In regardes to Account Security on FFXI

[Taylorman]

I do soooo love reading the threads of people getting their accounts hacked on FFXI, and the hijinks that ensue, but ive just seen a pretty simple way to stop it from happening. I loged on to check my bank statement today from work instead of at home, and i recieved an interesting messege.

"You have succesfully loged to ***********.com, however we do not recognize the computer you are using to access your account.
Please compleate the following steps to ensure your saftey of your account"

It then lists my cell phone and my work number and my home number, of which it will call or text a special one time code to for me to be able to compleate the login procedure.

I was really supprised at the new added level of security beyond the typical log in name and password, and thought it was pretty smart and simple to do. It looks like it just dumps a cookie into computers that you typically log in from, thus keeping keyloggers from being effective as they dont have access to your phone. Also it avoids email'd passwords because most people use the same login and password for all their surfing anyway.

It seems simple enough to implement on SE's side of things. Just wanted to share.

[Remyo]

would cost too much

[Silenus]

ps2 limitations

[Khamsin]

Banks can only afford it because they have so much money.

[souleman]

Actually, it tracks the IP address block that you normally log in from. Nothing to do with cookies. (cookies are about as secure as closing your front door and not locking it).

It wouldn't be too hard or expensive to maintain (especially with VoIP), but there are things that would be a lot easier to implement and not as much of a hassle to the end user.

[Ashokan]

Banks have to afford it because they have so much money -and- banks know they will always be a huge target -and- accounts being hacked hurts their bottom line more than Square Enix.

Fixed, but banks still get hacked.

[Spungy]

Banks lose money if you lose money. SE gets more money if you lose your account because your addicted ass will buy another content ID.

[Sykes]

The only reason your bank does it is because they are all but required to do it based on the Authentication in an Internet Banking Environment guidelines (although whether or not the Wish-It-Was Two-Factor authentication that most banks use comes even close to complying is another issue). Without those guidelines, it would probably take banks years to realize that the ROI of implementing those procedures was worth it.

The entire point is moot though. Square-Enix can't even figure out a way to allow non-alphanumeric passwords, much less two-factor authentication.

[Taj]

Don't use the same password you use for your E-Mail, forum accounts, or your favorite internet dating website where you met that one chick that tried to mace you. Don't send your PlayOnline ID to anyone over any kind of electronic medium that gets logged. Ever. (This includes Google Talk.) Problem solved. Why should Square-Enix take the time to implement such a level of security for people that can't even take care of their accounts in the first place? This is like forgetting to feed your cat and letting it die, then asking your parents for a new cat because there was obviously something wrong with your last one.

[Alleya]

Also, make sure your password is actually a password. 'realms' is an example of what NOT to use.

http://www.microsoft.com/smallbusiness/ ... urity.mspx

•

Don't use only letters or only numbers.
•

Don't use names of spouses, children, girlfriends/boyfriends or pets.
•

Don't use phone numbers, Social Security numbers or birthdates.
•

Don't use the same word as your log-in, or any variation of it.
•

Don't use any word that can be found in the dictionary — even foreign words.
•

Don't use passwords with double letters or numbers.

Some of the worst passwords are: password, drowssap, admin, 123456, and the name of your company or department. Finally, never leave it blank. That's a surefire way to let the bad guys into your system.

[docvicious]

SE cant afford it because of the rmt problem or the fact that they charge 13 dollars for 1 character with the average of 2 mules making it 15 dollars (rounded up) i think its more they just don't want to increase the security amirite

14.95* 1,000,000 customers = 14,950,000 per month I forget how many the last benchmark was placed at in number of paying content ID's for the entire system but so thast just an example but seriously THey could afford if they wanted to

Subtract Legal Fees
Outsourcing fees for GM's and customer support.
Special Projects
Development
"Anti cheat team" lol
and whatever the loss is on recreating old game CD's
and im sure they still have alot of money

edit
Forgot to add on maitenance
upkeep of servers and all the little small things that run a building
rent, water, light , etc etc. if you want to get technical.


Edit 2 for taj.
Thats not really the case, most people that would have more than 8 (character minimum) would almost more than likely use the same pass word. Not all but a vast majority. From your point of view it would just make it easy to hack them.

[Taj]

SE cant afford it because of the rmt problem or the fact that they charge 13 dollars for 1 character with the average of 2 mules making it 15 dollars (rounded up) i think its more they just don't want to increase the security amirite

Stop posting, you're dumb. Do you have any idea how many people bitched about the new eight character minimum? It's not about the cost, it's about how many people would throw a shitfit because they don't know half the information on their accounts and can't get in.

[Ashira]

Edit 2 for taj
Thats not really the case, most people that would have more than 8 (character minimum) would almost more than likely use the same pass word. Not all but a vast majority. From your point of view it would just make it easy to hack them.

Taj's point was that he got a lot of people bitching at him because no one remembered their passwords to change them to the new requirement, and ran into a lot of problems getting things reset properly because they didn't have reg codes, etc. I think. I dunno, I remembered him saying something briefly in IRC the other day, but I wasn't really paying attention cuz I was disconnecting every five minutes.

[docvicious]

Don't use the same password you use for your E-Mail, forum accounts, or your favorite internet dating website where you met that one chick that tried to mace you. Don't send your PlayOnline ID to anyone over any kind of electronic medium that gets logged. Ever. (This includes Google Talk.) Problem solved. Why should Square-Enix take the time to implement such a level of security for people that can't even take care of their accounts in the first place? This is like forgetting to feed your cat and letting it die, then asking your parents for a new cat because there was obviously something wrong with your last one.

Because most of them are stupid enough to do the exact opposite, thats why banks use the security in the first place to protect their stupid customers for the most part, but its also to protect their investors. I dont think SE would ever want to do the same exact thing because it probably would cost to much. But they are recognizing a problem by increasing the max character for passwords. If it works then it works, but people will still use stupid passwords.

[MarkM.]

I've suggested this before in a previous thread, but a simple way to avoid people from getting their accounts jacked is to require them to put at least the last 4 digits on their credit card number in to alter any information under billing, password, etc... FFxi is the only online service that you pay for that I've ever come across that does not require this.

[souleman]

I know I'd be pissed the first time I tried to log in from someplace other then home and got a phone call asking a series of questions that I dont remember the answer too.



And btw, once the system is in place, it could be maintained for about $300 a month, so really not that expensive. It would just be a really poor system to use for a video game.

[LD]

What kind of asshole forgets their password or doesn't make it at least somewhat easy to remember?

[ringthree]

SE should just make you add your mother's maiden name or like your favorite pets name as a security question. And if you have the information you can get your PW reset with POL, like how they used to do it with CC's, and you can't change the information without it. Easy, simple, discreet. It could also have the nice added benefit of making it harder for people to buy acconts.

[Everlasting]

Actually, it tracks the IP address block that you normally log in from. Nothing to do with cookies. (cookies are about as secure as closing your front door and not locking it).

It wouldn't be too hard or expensive to maintain (especially with VoIP), but there are things that would be a lot easier to implement and not as much of a hassle to the end user.

Nope. I'm pretty sure I use the same bank as the OP and I get that message EVERY. FUCKING. TIME.

[Remyo]

Also, make sure your password is actually a password. 'realms' is an example of what NOT to use.

http://www.microsoft.com/smallbusiness/ ... urity.mspx

•

Don't use only letters or only numbers.
•

Don't use names of spouses, children, girlfriends/boyfriends or pets.
•

Don't use phone numbers, Social Security numbers or birthdates.
•

Don't use the same word as your log-in, or any variation of it.
•

Don't use any word that can be found in the dictionary — even foreign words.
•

Don't use passwords with double letters or numbers.

Some of the worst passwords are: password, drowssap, admin, 123456, and the name of your company or department. Finally, never leave it blank. That's a surefire way to let the bad guys into your system.

damn thats the same combination as my briefcase. ><