FFXI Keychain Codes Expire in 27 minutes

[Izzy]

Zumi generated a code on his keychain, did salvage for another 15 mins, logged off, used the old code he generated 15 mins ago...

...The 15 min old code worked. WAY TO FUCK THIS ONE UP SE!

This is from a thread that came up in Standard Discussion and I also posted it in the existing thread in Advanced. I'm putting it here in hopes that some SE rep will see it and fix it. As of right now, any key that has previously been generated and has not been used can be used at any given time.

This does make it harder for RMT to hack your account, but it does not make it virtually impossible like the keychain is supposed to do.

Link to standard thread: http://www.bluegartr.com/forum/73422...-friendly.html

[Tomiko]

Hopefully SE fixes this. Although I'm not sure how they would since the keychain isn't connected to anything to know when the code is displayed.

[Izzy]

Hopefully SE fixes this. Although I'm not sure how they would since the keychain isn't connected to anything to know when the code is displayed.

Set their server side passwords to timeout after 30 seconds instead of remaining infinitely active.

[Corrderio]

SE just had a PlayOnline version update. Maybe that fixed it?

[shaddix]

Just crossposting.

Oh also to clarify, My experience is that after a password is used, it and everything that would have worked before it is disabled.

27 minutes appears to be the cutoff. I was denied login at 28 and 27, but successful just before 27 and successful at 26.

Also it seems the passwords generate every 40 seconds or something? Its not as short as 30 I don't think. Kind of hard to figure out.

So 40 possible combinations will be working at any given time unless you've recently logged in and nullified the 39 previous ones I suppose. Probably gives a little leeway and allows ones that will be generated next to work as well. Though 27 minutes seems excessive, do they really expect the clocks on these things to get off by 27 whole minutes? It's probably 27 minutes into the future as well.

Actually maybe its 30 minute window in both directions from SE's clock. And mine is already 3 minutes behind? Or maybe the cutoff is 20 minutes and my token is 7 minutes fast?

[Shadowhusky]

SE just had a PlayOnline version update. Maybe that fixed it?

[Update Details]
- An issue has been addressed where players would be unable to place a GM petition through the PlayOnline Viewer under a certain condition

Guess not.

[shaddix]

[04:39] <shaddix> um WHAT THE FUCK
[04:39] <shaddix> if you just type a random number into that one time password field
[04:39] <shaddix> it denies your login
[04:39] <shaddix> but kicks off whoever is actually logged in

I will test with just pol viewer and not being logged in to ffxi
Works on pol viewer as well so.

If someone knows your SE password, and your POL password, then they can just repeatedly kick you off pol viewer over and over, but still unable to log in themselves.

[Corrderio]

Well, sounds like another good idea SE managed to halfass.

[shaddix]

Lol a random SE password kicks you off as well :/

Haha even if you don't set it to use a SE account, you can still kick someone off if you know their POL username/pass.

[Katalyn]

Disheartening

[cdgreg]

Deep, Deep sigh

[cdgreg]

Actually, come to think the booting out if someone uses the wrong key while you're logged in this may not be a bad thing. Possibly SE planned this so you know someone is trying to log you in but using an invalid token so you can change your POL PW.

edit: if someone attempts the wrong key 5 times does it lock them out for 30 minutes?

[dejet]

Deep, Deep sigh

can you change your playonline PW from the playonline site? or you have to do it from the playonline screen? if its the 2nd one then well what if the person keeps logging in you cant change the PW ;p

[Khamsin]

Why would they need your POL password or SE password? Doesn't the one-time password replace all of that? i.e. once you activate your token on your account, you only enter the six digit number and any passwords you've created (for POL or SE account) are no longer needed?

Or are they requiring you to enter two/three passwords now? POL/SE, and token?

[cdgreg]

can you change your playonline PW from the playonline site? or you have to do it from the playonline screen? if its the 2nd one then well what if the person keeps logging in you cant change the PW ;p

I thought of this too, but at least it gives you time to call POL assuming it's one of the 8 hours they're open or have a friend call a GM then wait in line for 4 hours.

[dejet]

Why would they need your POL password or SE password? Doesn't the one-time password replace all of that? i.e. once you activate your token on your account, you only enter the six digit number and any passwords you've created (for POL or SE account) are no longer needed?

Or are they requiring you to enter two/three passwords now? POL/SE, and token?

if you look it still stores your Playonline PW(you still need it but its saved and you never have to enter it)

the SE PW is added(so now they need to jack 2 PWS, 1 that you never enter anymore so that is much safer, and a 2nd that does nothing if they gain it) and then add ontop of that the 1 time PW.

so your playonline PW is still there, just saved. so you still need it ~_~;

not a bad idea i guess, but i wish they would make it that you could change the PW from playonline.com it make things easy.

this stops anyone from stealing your account in anyway i mean. they need to do this

gain your playonline PW and ID, then gain your SE ID and PW, then gain the one time PW lol what the hell are the odds they could do that.

[Izzy]

Why would they need your POL password or SE password? Doesn't the one-time password replace all of that? i.e. once you activate your token on your account, you only enter the six digit number and any passwords you've created (for POL or SE account) are no longer needed?

Or are they requiring you to enter two/three passwords now? POL/SE, and token?

You need all three. Your pol password is saved but you have to type the other two.

So I guess there's like 54 working numbers at any given time now?

[Khamsin]

Was hoping I'd only need to enter the six digit number, and be logged in. I wonder why the extra step of entering your SE password is needed. Maybe they'll let us save the SE password, too, so we only have to enter the number.

Afterall, just entering the six digit number should be secure enough if it works as it should.

[Cairthenn]

Lol a random SE password kicks you off as well :/

Haha even if you don't set it to use a SE account, you can still kick someone off if you know their POL username/pass.

It verifies your POL account information before it verifies your SE account information; so, it probably attempts to log you in then verifies the Square Enix account information, and if that's incorrect it kicks you (Just making guesswork going by the steps in the POL connection sequence thing).

It'd be much smarter to make it work in the opposite order, or if Square Enix employees had working brains.

[Charismatic]

Not touching this but oh man... oh god... oh man.