Regarding Rise of Unauthorized Access and Password Security

[Shenrien]

There has been an increase in the number of unauthorized access since November 15, 2011. The cause for this is still under investigation; however, it is possible that some of the victims may have been using the same account name and password from other online services with their Square Enix account.

Please note that if you use the same account name or password as your PlayOnline ID or Square Enix account on other online services, a security breach at any of the other online services you use could potentially lead to your PlayOnline ID or Square Enix account being compromised as well.

Likewise, if you use repeated strings of characters, phone numbers, birth dates, or other such information, this will leave your account highly vulnerable in the event another customer's account name and password is compromised from other online services, even if you are not using the same exact account name or password.

Therefore, if you are sharing the same account name or password between other online services and your Square Enix account, or if you are using information that can be easily deciphered, we ask that you change your password as soon as possible.

-Please visit the following link to reset your Square Enix password.
https://secure.square-enix.com/accou.../svc/reminder?

Also, please note that accounts that are suspected of having been compromised will have their access temporarily restricted. Once login has been restricted, an email notification will be sent to the primary email address registered to the Square Enix account. This email will contain instructions on how to remove the login restriction. Players will be asked to reset their passwords and log in again.

Please visit the following link for more information about login restrictions.
http://support.na.square-enix.com/j/lbna

If cases of unauthorized access continue to rise, we may be forced to take measures to reset Square Enix account passwords for all customers, so we kindly ask for your cooperation in helping us better safeguard your personal information and account information.

http://www.playonline.com/ff11us/pol...ews21167.shtml

Anyone else have had anyone they know get hacked? or if you've been hacked? My LS has a mule that we hold our relic currency on, and it's also on an account to a mule that we use to sit out and Tiamat and shit on occasion, and it got jacked about a week ago, and SE is horribly slow about restoring it, lost about 4mil gil, and about 30-40mil in currency on it.

[Priran]

how is this still a problem, even with security tokens

[Kaisha]

how is this still a problem, even with security tokens

People are lazy and disable the security token after they get their mog satchel.

[Draginhikari]

You know I debated continuing to use the security token as much as I have. Now I'm pretty sure I made the right choice in that matter.

[Yukari]

People are lazy and disable the security token after they get their mog satchel.

In this case though, it was a LS bank. How would they go about keeping a security token on that sort of account?

[Draginhikari]

That kind of the risk of any account that can be accessed by more then one person or that more then one person has the information in a way that prevents a security token from being used.

[ikariiiii]

did OP never learn that LS bank mules are -going- to be jacked by someone at some point? i figured that was common sense

[Shenrien]

Bank character, no. More of a bazaar / slap shit on here cause we don't want it on my character the owners main character, the only reason they were holding any gil at all was due to other currency / items selling that we never bothered to pick up, my LS has no bank because figured shit would just cause an issue when someone cries about it not being spent, and when it does get spent it's for X-person instead of them.

The owner does have a security token on the square-enix account that is linked to both their main and the mule we use, sadly enough they hit the mule which probably doesn't even have a faction of what's considered valuable, currency is easily replaceable with lolgil. Would be shitty as fuck if the character with a 100 craft, several emps, base relic, all content cleared, ect were to have been deleted like they did to every character on the mule account before we managed to recover it and have it taken up by SE.

[Kaisha]

Regardless, I wouldn't put it past SE to secure their environment given I managed to somehow log onto my mule's POL account on a fucked-up version of POL (an instance of me not fully copying over the updated files over) that predates the SE Account system, and it still let me in even though I didn't give the SE Account info nor the security token code.

[EDIT] I should clarify that I didn't get to log into FFXI though, this was within a WINE environment that I was working the kinks out, and the shit liked to crash during the window between POL closing and FFXI initiating.

[Yukari]

Bank character, no. More of a bazaar / slap shit on here cause we don't want it on my character the owners main character, the only reason they were holding any gil at all was due to other currency / items selling that we never bothered to pick up, my LS has no bank because figured shit would just cause an issue when someone cries about it not being spent, and when it does get spent it's for X-person instead of them.

The owner does have a security token on the square-enix account that is linked to both their main and the mule we use, sadly enough they hit the mule which probably doesn't even have a faction of what's considered valuable, currency is easily replaceable with lolgil. Would be shitty as fuck if the character with a 100 craft, several emps, base relic, all content cleared, ect were to have been deleted like they did to every character on the mule account before we managed to recover it and have it taken up by SE.

They managed to log in even with a security token on the mule?

[Shenrien]

Yeah, I woke the owner cause the night it happened I noticed the bazaar character was offline and they were on one of the other mules that they hold gear on or pop sets on for NMs.

[Stromgarde]

Last I heard the only way around a security token was with keyloggers or man-in-the-middle attacks. Losing the mule might be the least of your friend's worries depending on the severity of the infection.

[cdgreg]

Yeah, I woke the owner cause the night it happened I noticed the bazaar character was offline and they were on one of the other mules that they hold gear on or pop sets on for NMs.

Can you disable your token through your square-enix online account? If not, I'm skeptical.

[Kaisha]

You can unlink your token, but it's a one-time affair. You'd have to purchase another token to resecure the account.


Anyways, I'm a go experiment with POL and see if I can try and replicate what I did in my earlier post.

[arus2001]

Friend of mine got hacked a couple months back, stripping him of 60 mil and some gear. Sadly, he didn't have his restore since he got hacked like 4 years ago, too. Did the usual battery of "Did you..." questions from visiting stupid sites to running scans, but no admission on the former and apparently nothing on the latter. Sometimes I still think there's a rogue SE employee that just jacks some account's info to RMT off for spare cash. :/

[Priran]

Can you disable your token through your square-enix online account? If not, I'm skeptical.

yes but i assume you need the token to do it

[Septimus]

yes but i assume you need the token to do it

I believe that the official information stated you have to enter the code on the back of your token to disable it, but I have not disabled mine to be able to say for sure.

[Forte]

I got hacked once. I bought a token after that. I haven't been hacked since.

The point is, use the fucking token. You are asking for bullshit otherwise.

[Rocl]

I believe that the official information stated you have to enter the code on the back of your token to disable it, but I have not disabled mine to be able to say for sure.

Yeah, when I unlinked mine I did it by e-mail instead of over the phone and just rattled off the number and they did it. Never been bothered to set a second one up, but it's not a huge concern for me.

I miss licking the token for a number though ;;

[Vinedrai]

i got hacked recently too. their reasoning of using same password for different online services is bullshit. i don't use a password same as my pol one anywhere else. either linkshell community or account management system page is subject to some sort of leakage or some fucker in SE is taking advantage of his access to account informations... yes, i am that skeptical. i have been scanning this machine very frequently with multiple highly regarded scanners so i highly doubt that it was simply a keylogger.

i lost about 60m gil and couldn't recover anything thanks to their "photo ID or gtfo" policy since i am not the original owner. sometimes i really wish i was a con artist to fake an ID... it seems being honest doesn't always pay off. i manage to prove my ownership everytime on chat support but when it comes to recovering data, i can't do shit just because i don't have an ID with the name of original owner on it.