Special Task Force Report (10/24/2007)

[Fhqwghads]

Dear SE:

Limiting passwords to alphanumeric characters (0-9 A-Z) is retardedly stupid. You say you're concerned about security, so pony up and let your customers create passwords that are in orders of magnitude more secure than what can be set at this time. Introducing special characters (`~!@#$%^&*()_+-={}[]|\:;"'<,>.?/) would raise the complexity level so high it would take forever to brute-force. Please stop tooting your Horn of Concern when you don't allow basic security in passwords. There's no reason to omit special characters.

Let's be realistic here... once your password is beyond the point of a dictionary attack, common things like "summer1", and the login system has an appropriate rate-limiter to prevent brute-forcing from getting anywhere, adding crazy-ass characters is an insignificant increase in security, not an order of magnitude.

Do you work for SE?

[spooky]

Dear SE:

Limiting passwords to alphanumeric characters (0-9 A-Z) is retardedly stupid. You say you're concerned about security, so pony up and let your customers create passwords that are in orders of magnitude more secure than what can be set at this time. Introducing special characters (`~!@#$%^&*()_+-={}[]|\:;"'<,>.?/) would raise the complexity level so high it would take forever to brute-force. Please stop tooting your Horn of Concern when you don't allow basic security in passwords. There's no reason to omit special characters.

Let's be realistic here... once your password is beyond the point of a dictionary attack, common things like "summer1", and the login system has an appropriate rate-limiter to prevent brute-forcing from getting anywhere, adding crazy-ass characters is an insignificant increase in security, not an order of magnitude.

lrn2math

[Liselle]

Do you work for SE?

I could ask you the same thing, since you seem to think obscurity = security.

[spooky]

Do you work for SE?

I could ask you the same thing, since you seem to think obscurity = security.

Why don't you try this; write some software to guess a 4 letter password (no not a POL password, just one you made up)
First time the password is only a-z, next time it can use any printable charicter and is case sensative.
You might notice a slight difference in the speed of the two.
Have a lot of fun!

[Fhqwghads]

Do you work for SE?

I could ask you the same thing, since you seem to think obscurity = security.

Cue Capt. Picard pic.

[evilpaul]

not an issue on Cerberus http://www.ffxiah.com/item.php?id=4384&stack=1&sid=23

And 58 stacks is actually quite low from our normal.

Now compare that to Dil, which are used in same recipes but are much more difficult if not impossible for the rmt to mass bot--

http://www.ffxiah.com/item.php?id=5457&stack=1&sid=23

Come to Hades, our RMT are all over Tallacco Cove.

And whoever was talking about Sole Sushi: You can make it profitably (barring several breaks) entirely from AH ingredients on Hades. It's just not worth the time as getting 500 gil per stack of sushi isn't as good a use of your time as killing lolGigas with /THF. (P.S. fuck Keaimm.)

[Liselle]

Why don't you try this; write some software to guess a 4 letter password (no not a POL password, just one you made up)
First time the password is only a-z, next time it can use any printable charicter and is case sensative.
You might notice a slight difference in the speed of the two.
Have a lot of fun!

Been there, done that. My turn: look up what the phrase "rate limit" means, and then ponder what this means for brute-force attacks.

@Fhqwghads: Sorry, I don't get the reference.

@both of you: the biggest security risk to POL logins is social engineering, which no amount of password complexity will change (in fact, overly complex passwords make it worse, because then people write their password down in unsafe places). Complex passwords to prevent brute-force attacks on POL logins is what we call a solution looking for a problem.

in before Friends+. Not because it's relevant, but because someone probably thinks it is.

[evilpaul]

[@Fhqwghads: Sorry, I don't get the reference.

http://img144.imageshack.us/img144/5...cardog0.th.jpg

[spooky]

@Liselle
I give up.

[Liselle]

Thanks for the clarification. Maybe I should have done a pre-emptive /facepalm myself, since that's the expected level of rebuttal around here.

@spooky: maybe you just don't understand my point. Complex passwords will definitely make brute-forcing harder, but when brute-forcing can't happen in the first place, you're not going to get a 10x increase in security by making passwords look like Perl.

Or maybe you do understand my point, and you just don't feel like admitting it.

[Fhqwghads]

Thanks for the clarification. Maybe I should have done a pre-emptive /facepalm myself, since that's the expected level of rebuttal around here.

@spooky: maybe you just don't understand my point. Complex passwords will definitely make brute-forcing harder, but when brute-forcing can't happen in the first place, you're not going to get a 10x increase in security by making passwords look like Perl.

Or maybe you do understand my point, and you just don't feel like admitting it.

The real point is there's no reason to NOT increase the security of a password. The cost in terms of development is negligible, and I'd argue there's probably extra code to *prevent* special characters from being accepted.

As far as writing down a password due to complexity, if someone is in your house I think it's safe to say you probably trust the person in the first place. If not, why the hell are they in your house.

[Liselle]

The real point is there's no reason to NOT increase the security of a password. The cost in terms of development is negligible, and I'd argue there's probably extra code to *prevent* special characters from being accepted.

That is a valid reason and I agree with you. But, if you look back at my OP, my problem was that special characters aren't going to increase security by an "order of magnitude". Even mixed-case alphanumeric passwords that are exactly 8 characters long will take 6.9 million years to traverse all possibilities if you limit attempts to one per second (which is an insanely low rate limit). It's simply not possible to brute-force very many things these days unless there's another hole you can squeeze through. So adding curly braces to your password is a placebo in my opinion, unless your password is "realms" or something, in which case you need your head examined in the first place.

As far as writing down a password due to complexity, if someone is in your house I think it's safe to say you probably trust the person in the first place. If not, why the hell are they in your house.

I was speaking more in general for this one, aka stupid IT departments that have ridiculous password requirements and everyone in the office has to write them on a Post-It for the bottom of the keyboard or monitor, just so that they can log in.

Although for FFXI I could say that maybe people would have account details in a forum's PM system. Ahem.

[Max™]

Dear SE: http://www.ffxiah.com/player.php?id=1000191&sid=6

If you look around FFXIAH for a second, on basically any server, you can pick out these guys, they aren't terribly destructive, but they are definitely annoying when you go to pay 100k for an Assault earring and find out they've bumped it artificially to 250k by flooding the old price history with sales to others in their group.

[narusegwa]

I dont like how they describe hunter and stuff:3 its kinda stupid how they described it.. I mean we all know RMT sucks ass but theres legit people fishing and mining and farming NM to make money, or farming Devil manta to get Angel Skin.. its not always RMT...

*1. Hunters
Characters who kill Notorious Monsters, clear quests, and obtain items over and over again with the sole purpose of gathering gil, which is then handed off to RMT groups.

*2. RMT
"Real Money Trading." Selling game data for real money.

*3. Use of synthesis and auction houses for RMT
Actions involving selling large quantities of in-game items for gil, which is then traded for real money.

Okay. for a normal people its hard now days to making decent amount gil.. If some player go out say farm an NM like Bonnacon get Cure clog over and over again. its one of his main way to make money , or someone synth darksteel sheet over and over again for money.. does it count them as RMT? they dont have the intention to give to RMT.. but Gathering gil for themselve.. but to SE this could count as RMT .. which in a way it totally messed up on SE's part .. thats how i think of things.. so now i can basically check AH see who sell the most crystal or anything that remotely make gils... you could report them..

[Fhqwghads]

The real point is there's no reason to NOT increase the security of a password. The cost in terms of development is negligible, and I'd argue there's probably extra code to *prevent* special characters from being accepted.

That is a valid reason and I agree with you. But, if you look back at my OP, my problem was that special characters aren't going to increase security by an "order of magnitude". Even mixed-case alphanumeric passwords that are exactly 8 characters long will take 6.9 million years to traverse all possibilities if you limit attempts to one per second (which is an insanely low rate limit). It's simply not possible to brute-force very many things these days unless there's another hole you can squeeze through. So adding curly braces to your password is a placebo in my opinion, unless your password is "realms" or something, in which case you need your head examined in the first place.

As far as writing down a password due to complexity, if someone is in your house I think it's safe to say you probably trust the person in the first place. If not, why the hell are they in your house.

I was speaking more in general for this one, aka stupid IT departments that have ridiculous password requirements and everyone in the office has to write them on a Post-It for the bottom of the keyboard or monitor, just so that they can log in.

Although for FFXI I could say that maybe people would have account details in a forum's PM system. Ahem.

I suppose I was a little overdramatic with "orders of magnitude." If there was no lock-out from failed attempts that would definitely be a correct assertion on my part. I think I pretty much covered my dislike of limiting passwords to alpha-numeric only, though. There's just no reason to do it, even if there are lock-outs.

[evilpaul]

Okay. for a normal people its hard now days to making decent amount gil.. If some player go out say farm an NM like Bonnacon get Cure clog over and over again. its one of his main way to make money , or someone synth darksteel sheet over and over again for money.. does it count them as RMT? they dont have the intention to give to RMT.. but Gathering gil for themselve.. but to SE this could count as RMT .. which in a way it totally messed up on SE's part .. thats how i think of things.. so now i can basically check AH see who sell the most crystal or anything that remotely make gils... you could report them..

It's probably referring to the 24/7 mass producers of sushi, ninja tools, etc that are sold for a tiny profit that adds up when you're selling 2,000 stacks a week. Particularly if it's a bot doing all the synths for you.

[niisse]

I dont like how they describe hunter and stuff:3 its kinda stupid how they described it.. I mean we all know RMT sucks ass but theres legit people fishing and mining and farming NM to make money, or farming Devil manta to get Angel Skin.. its not always RMT...

but Gathering gil for themselve.. but to SE this could count as RMT .. which in a way it totally messed up on SE's part .. thats how i think of things.. so now i can basically check AH see who sell the most crystal or anything that remotely make gils... you could report them..

The difference is that players dont then send all this gil to some central mules then exchange it to random people infront of the jeuno AH or whatever, they keep it for themselves and spend it on gear. Thats why they spend ages seeing where all the farmed gill goes. If littlebobby farms for ages then uses the gil to buy a HQ stave or something then goes about his regular business its different to qwtewytexiangshing farms for ages then trades it all to the same character who they are monitoring and is a known RMT and then goes back to farming 24/7.

[OctavoGilgamesh]

Dear SE:

Limiting passwords to alphanumeric characters (0-9 A-Z) is retardedly stupid. You say you're concerned about security, so pony up and let your customers create passwords that are in orders of magnitude more secure than what can be set at this time. Introducing special characters (`~!@#$%^&*()_+-={}[]|\:;"'<,>.?/) would raise the complexity level so high it would take forever to brute-force. Please stop tooting your Horn of Concern when you don't allow basic security in passwords. There's no reason to omit special characters.

Let's be realistic here... once your password is beyond the point of a dictionary attack, common things like "summer1", and the login system has an appropriate rate-limiter to prevent brute-forcing from getting anywhere, adding crazy-ass characters is an insignificant increase in security, not an order of magnitude.

I had an issue a while back where I didn't realize SE didn't support alternate characters in your pol password. The client allowed me to enter a period in my pw

Took almost 2 days of trying to get through to support (not all SE's fault, just worked out that way because of work and shit) to get my password reset.

[zagex]

I had an issue a while back where I didn't realize SE didn't support alternate characters in your pol password. The client allowed me to enter a period in my pw

Took almost 2 days of trying to get through to support (not all SE's fault, just worked out that way because of work and shit) to get my password reset.

Me too! Well, not the same character, and it took me less time, but my password wasn't alphanumeric, and POL didn't spit out an error telling me it was an invalid PW. Though it took me less time and more password resets because the rep I got didn't know it had to be alphanumeric. He just told me to stick to the standard keyboard. It's just so annoying/stupid/retarded how POL lets you change your password to have non-alphanumeric characters in your PW, but then won't let you log on afterwards because your password is actually invalid.

[loial]

they'll have to do something about the resulting fish shortage

The market will right itself. A lot of players don't bother fishing since the profits are small. That would change if the profits were more reasonable. We don't need an RMT army to 24/7 mass fish bot the sole the playerbase needs. Same goes for cheap tools and other crafted items where profitability was destroyed by RMT. Legit players simply don't want to spend the time to fish/craft consumable items like food, ninja tools, medicines, etc because the profits are too meager.

However, I think all their efforts are going to waste. Every single Special Task Force news release, they always say "Yeah, we banned 1000ish fish/craft bots." They've been saying this for nearly two years now? The situation isn't much better.