100425-security-problems

== Content ==
			
The name, address, phone, etc fields are all censored with * when you view a profile, however, if you click edit on any of them you'll get the full information on everything but the lastname.
You don't need two-step authentication to log into the website. This requires people to have two-step authentication on the e-mail tied to their wildstar account to be safe.
You can edit every piece of personal information without entering your password.
Support removes the two-step authentication without asking for any form of ID.
Might wanna fix that.	
----
			
This trumps all that:
You can only login to the website and forums from IP addresses you've authorized.
IP authorization requires you to click a link sent to the email listed on your account.
Unless your email and password are both compromised by the same individual, it is highly unlikely that anyone but you will gain access. I'm comfortable with this system, and I take security very seriously.	
----
			I'm more bothered with login email being just there in the open in the %appdata% folder...	
----
			
{| class="blockquote"
Support removes the two-step authentication without asking for any form of ID. 
----
			
{| class="blockquote"
Most of these don't bother me, but this one is always funny to me, so many support sites are like that, you don't need to hack anything when you can just convince the vendor to give you access.
----
			
{| class="blockquote"
Not to dabble in stereotyping too much, but my guess is the majority of actual hackers can't... communicate adequately in languages that support speaks... 
I guess that lowers the danger ever so slightly... <_<
----
			
{| class="blockquote"
Not to dabble in stereotyping too much, but my guess is the majority of actual hackers can't... communicate adequately in languages that support speaks... 
I guess that lowers the danger ever so slightly... <_<
----
			
{| class="blockquote"
This trumps all that:
You can only login to the website and forums from IP addresses you've authorized.
IP authorization requires you to click a link sent to the email listed on your account.
Unless your email and password are both compromised by the same individual, it is highly unlikely that anyone but you will gain access. I'm comfortable with this system, and I take security very seriously.
----
			
{| class="blockquote"
Two counterarguments:
 
1) Most of the people getting hacked happen to have poor security practices (such as password re-use).
 
2) Many ISPs give people random IP addresses, so the address you had yesterday may be handed to your neighbor today.
 
It's actually okay for people who take security seriously, but a little dangerous for the masses that do not.
----
			
{| class="blockquote"
This trumps all that:
You can only login to the website and forums from IP addresses you've authorized.
IP authorization requires you to click a link sent to the email listed on your account.
Unless your email and password are both compromised by the same individual, it is highly unlikely that anyone but you will gain access. I'm comfortable with this system, and I take security very seriously.
----
			
{| class="blockquote"
This trumps all that:
You can only login to the website and forums from IP addresses you've authorized.
IP authorization requires you to click a link sent to the email listed on your account.
 
----
			
{| class="blockquote"
100% this. It's obvious when you have "Jonathan Smith" from Pittsburgh, PA send in a support ticket that looks like: "hi , can pls remove 2FA. lost the mobile phone, can't login to play" 
I'm sure support then takes some extra precautions....
----