102205-you-must-get-two-factor-authentication

== Content ==
			
Hi all,
 
After a recent hacking experience, I feel compelled to make this post...
 
So I bought the game on July 18th and spent the weekend playing it, as you'd expect. Get back from work Tuesday, can't log in, says my account is active on another client - kinda scary message. So went into my emails, saw an email stating that a failed login attempt from Taiwan had occured - ok, now I'm really concerned. At this point it occured that perhaps two factor was a good idea, so I set it up.
 
Registered my IP again and managed to log in, only to find my character half way across the world, with several platinum in cash (up from less than 10 gold previous) and an inventory full of items. So I've spent less than a week on this game and I'm hacked already? What the actual f...
 
Of course, I create a support ticket immediately and I have to say they responded (initially) very quickly. Now, they instruct me to do virus scans and change passwords, so I do all that and let them know. Then it goes to a restoration team, my sub gets cancelled and basically I'm waiting until today for it to finally get resolved (after chasing them up a couple of times!).
 
So all good right? Decent customer service (with some gentle prodding) and got my account back. Well, something is bothering me...
 
I'd never been hacked before, I'd never felt I needed anything more than a traditional username and password for any online service. All the anti-malware, anti-spyware and anti-virus scans I had done came back clean, my email hadn't been touched. I hadn't received any dodgy email, not been to any dodgy websites... I just can't understand how it happened.
 
One of the messages I received from support stated that "the daily volume of account comprimise tickets is rising". So much so in fact they went on to say that basically they are just giving people a set of items depending on class and level rather than specific restorations.
 
Take into account the amount of hacking stories on the forums and posts from officials saying the same sort of thing as I had received from support then a picture begins to appear. So I'll take an educated guess and, prepare the tin foil hats, say that:
 
Accounts are being systematically farmed and hacked and if you don't have two factor then it is not a case of IF it is a case of WHEN. You WILL be hacked if you don't have two factor.
 
Forget the XP bonus and the mount, forget having an extra layer of security - this is about simply protecting against what appears to be inevitable.
 
@Carbine and NCSoft - what are you doing about it? Your staff freely admit that hacking is increasing big time. Seems to me your user account systems are wide open to attack. This is a great game and when I have been able to play it's been fun, but lets not have the whole game ruined by a half arsed accounts system. You may as well publish a list of accounts and passwords on the internet, it's pretty much the same thing happening here. Seriously though, do something about it!
 
Anyway, thanks for reading - if you didn't make it through the text wall then for a TL;DR see the bold text!	
----
			I think what they're doing about it is giving the option of 2f verification.	
----
			
Hackers are getting better and better at what they do.
 
It's their job, their livelihood.
 
This is why two-step and authenticator keys exist for so many games.
 
Also why pin numbers and atm cards exist IRL. Imagine if all you had to do was show up to a bank with an account number and password, I'd be rich beyond my wildest dreams.	
----
			
It's not just freelance criminal hackers looking for credit card info you gotta watch out for. 
http://www.pcgamer.com/2011/08/08/north-korea-deploys-squad-of-mmo-gold-farmers-to-fund-regime/
http://www.gamepolitics.com/2013/04/12/kaspersky-chinese-hacking-ring-has-hacked-multiple-mmo-game-servers#.U9O6C_ldWSo	
----
			
{| class="blockquote"
It's not just freelance criminal hackers looking for credit card info you gotta watch out for. 
http://www.pcgamer.com/2011/08/08/north-korea-deploys-squad-of-mmo-gold-farmers-to-fund-regime/
http://www.gamepolitics.com/2013/04/12/kaspersky-chinese-hacking-ring-has-hacked-multiple-mmo-game-servers#.U9O6C_ldWSo
----
			Why can't they make it mandatory, I mean there is a PC version of the 2 step.	
----
			
{| class="blockquote"
Why can't they make it mandatory, I mean there is a PC version of the 2 step.
----
			
{| class="blockquote"
All the more reason people shouldn't support gold farmers.
 
But hey, I'm the idiot that gives plat to lowbies to help them on their way and offers what information I have in /advice. I am an outdated relic trying to exist in modern(selfish) gaming.
----
			
{| class="blockquote"
Why can't they make it mandatory, I mean there is a PC version of the 2 step.
----
			
{| class="blockquote"
have you met people before? typically these days if you tell someone they have no choice they'll dig in their heels, scream about their rights being violated blah blah blah even though it may be looking out for them.
 
so, you give them a choice and you STILL have people saying they shouldnt have to do this, never been hacked blah blah blah (mind you some of the same people saying this is 2014, get with the times for other aspects...funny eh?)
 
so you offer a choice, with incentives and now a mount and STRONGLY recommend doing it, and people still complain about it despite people getting compromised daily
 
bottom line is you can lead a horse to water, but its going to complain that it had to walk there...
----
			
{| class="blockquote"
Everyone hates when I say this but: Take some responsibility for ones-self.
----
			
Thanks for the replies. I'll admit that I should of gone down the two factor route when I signed up - I can accept that.
 
The idea of my OP was that I'm trying to encourage more to take up the two factor not moan about Carbine/NCSoft. I know many will be in the same boat as me; "as long as I have a strong password I'll be fine, I don't want to have to jump through hoops just to log in every damn time!" - which is a totally understandable viewpoint.
 
The client has some responsibility here and I can accept my failings on that part. However, that doesn't take away their responsibility to have a secure system - there is a serious problem at their end, and they need to acknowledge and persue that.	
----
			
{| class="blockquote"
Thanks for the replies. I'll admit that I should of gone down the two factor route when I signed up - I can accept that.
 
The idea of my OP was that I'm trying to encourage more to take up the two factor not moan about Carbine/NCSoft. I know many will be in the same boat as me; "as long as I have a strong password I'll be fine, I don't want to have to jump through hoops just to log in every damn time!" - which is a totally understandable viewpoint.
 
The client has some responsibility here and I can accept my failings on that part. However, that doesn't take away their responsibility to have a secure system - there is a serious problem at their end, and they need to acknowledge and persue that.
----
			
Just remember if you STORE your password on your computer, your odds of getting hacked are much higher. Two-factor is overrated.
 
My password is a number +world of warcraft item.
 
Comehaxmeplz.
 
{| class="blockquote"
 "as long as I have a strong password I'll be fine, I don't want to have to jump through hoops just to log in every damn time!" - 
----
			
{| class="blockquote"
bottom line is you can lead a horse to water, but its going to complain that it had to walk there...
----
			
{| class="blockquote"
Just remember if you STORE your password on your computer, your odds of getting hacked are much higher. Two-factor is overrated.
 
My password is a number +world of warcraft item.
 
Comehaxmeplz.
 
i'll have a weak password and take my chances.
 
http://xkcd.com/936/
----
			
{| class="blockquote"
@Carbine and NCSoft - what are you doing about it? Your staff freely admit that hacking is increasing big time. Seems to me your user account systems are wide open to attack. This is a great game and when I have been able to play it's been fun, but lets not have the whole game ruined by a half arsed accounts system. You may as well publish a list of accounts and passwords on the internet, it's pretty much the same thing happening here. Seriously though, do something about it!
----
			
{| class="blockquote"
I've seen the same claims made by people for over a decade.   It's very doubtful that their "user account systems" are "wide open to attack."  I'd say it's more likely that an insider is selling the information.  Even then you'd have to be using a horrible password that could be cracked.  And even then, the chance that either of those is the case is small compared to plain ol' user stupidity.
----
			
{| class="blockquote"
Or a popular site has a bad ad on it.
 
Or any number of things that can steal info.
----
			
{| class="blockquote"
This is pretty much why i dont go to any game related sites anymore.  Even legit sites like pcgamer or anything like that.  I havent been to curse yet despite claims that as long as you dont use the client you are fine, or that the attacks happened long ago or that it was all just a rumor.  And I actually hate it when a person asks for help in game and someone replies back 'google it'.
 
WTS tin foil hats 5 plat PST
----
			
{| class="blockquote"
Venompaw@google.com
2014ThunderfuryBlessedBladeOfTheWindseeker
 
 
\o/
----
			
I posted this before and I will post it again every time I see these threads.. :
 
 
 
I really don't know how so many people manage to get so careless with their account safety.In my ten years of playing online games, I have NEVER had any of my accounts "hacked". Not once. I have never used an authenticator for any of my accounts over the years, because I know that no one will ever hack my passwords. The only person that ever has access to any of my accounts is me, and no one else. You all claim that it is required to have an authenticator to keep your account safe, but it really isn't.- Stop sharing your password with your "friends" and other people.- Stop using the same password on multiple websites and games. (Probably the main cause of accounts getting hacked)- Stop using the same recovery questions on multiple websites and games.- Stop using easy-guess passwords because a "long and complex" one will be too hard for you to remember.- Keep YOUR computer system secure. It is most likely your system that is insecure, not Carbine's. - Don't visit malicious looking websites.- Don't download an obvious keylogger.
- Change your password every 1-2 months.- Have common sense.It's really that simple to never get your account hacked.	
----
			
{| class="blockquote"
I use curse client. I also use different emails for different accounts.
 
Never use the same thing twice.
----
			
{| class="blockquote"
I posted this before and I will post it again every time I see these threads.. :
 
 
 
I really don't know how so many people manage to get so careless with their account safety.
 
In my ten years of playing online games, I have NEVER had any of my accounts "hacked". Not once. I have never used an authenticator for any of my accounts over the years, because I know that no one will ever hack my passwords. The only person that ever has access to any of my accounts is me, and no one else. You all claim that it is required to have an authenticator to keep your account safe, but it really isn't.
 
- Stop sharing your password with your "friends" and other people.
- Stop using the same password on multiple websites and games. (Probably the main cause of accounts getting hacked)
- Stop using the same recovery questions on multiple websites and games.
- Stop using easy-guess passwords because a "long and complex" one will be too hard for you to remember.
- Keep YOUR computer system secure. It is most likely your system that is insecure, not Carbine's. 
- Don't visit malicious looking websites.
- Don't download an obvious keylogger.
- Change your password every 1-2 months.
- Have common sense.
 
 
It's really that simple to never get your account hacked.
----
			
Computer security must be treated like building security.  Because computer security is exactly the same as building security.  The thing to remember is that hackers go for the low fruit,  For them stealing an account has to be worth the effort vs the expense.  Buying a malwarebot and tossing it into a phishing email is pretty cheap just as picking a conventional door lock is pretty easy or simply kicking the door in.
 
Oh but why am I comparing to building security here.  2 factor auth is like spending the money on a deadbolt.  You have raised yourself to mid hanging fruit status now,  The effort vs reward is no longer worth it when there are so many easy targets out there.
 
I think a vital thing to remember when securing an MMO account is first get 2 factor auth.   Second never trust emails that state your account is under any investigation and that you must login.  Also if you use an email program like Outlook or Thunderbird as an example leave the default setting about loading email content set to off this way any payloads that could be loaded by rich content do not load.(I do not load extra content from anybody I do not know)  And remember that a legit NC-Soft email will never ask for account info.   If you get a mail claiming your Wildstar is suspended best bet is to open a browser window and manually go to the actual NC site and try to login or open your Wildstar and try to login because I know from my experience with WoW the hackers sound out a shitload of fake "you are banned" emails to capture passwords.	
----
			One word, NCSoft.  People who don't protect their accounts and CCs are crazy.	
----
			
Honestly, I'd never trust an account with just a password if 2FA is available.  Your password will never be immune to being cracked or logged.  2FA is essentially, at least for the purposes of RMTs, unbreakable.  Literally a million in one chance they will guess the right number at that particular moment and it will only be the same number twice one in a million times.  Literally one in a million; 106.
 
But that's a lesson people are coming to gradually.  It used to be that you were told to think of an easy password to remember, but don't write it down because if someone breaks in, they can access all your accounts.  Once people realized that the guys breaking into your house rarely were also interested in breaking into your game account or water bill provider (they tend to just steal checks and bills to hopefully break into your bank account), the advice was to choose something complicated, but idiosyncratic and just write it all down.  In the end, though, you only have to be broken once.
 
You may not think you need 2FA, and that's your decision, but 2FA on an independent device is the closest thing there is to a bulletproof vest in computer security.  If it's offered, I'm never without it.	
----
			Kinda feel like Rift's Coinlock feature is ridiculously underused. As long as you aren't stupid enough to use the same password for your account and email it works. No point in hacking if you can't sell anything:)	
----
			
You *gave* them your password to them unknowingly.
 
*you logged into a webpage that looked legit and of course it wasn't.
*you opened an email and/or attachment that ran a keylogger on your machine and in turn it transmitted itself back to the owner. (check your firewall rules, I bet there is a new one)
 
Your IP wasn't randomly selected. There are trillions of them. No one is special. We're all fodder to them, well the ones that fall for the oldest tricks in the book. No one randomly connected to your computer from the basement of a secret lab in Sri Lanka by choice.
 
They let us do it for them. Every time.	
----
			
{| class="blockquote"
I posted this before and I will post it again every time I see these threads.. :
 
 
 
I really don't know how so many people manage to get so careless with their account safety.
 
In my ten years of playing online games, I have NEVER had any of my accounts "hacked". Not once. I have never used an authenticator for any of my accounts over the years, because I know that no one will ever hack my passwords. The only person that ever has access to any of my accounts is me, and no one else. You all claim that it is required to have an authenticator to keep your account safe, but it really isn't.
 
- Stop sharing your password with your "friends" and other people.
- Stop using the same password on multiple websites and games. (Probably the main cause of accounts getting hacked)
- Stop using the same recovery questions on multiple websites and games.
- Stop using easy-guess passwords because a "long and complex" one will be too hard for you to remember.
- Keep YOUR computer system secure. It is most likely your system that is insecure, not Carbine's. 
- Don't visit malicious looking websites.
- Don't download an obvious keylogger.
- Change your password every 1-2 months.
- Have common sense.
 
 
It's really that simple to never get your account hacked.
----
			
2 suggestions I would like to make:
 
1. my phone is a blackberry which is currently unsupported. I am all for 2 step authentication but I cannot currently use it.
 
2. When it comes to certifying IPs. I frequently get told when logging in that the IP I am using is uncertified and have to authorize another one. A thought I had is since it also displays the country why can we not exclude certain IPs from accessing our accounts. IE, block all accounts originating from outside the country which the account holder lives. Dont know how possible that is and I know there are IP spoofers but it would still be enough I think to stop some.
 
Personally I dont think any solution would be full proof, hackers will always find a way.	
----
			1. you are aware you can put it on your pc right?	
----
			
{| class="blockquote"
Just remember if you STORE your password on your computer, your odds of getting hacked are much higher. Two-factor is overrated.
 
My password is a number +world of warcraft item.
 
Comehaxmeplz.
 
i'll have a weak password and take my chances.
 
http://xkcd.com/936/
----
			
{| class="blockquote"
Am i wrong about curse client? yah i probably am, but i dont care.  Can anyone convince me otherwise? no probably not. 
----