148443-carbinencsoft-and-security

== Content ==
			
Not their strongest point...
 
I just finished installing a Laptop with Windows 10 and the latest Firefox on it.
I cannot even access the Wildstar forums anymore on that system because Firefox keeps complaining about the Cypher issue with the certificate. And adding an exception is no longer possible due the severity of the error.
 
This is has been reported months ago, and is still not resolved...
 
And the whole security concern with the authenticator is being swept under the rug as well by Carbine and NCSoft support.
I have not received a single, sensible response on the relevant topic in regards to the security hole for removing authenticators.
 
 
Carbine and NCsoft, get your act together please before it is too late.
			
				
	Edited December 23, 2015 by Olivar	
----
			Just for reference, Oli is talking about the fact that if 2FA is what is stopping someone from hacking your account, they already know enough to simply remove your 2FA.	
----
			
My technical insight is limited so there's not a lot I can add to the discussion.
Just this: These issues have been discussed (rather one-sidedly) for months. One of them got to the point where a major browser stops working with your forum. For security reasons. These are not the issues that eventually go away if you just ignore them long enough. It's time to at least talk to us if there's nothing you can do to actually fix them. Preferrably before anything major happens.
It's great that the devs are listening but when your customers are concerned about the security of their accounts (and associated information) you may want to at least come out and pass the ball so our concerns can be directed at the people who can do something about it.	
----
			I'm on Firefox 43.0.2 (64 bit) and all i get is a weak encryption indicator on the pad lock.	
----
			
I've never had issues with the forums (I use Chrome and an older version of Safari) but what they've done with the 2-Step Authentication is easily one of the worst mistakes Carbine/NCSoft has ever made. I always felt better knowing my account was secure but my account doesn't feel as secure anymore :( If someone manages to get your email and your account password there is nothing stopping them from removing the authenticator and hacking your account which completely defeats the purpose of using it in the first place. If this happens all the authenticator does is delay hackers from hacking your account for a few minutes while they remove it. I'm glad I have 2-Step Authentication on my email as well because it still helps me feel that my account is secure in some way.
 
They need to make it so that only Customer Support can remove the Authenticator again. I know it's a hassle for some people who have lost their phones/etc and had to ask CS to get it removed, but that doesn't mean that everyone's account security should be put at risk. I've been hacked in the past (my FaceBook account) so I now take every step possible to protect all my accounts. I don't want to lose my WildStar account, I've put so much time, effort and money into it, so someone being able to just remove the extra protection I put on it if they get my other details, and hack it, is really unsettling.	
----
			
Hey Everyone -
 
Thanks for the feedback. We are continuously working on ways to make encryption better, and safer, for everyone. I'll take your thoughts to the appropriate teams and see what we can do.
 
Thanks!	
----
			
DD,
 
That is what has been promised/said months ago; yet the forums are still running on outdated security measures.
Updating this certificates is a 10 minute job really.	
----
			Since I really don't know much about the issue, is this a legitimate security risk Oli (as far as our financial information is concerned?), or is it only potentially compromising for our forum accounts?	
----
			
It's always been weird to me that even after the initial wave of "security warnings" it just keeps popping off every now and then either on my phone, desktop, or both with various browsers. Forums for the longest time especially seem to just be "wonky" for lack of a better word long as I can remember.
 
In regard to the authenticator change I really hope that changes back to the old method.	
----
			
{| class="blockquote"
Since I really don't know much about the issue, is this a legitimate security risk Oli (as far as our financial information is concerned?), or is it only potentially compromising for our forum accounts?
----
			
That has happened to me many times using firefox
 
eventuality the issue goes away but it happens from time to time....twice it happened to me thus far....	
----
			
{| class="blockquote"
That has happened to me many times using firefox
 
eventuality the issue goes away but it happens from time to time....twice it happened to me thus far....
----
			
{| class="blockquote"
DD,
 
That is what has been promised/said months ago; yet the forums are still running on outdated security measures.
Updating this certificates is a 10 minute job really.
----
			
Just to play Devil's advocate on this for a moment...
 
The site also uses SSO for a unified credential across Lineage, B&S and Aion, through the standard NC backend. Now, depending on if they're using SAML or OAuth, that's a whole additional layer of complexity. It means you've got to consider how the cert update affects the relationship with all those additional systems, or the whole thing breaks and users can't log into the forums at all.
 
Now, considering that (I think) the forums are provided by NC and aren't (I think) maintained by Carbine directly, and there's a layer of distancing, change management, and general IT governance that something like this needs to go through. It's not some 30-person startup that can move on a dime, but a large IT conglomerate that moves at a much slower pace.
 
They also likely have a Christmas change freeze in place - just about every large firm has a lockdown on any non-critical changes until something like Jan 10 when the holidays are generally over.
 
That said, if it's now preventing a group of users from accessing the forums, it'll need to be bumped up the change request queue. All I'm saying is don't expect something in the next 2-3 weeks - it's very unlikely to happen.	
----
			
Let me elaborate a bit on that, as we are getting a bit technical now.
 
NCSoft uses a single sign on system, similar to the CAS mechanic. This stands for Centralized Authentication System.
Basically you authenticate at a centralized system, are redirected to whereever you came from, and that system asks the CAS to authenticate the request.
Which is what the multiple bouncing is. You are one one site; are authenticating and bounced around until you hit that one site that actually formed the original request.
 
Which is fine. It works, all be it a bit slow and cu,bersome, but it works.
However, the problem here is that a security mechanism is only as good as its weakest link.
In this case the Wildstar forum website.
Actually the whole forum of NCSoft. You can go to any of the forums used by NCSoft; and you will get the same warning by Firefox.
Because NCSoft uses the same forum for all their games.
Which is why you can find Wildstar search results on the Blade and Soul forums for example, it is the exact same forum.
 
And one entry point is enough.
When one person gets access to your system, it does not even matter if he can read the data; use the data.
All he needs to do is announce he was inside; post some proof if it and your reputation is gone.
You can close shop because nobody is going to trust a company that cannot safeguard its customers data.
 
Which is exactly why this topic is here.
This certificate is a 10 minute job. Regardless of the system used.
I do this for a living; trust me when I say that this is a simple task, that needs to be fixed ASAP.
Update your certificate; point your webservers to use the new certicate, and update your "clients" to get the new shared key.
 
Or run the risk of reading about a security breach soon on the Internet.
The choice is yours Carbine; I advice you go for the first approach and do it fast.	
----
			
Sorry to split hairs over this, but regardless of the technicalities, you're saying it's a 10 minute job. I don't disagree with that. But:
 
The certificate needs to be generated. In fact, you'll need multiple certificates for each environment you have (production, pre-production, development, etc).
Documentation describing the planned change needs to be written
Test cases need to be generated
A back-out plan needs to be prepared.
The change needs to be implemented, tested and regression tested on lower environments.
It needs to pass through change board approval
An outage slot needs to be booked. There might be a change freeze in place over the winter.
Planned downtime is communicated to players.
Your 10 minutes of work can take place.
An period of sanity and regression testing takes place to ensure the change has been applied successfully
The outage is closed. 
In my book (yes, I do this for a living as well, for firms with more live customers than NCSoft as a group), that's more than ten minutes work. 	
----
			
{| class="blockquote"
Sorry to split hairs over this, but regardless of the technicalities, you're saying it's a 10 minute job. I don't disagree with that. But:
 
The certificate needs to be generated. In fact, you'll need multiple certificates for each environment you have (production, pre-production, development, etc).
Documentation describing the planned change needs to be written
Test cases need to be generated
A back-out plan needs to be prepared.
The change needs to be implemented, tested and regression tested on lower environments.
It needs to pass through change board approval
An outage slot needs to be booked. There might be a change freeze in place over the winter.
Planned downtime is communicated to players.
Your 10 minutes of work can take place.
An period of sanity and regression testing takes place to ensure the change has been applied successfully
The outage is closed. 
In my book (yes, I do this for a living as well, for firms with more live customers than NCSoft as a group), that's more than ten minutes work. 
----
			
{| class="blockquote"
Sorry to split hairs over this, but regardless of the technicalities, you're saying it's a 10 minute job. I don't disagree with that. But:
 
The certificate needs to be generated. In fact, you'll need multiple certificates for each environment you have (production, pre-production, development, etc).
Documentation describing the planned change needs to be written
Test cases need to be generated
A back-out plan needs to be prepared.
The change needs to be implemented, tested and regression tested on lower environments. LOL
It needs to pass through change board approval
An outage slot needs to be booked. There might be a change freeze in place over the winter.
Planned downtime is communicated to players.
Your 10 minutes of work can take place.
An period of sanity and regression testing takes place to ensure the change has been applied successfully
The outage is closed. 
In my book (yes, I do this for a living as well, for firms with more live customers than NCSoft as a group), that's more than ten minutes work. 
----
			
I reported this a couple of weeks back and was told they are working on it.
 
Besides the game sites and forums,I get the exact same warning in the NCoin shop,
and I can tell you I don't feel comfortable with inserting my CC info on that site anymore.	
----
			
Shall we take a look at Steam with the disaster that just happened there?
Security is not to be taken lightly.	
----
			
My version of firefox (43.0.3, 64 bit) has just blocked the website.
 
Error message
An error occurred during a connection to forums.wildstar-online.com. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap)
    Please contact the web site owners to inform them of this problem.    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.	
----
			
yep, had that too.
You need to change the Firefox config to allow fallback on old SSL protocols...
 
Carbine/NCSoft, wake up and fix this.	
----
			
{| class="blockquote"
Hey Everyone -
 
Thanks for the feedback. We are continuously working on ways to make encryption better, and safer, for everyone. I'll take your thoughts to the appropriate teams and see what we can do.
 
Thanks!
----
			
{| class="blockquote"
My version of firefox (43.0.3, 64 bit) has just blocked the website.
 
Error message
 
An error occurred during a connection to forums.wildstar-online.com. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap) Please contact the web site owners to inform them of this problem. The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
----
			
{| class="blockquote"
 
My version of firefox (43.0.3, 64 bit) has just blocked the website.
 
Error message
An error occurred during a connection to forums.wildstar-online.com. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap)
    Please contact the web site owners to inform them of this problem.    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
----
			
{| class="blockquote"
Not that the underlying issue doesn't need to be corrected..but I'm not seeing the same error, using the same version of Firefox..
----
			
{| class="blockquote"
Have you altered any security settings? I've not touched them since I originally installed Firefox. When I first saw this thread the only issue I had was a with weak encryption notice then early yesterday morning the website just stopped loading and gave that error message.
 
I'm surprised we've not had a Carbine response saying it's been looked at, again.
 
Edit: Firefox is now back to normal with no changes done by me. I still get the weak encryption warning though.
----
			
{| class="blockquote"
Nope, default install.. I get the weak encryption warning, but that's it..
----
			
{| class="blockquote"
It seems fixed for me so maybe it was fixed by the time you logged in.
----
			
Weak encryption warning has gone!
 
The Blade and Soul forums now refuse to load. :(	
----
			
about bloody time.
Just leaves us now with the authenticator mess.
			
				
	Edited January 7, 2016 by Olivar	
----
			
Wow, i can read the forums again for the first time in a month.
 
https://twitter.com/codemasher/status/674618172797034496
 
{| class="blockquote"
about bloody time.
Just leaves us now with the authenticator mess.
----
			
{| class="blockquote"
Hey Everyone -
 
Thanks for the feedback. We are continuously working on ways to make encryption better, and safer, for everyone. I'll take your thoughts to the appropriate teams and see what we can do.
 
Thanks!
----