Recent Hackings and Steps to Ensure Account Safety.

[Khamsin]

I guess the point is, no matter what reasons the terrorists/hackers/soup nazis have for bombing/hacking/not serving soup, it's always they're fault, not the victims.

:ashira: says: "their"

And what's worse, it was your bolded word in that statement.

Ohshi-

Figures the once in a watersday moon I make typos like that, it happens to be their/they're/there and bolded.

[Ashira]

I'm not clicking.

Which items? lol.

Roast Mushroom, Cerberus Meat, and Blinding Potions.

Just clicking to look at in the above post won't do anything , it's just text in comments saying "new fish bot" or.. "new jobs macro" or something.. with a text link you'd have to cut and paste.

[Ryko]

And I'm not faulting SE, I meant more that the argument of "well you shouldn't be using wikis/information websites" etc in the first place is just plain stupid. EVERYTHING ends up with compilation/fan sites... if someone started accessing bank account information of all the people that visited a particular network of "Chuck" websites, I'm sure NBC would at least issue warnings. In this case though, NBC isn't liable for anything lost from the bank accounts, of course.

It's not stupid in the slightest. Tsuko has the most valid point that it could be alleviated if SE had official information websites that they controlled (which most of you/us wouldn't be satisfied with anyway), but in the end the bottom line is to not shit where you eat. Don't put something at risk for convenience (that they told you not to put at risk in the first place) if you don't want to lose the stuff that matters to you. And uh... instead of us warning people to stay away from third party websites until the issue is fixed, SE should... do the same thing?

[Ashira]

And I'm not faulting SE, I meant more that the argument of "well you shouldn't be using wikis/information websites" etc in the first place is just plain stupid. EVERYTHING ends up with compilation/fan sites... if someone started accessing bank account information of all the people that visited a particular network of "Chuck" websites, I'm sure NBC would at least issue warnings. In this case though, NBC isn't liable for anything lost from the bank accounts, of course.

It's not stupid in the slightest. Tsuko has the most valid point that it could be alleviated if SE had official information websites that they controlled (which most of you/us wouldn't be satisfied with anyway), but in the end the bottom line is to not shit where you eat. Don't put something at risk for convenience (that they told you not to put at risk in the first place) if you don't want to lose the stuff that matters to you. And uh... instead of us warning people to stay away from third party websites until the issue is fixed, SE should... do the same thing?

I'm having a problem with you calling things like somepage 'third party' though, is my issue, which you helped me recognize with this ranting post of yours. You're making it sound like it is wrong to visit a site that documents information, like somepage. It is then just as bad to visit forums, so GTFO?

[Ryko]

And I'm not faulting SE, I meant more that the argument of "well you shouldn't be using wikis/information websites" etc in the first place is just plain stupid. EVERYTHING ends up with compilation/fan sites... if someone started accessing bank account information of all the people that visited a particular network of "Chuck" websites, I'm sure NBC would at least issue warnings. In this case though, NBC isn't liable for anything lost from the bank accounts, of course.

It's not stupid in the slightest. Tsuko has the most valid point that it could be alleviated if SE had official information websites that they controlled (which most of you/us wouldn't be satisfied with anyway), but in the end the bottom line is to not shit where you eat. Don't put something at risk for convenience (that they told you not to put at risk in the first place) if you don't want to lose the stuff that matters to you. And uh... instead of us warning people to stay away from third party websites until the issue is fixed, SE should... do the same thing?

I'm having a problem with you calling things like somepage 'third party' though, is my issue, which you helped me recognize with this ranting post of yours. You're making it sound like it is wrong to visit a site that documents information, like somepage. It is then just as bad to visit forums, so GTFO?

It is a third party website. The difference is I won't sit here and claim it's SE's fault if sono fucked up and managed to let something like that happen here, which I think it's safe to say that he spends a lot of his time making sure doesn't happen. Furthermore you don't know from what PC I browse BG on in the first place.

The operative here isnt that people are picking shit up from information websites, it's that they have the gall to claim it's SE's responsibility to police shit (or "show concern" over which is basically "police shit" with a spin added to it) they have no control over.

So I'm gonna go with "no" and "grow up".

[Ashira]

And I'm not faulting SE, I meant more that the argument of "well you shouldn't be using wikis/information websites" etc in the first place is just plain stupid. EVERYTHING ends up with compilation/fan sites... if someone started accessing bank account information of all the people that visited a particular network of "Chuck" websites, I'm sure NBC would at least issue warnings. In this case though, NBC isn't liable for anything lost from the bank accounts, of course.

It's not stupid in the slightest. Tsuko has the most valid point that it could be alleviated if SE had official information websites that they controlled (which most of you/us wouldn't be satisfied with anyway), but in the end the bottom line is to not shit where you eat. Don't put something at risk for convenience (that they told you not to put at risk in the first place) if you don't want to lose the stuff that matters to you. And uh... instead of us warning people to stay away from third party websites until the issue is fixed, SE should... do the same thing?

I'm having a problem with you calling things like somepage 'third party' though, is my issue, which you helped me recognize with this ranting post of yours. You're making it sound like it is wrong to visit a site that documents information, like somepage. It is then just as bad to visit forums, so GTFO?

The difference is I won't sit here and claim it's SE's fault if sono fucked up and managed to let something like that happen here, which I think it's safe to say that he spends a lot of his time making sure doesn't happen. So I'm gonna go with no and grow up.

Where did I say it's SE's fault? I said it's in their own interest to attempt to protect and help their customers, not that it's their fault. There is a huge difference. So stop telling me to grow up, and learn to read.

[Ryko]

The difference is I won't sit here and claim it's SE's fault if sono fucked up and managed to let something like that happen here, which I think it's safe to say that he spends a lot of his time making sure doesn't happen. So I'm gonna go with no and grow up.

Where did I say it's SE's fault? I said it's in their own interest to attempt to protect and help their customers, not that it's their fault. There is a huge difference. So stop telling me to grow up, and learn to read.

It's not "in their interest" to do a damn thing, you are implying that it is somehow beneficial to them to cover for other websites' fuckups. They wash their hands of it the second they don't endorse it. Beyond that it's not in their best interest to do a thing. An account stolen is still an account paid for, SE still makes their money, and the only implied or direct fault on anyone's hands is on not-so-little jimmy for dodging minivans as a hobby. You know whose best interest to protect and help their visitors? The webmasters of those websites. (Hence my saying that while I may not be into the whole creepy cat thing, I give sono [and nikkei and whoever is administrating this website] credit for generally keeping this place safe.)

Otherwise? They do "attempt to protect their customers" (I wouldn't say help since they're horrible at dealing with the situation after it's actually happened.) If you go beyond what they offer and advise it's no one's fault but your own. Once again, grow up. I thought taking responsibility for your actions was something taught in most after school specials. It would do everyone a great service if we stop treating SE like some guardian angels they've never ever even faked being convincingly. Treat them like the red-tape spewing E-DMV that they are and suddenly you'll stop wondering why they don't care.

[Ashira]

It's not "in their interest" to do a damn thing, you are implying that it is somehow beneficial to them to cover for other websites' fuckups. They wash their hands of it the second they don't endorse it. Beyond that it's not in their best interest to do a thing. An account stolen is still an account paid for, SE still makes their money, and the only implied or direct fault on anyone's hands is on little jimmy for dodging minivans as a hobby. You know whose best interest to protect and help their visitors? The webmasters of those websites.

Otherwise? They do "attempt to protect and help their customers". If you go beyond what they offer and advise it's no one's fault but your own. Once again, grow up. I thought taking responsibility for your actions was something taught in most after school specials.

Recovering stolen accounts is in their interest - leaving it with the RMT means it'll just get banned later and that's money they will then lose. Reissuing/refunding stolen items is in their interest - someone having to get everything back again may just end up quitting. Credit card and phone companies do this. It is in their interest to protect a customer because the customer will remain with them. If SE made it not impossible to retrieve an account, and helped to an extent with recovering lost items, it would go a long way in customer satisfaction and morale. Keeping customers happy is IN THEIR INTEREST, especially with a slowly decreasing customer base.

It isn't my fault that some guy was taller than me and could see over my shoulder and/or head when I plugged in a phone card number in a pay phone. I've always been very good about standing squarely in front of a pay phone, but next time I tried to call using my card, I was connected to an operator asking about some 4 hr long phone calls to the Bahamas. It isn't my fault that a restaurant I worked for used social security numbers as employee ID numbers, which were available for anyone to see in our paycheck log we all had to sign each week to verify we'd received our check, and some fellow coworker nabbed my SS# and got herself a new landline with Verizon when hers was turned off again. But I didn't have to pay that bill. Was the restaurant responsible? No, but at least within our restaurant they changed policy and blacked out employee numbers after I reported the incident.

Shit happens, and a company that realizes this instead of saying everything is out of their control and does what they can to help people who are taken advantage of by using an outside source of information will do a lot better than those who say they aren't responsible and DAMN YOU IDIOT PEOPLE WHO PAY US FOR BEING STUPID ENOUGH TO HAVE TO LOOK SOMETHING UP ONLINE.

Now, if in the case of the text links mentioned above, it's people going to links for fishbots and shit, then fuck, that is yes, retarded on the part of the consumer. But if it's something that somehow found their way in through google ads or something, passively, into computers of people using a particular browser just for looking up information, then that isn't their fault. Stop telling me to grow up; that's the argument of someone who thinks that just because someone else doesn't believe exactly the way they do, they are wrong. I understand where you're coming from, but I think it's stupid you're faulting people who may be getting these passively from information websites. You'd rather they use Brady Guide?

[Ruby]

hmmm. so what IS the best way to protect your account?

[Builttolast]

hmmm. so what IS the best way to protect your account?

Not get infected in the first place. I gave my opinion on this on page 5 in the list of hacked people thread.

viewtopic.php?f=2&t=27042&st=0&sk=t&sd=a&start=120

Also keeping your password in a plain text file is just bang your head into a brick wall stupid for many reasons most of which have been covered but you know that many infections can read your clipboard right?

[aurik]

hmmm. so what IS the best way to protect your account?

1) save your account password. Tell nobody, and definitely don't write it in cleartext on your computer.
- if you're concerned about forgetting it, write it down on a piece of paper and put it somewhere secure and non-obvious (ie, not on a postit on the monitor)
2) prevent other people from using your computer
3) if you use wireless, use encryption
4) use a firewall that analyses outgoing connections
5) improve your browsing security by doing some or all of the following:
- browse on a seperate computer or in a virtual machine
- don't use IE, especially if you don't patch religiously
- disable scripting
- avoid "shady" sites
6) do not download any binaries from the internet, with the exception of official patches obtained through the official channel

[Spider-Dan]

But it's targeting their audience, and a company should be interested in protecting its audience.

Which once again doesn't change that SE has no control over those websites and therefore can not be held responsible for shit that goes down on said sites. Sorry, no amount of sentiment changes the facts of the matter. SE can't police stuff they have no access to and, furthermore, don't even endorse (likely because doing so would put them at implied fault, as opposed to people who screwed up passing the buck to the wrong people).

Sorry, but your argument runs into a wall here. How many times have GMs told players to "look on internet forums" for the solution to some problem that they don't feel like answering?

The amount of quest info provided in-game is, in a word, pitiful. The vast majority of quests in this game would be practically unsolvable if you ignored all internet-related resources. Try looking through your "active quests" log and see how many of them you can solve solely through in-game information. It's f*cking pathetic.

If Squenix seriously expects you to Stay Off The Internets on the machine you're playing this game on, then they need to do a damn sight better at providing in-game information.

P.S. I'm pretty sure that "decrypting" the clipboard is easier than decrypting any password file (POL or otherwise), so copypasting into password box = security theater (i.e. for entertainment purposes only).

[Taj]

lol... I thought most FFXI players on PC would at least have some idea how a keylogger works.
If its copy and pasted the keylogger will not pick up the password as you are entering it. >.>

Keyloggers record every stroke you make on your keyboard. The copy/paste method surpasses that.

No.

First, as several people have mentioned, it's not any harder to hook clipboard change notifications than it is to hook keypresses, and you can safely assume that keylogger authors have known about copy/pasting passwords for years. It offers no additional protection, and leaves your passwords sitting around in plaintext, which is security-through-obscurity at best.

Yes.

OP, you're just causing more problems for people. Most modern keyloggers record changes to the clipboard, in fact, I want to say it's probably the default for all of them. That being said, let me explain how people get your information with keyloggers: They set up the keylogger to take a screenshot of your desktop either at a certain interval, or X seconds after you open pol.exe. This is the only way they can get your POL ID. Then, they just have to hope that one of the passwords you type elsewhere is the same as your POL password. So congratulations OP, by advocating that people copy and paste their password instead of storing it, you just made a lot more people vulnerable.

[Airenn]

Hokay, fine, deleted everything about Password. Leaving it for the programs/how to scan and get shit off your comp.

PW's up to you guys, go whatcha feel like was just trying to help, and best of luck.

[Ryko]

But it's targeting their audience, and a company should be interested in protecting its audience.

Which once again doesn't change that SE has no control over those websites and therefore can not be held responsible for shit that goes down on said sites. Sorry, no amount of sentiment changes the facts of the matter. SE can't police stuff they have no access to and, furthermore, don't even endorse (likely because doing so would put them at implied fault, as opposed to people who screwed up passing the buck to the wrong people).

Sorry, but your argument runs into a wall here. How many times have GMs told players to "look on internet forums" for the solution to some problem that they don't feel like answering?

The amount of quest info provided in-game is, in a word, pitiful. The vast majority of quests in this game would be practically unsolvable if you ignored all internet-related resources. Try looking through your "active quests" log and see how many of them you can solve solely through in-game information. It's f*cking pathetic.

If Squenix seriously expects you to Stay Off The Internets on the machine you're playing this game on, then they need to do a damn sight better at providing in-game information.

P.S. I'm pretty sure that "decrypting" the clipboard is easier than decrypting any password file (POL or otherwise), so copypasting into password box = security theater (i.e. for entertainment purposes only).

I already gave credit to tsuko's point that SE's information available is pathetic, I still don't see how it's their responsibility when you go to some site they have no control over. Should they fix the way they handle restoring accounts after the fact? Yeah, though then they start a trend where people fake losing their account and their shit so SE can restore it, inadvertantly duping stuff if they don't keep it basic (restoring the account/character with nothing that it lost)

[Taj]

Yeah, though then they start a trend where people fake losing their account and their shit so SE can restore it, inadvertantly duping stuff if they don't keep it basic (restoring the account/character with nothing that it lost)

It's a policy in a lot of other MMORPGs that when you report an account has been hacked, they lock down that account and investigate. Take for example Ragnarok Online. You report your account has been hacked, they temporarily ban it, ban whoever took your stuff, and give you your stuff back. I don't see why SE should do any differently.

[Ryko]

Yeah, though then they start a trend where people fake losing their account and their shit so SE can restore it, inadvertantly duping stuff if they don't keep it basic (restoring the account/character with nothing that it lost)

It's a policy in a lot of other MMORPGs that when you report an account has been hacked, they lock down that account and investigate. Take for example Ragnarok Online. You report your account has been hacked, they temporarily ban it, ban whoever took your stuff, and give you your stuff back. I don't see why SE should do any differently.

So I guess the first step would be for them to up their customer service schedule to 7 days a week, which seems rather obvious, since most of these account fiascos happen on or near the weekend so by the time someone reports it to SE it's not handled till monday.

[ronin sparthos]

Any sound company looks down on fraud (every industry has their versions of what we call RMT) and these said companies do not shoulder blame to the customer base. Maybe SE should be taking your advice instead of spouting it over to us?

If i lose my cell phone and someone runs up the bills, you damn well know my phone company will shut that phone off asap and do what they need to do to get me up and running asap. (Im a paying customer, and paying customers are free people who will market your product if you keep them happy. Win/Win situation for us both.)

If someone steals my credit card? That company will not interrogate me (like SE does to everyone) and they will attempt to listen to reason. (Hey, look at my billing statement - something just HAPPENED to change and i can show that its fraudulent.)

Ryko, you refuse to listen to reason. You understand fully well that SE is a business and most businesses infact dont give a fuck about the customer, BUT most companies attempt to create the ILLUSION that they want happy customers. They will give perks to the customerbase to keep them happy while they milk them. (My credit card company will help with fraud but dont cross them when payment time comes along, thats understood.)

Telling people to grow-up when infact SE wants the best of both worlds is utter and complete bullshit. You defend SE but want to tell people to grow up? SE isnt being very 'adult' when they refuse to listen to reason. (Hey, i have my fucking ID KEY, the one thing only the real owner of the account would have and thats not good enough?)

You brought some fantastic points in that last post of yours:

It's not "in their interest" to do a damn thing, you are implying that it is somehow beneficial to them to cover for other websites' fuckups.

No i dont expect them to cover for others asses, but even if SEs Linkshell Community site had something to do with it, do YOU actually think they would admit they fucked up? HELL NO.

Doesnt seem very 'adult' to me.

Are you really ready to argue that player morale isnt important in a situation where id imagine MANY people are questioning the years of dedication and work is out of SEs hands? This kinda stuff stirs panic and where is SE to even post something to the tune of:

'Change your passwords, its in your best interest since we have had a rash of compromised accounts'

'STAY OFF THE INTERNET WHEN YOU PLAY FFXI'

Oh right, they are too busy telling people to drop snowmen items that have nothing to do with the serious issues at hand. No one would know about this issue if they didnt read it on what you termed:

A THIRD PARTY WEBISTE

So yes, we should all remain uninformed because SE refuses to listen to reason, refuses to tell the playerbase something (that may or may not be their fault) has happened and want to skirt the issue?

'Dont shit where you eat' - thats a good quote if the situation was different, and you can quote what SE says all you want but the fact of the matter is if the playerbase didnt use resources and talk amongst eachother (all places where you can end up getting fucked up account-wise) that'd well all be bitching about how people have no idea what the fuck to do ingame.

The quotes you use are all from some vacuum-sealed contract that SE itself doesnt follow to the letter. (hey, that right to a safe gaming enviroment - where the fuck is it?) You think that SE shouldnt amend the ToS as fast as the RMT get better at what they do?

You make it all seem that SE and yourself are in the right and everyone else is in the wrong but the fact of the matter is that this game isnt in its prime anymore, every player that stays with SE is money in the bank (hey, when those RMT cards dont clear im sure SE wont be happy about the stolen accts issue then.) and happy customers are the most important thing you can have in an MMO.

Third-Party Websites are the driving force of this game and without them SE can start digging the grave for FFXI whether or not they decide to feign ignorance. These arent sites that promote illegal activity, they actually help to make people enjoy the game more which leads to SE being happy when that money flows in. BG is a good example of that eh?

It would do everyone a great service if we stop treating SE like some guardian angels they've never ever even faked being convincingly.

Maybe they should, in this parasitic relationship we call FFXI. Ignoring and saying 'fuck you' to your fanbase doesnt help when your game isnt the flavor of the month anymore. (Hey, maybe they should be more like Blizzard!)

Maybe you should be telling SE to grow up, its obvious they are the most immature of us all.

[Ryko]

Maybe they should, in this parasitic relationship we call FFXI. Ignoring and saying 'fuck you' to your fanbase doesnt help when your game isnt the flavor of the month anymore. (Hey, maybe they should be more like Blizzard!)

Maybe you should be telling SE to grow up, its obvious they are the most immature of us all.

SE hasn't been flavor of the month for about half of its NA lifespan, it's not like another MMO making more money than them has ever been a motivation for them to not treat their customers like utter crap. Maybe I'm the only one used to it so I just don't expect much out of them but how exactly is any of this new. Why is it suddenly now a big deal and up to them to fix it when the playerbase ignores it otherwise until it hits home? Like I said, I'm one of the few people who is almost constantly on the "Fuck SE" side of things, and this one seems silly even to me.

[DragonCloud64]

If people are still wondering as to a possible source of these keyloggers I came across a couple links on somepage.com. Somebody posted some very suspicious links in the comments area of items.

http://ffxi.somepage.com/itemdb/2923

http://ffxi.somepage.com/itemdb/8522

http://ffxi.somepage.com/itemdb/3890

The fact they arent clickable links is pretty lol. I guess stupid people will try anything.

And yah I think it goes without saying dont copy and paste those links or you will probably get a keylogger.

There are a -ton- more of these, they are on alot of pages. FFXIsomepage web admin needs to delete those. God forbid anyone is stupid enough to DL those D:
Here are some more, they try to use different hosts and crap, most of these are on fish pages: http://ffxi.somepage.com/itemdb/3743 http://ffxi.somepage.com/itemdb/4167
http://ffxi.somepage.com/itemdb/4217 http://ffxi.somepage.com/itemdb/4204