote:The hint is, when you get the box to enter a name, you just press back and retype your password instead.
But.. but.. but, why should I have to figure that out? CCP should do everything for me.
/sarcasm
I get that box about once a week, or I did before I started working 60 hours a week, even when I put my password in correctly. It's one of those "it'd be nice" things that isn't really important.
EvE is hard. It's harder if you're stupid.
I couldn't have said it better.
Hello, Mr Carebear. Would you like some cheese with that whine?
|
Chal0ner
Signal Cartel
EvE-Scout Enclave
172
|
Posted - 2015.10.03 08:17:04 -
[4] - Quote
Yes I know it's a minor thing.
But it's a bug, it should be fixed when they redoing the launcher anyway.
And if you actually do move between locations you won't know if it's a legitimate dialog or the bug poping up.
Also dynamic IP addresses expire and some ISP uses IP-ranges. /explanationfortechnologychallenged
/sarcasmthatneverexisted |
Kniht
87
|
Posted - 2015.10.04 05:44:32 -
[5] - Quote
Chal0ner wrote:I hope; When entering a wrong password, rather than getting an error that the username/password is wrong you get a dialog where you enter your character name "Because it has not logged in from this IP before" (or somesuch). And then after entering your character name you get "Wrong password".
The reason you are asked for a character name when entering a bad password is to prevent leaking whether the account username exists. You can try this yourself with a random long username and a junk password, and with your username and a junk password.
Consider an unscrupulous EVE player (but I repeat myself) trying to log into your account. They generate several thousand username possibilities, then attempt to log in each one with a single password. There are several ways to automate this from a disposable IP to evade potential IP bans. If this attack tells them which usernames are valid, those handful are tried with many passwords each. Eventually the brute force will work, and they will steal your pixels.
By not leaking information on incorrect attempts, this attack surface stays large enough that other measures (such as IP bans) stay effective.
There is the checkbox to "Don't ask me this again" if you change locations often; I don't know when that was added.
o/ fly crazy
|
Chal0ner
Signal Cartel
EvE-Scout Enclave
172
|
Posted - 2015.10.04 06:13:31 -
[6] - Quote
Kniht wrote:Chal0ner wrote:I hope; When entering a wrong password, rather than getting an error that the username/password is wrong you get a dialog where you enter your character name "Because it has not logged in from this IP before" (or somesuch). And then after entering your character name you get "Wrong password".
The reason you are asked for a character name when entering a bad password is to prevent leaking whether the account username exists. You can try this yourself with a random long username and a junk password, and with your username and a junk password. Consider an unscrupulous EVE player (but I repeat myself) trying to log into your account. They generate several thousand username possibilities, then attempt to log in each one with a single password. There are several ways to automate this from a disposable IP to evade potential IP bans. If this attack tells them which usernames are valid, those handful are tried with many passwords each. Eventually the brute force will work, and they will steal your pixels. By not leaking information on incorrect attempts, this attack surface stays large enough that other measures (such as IP bans) stay effective. There is the checkbox to "Don't ask me this again" if you change locations often; I don't know when that was added.
Oh so it's like a kind of 2FA? That would hopefully make sense if done intentionally.
|
Kniht
87
|
Posted - 2015.10.04 06:25:42 -
[7] - Quote
Chal0ner wrote:Kniht wrote:The reason you are asked for a character name when entering a bad password is to prevent leaking whether the account username exists. You can try this yourself with a random long username and a junk password, and with your username and a junk password. Unfortunately entering a random username ("KalleAnka") and a random password, then hitting Log In, results in "Invalid username / password". It's only when the username is correct and the password is wrong that I get to enter the character name. Which indicates that the user name is actually correct, giving away one of two parameters.
I did try it right before I posted, maybe the "random long username" I tried actually exists, though it was something like fjdksalhfdskjaljfkdla, and I got the prompt for character name. Or maybe I've been flagged in some way and see different behavior from most.
And I should have said "attack surface stays small enough...", silly language.
o/ fly crazy
|
Chal0ner
Signal Cartel
EvE-Scout Enclave
172
|
Posted - 2015.10.04 06:33:41 -
[8] - Quote
Kniht wrote:I did try it right before I posted, maybe the "random long username" I tried actually exists, though it was something like fjdksalhfdskjaljfkdla, and I got the prompt for character name.
And I should have said "attack surface stays small enough...", silly language.
Hmm, that's weird I tried with "asfsdafsdfasdfasdf" and a random password. And I got the same as you - while trying the first again, I also get the response posted in my previous post. I'll post this as a bug in-game and see what happens.
Hopefully it'll all be irrelevant shortly (with the new launcher). |
Kniht
87
|
Posted - 2015.10.04 06:37:37 -
[9] - Quote
Chal0ner wrote:Hmm, that's weird I tried with "asfsdafsdfasdfasdf" and a random password. And I got the same as you - while trying the first again, I also get the response posted in my previous post. I'll post this as a bug in-game and see what happens.
Hopefully it'll all be irrelevant shortly (with the new launcher).
Maybe "KalleAnka" exists and has checked "Don't ask me this again".
By the way, a custom launcher can store your password. I've been working on one myself, and it works quite well for me. For you, I'd suggest one of those posted elsewhere, without a specific recommendation.
Asking for character name isn't two-factor auth, but it does make it much harder to brute force than just username and password.
o/ fly crazy
|
| |
|
| Pages: [1] :: one page |
| First page | Previous page | Next page | Last page |