Account Security

Got a great idea or a proposal for us? Post it here and discuss it with others!
User avatar
Till
Staff
Posts: 3563
Joined: April 19, 2007, 06:54:42 PM
Character: Till
Location: Germany

November 07, 2007, 09:55:16 PM

Was just wondering how you are going to guarantee best account safety for your players, apart from advising them to use a non-guessable password...

I'd suggest something with Security Questions like "What's your mother's name?" as many other known, especially mail-services like GMX or GoogleMail, webpages do. I don't like the system Tibia offers, the so-called Account Personalization, because I really don't like to give away my personal data and I am too lazy to write down an eternally long code, whereas remembering the proper answers to some questions are very easy to remember :)

Kind regards, Nim~
Nilsson
Tester
Posts: 1944
Joined: May 15, 2007, 09:34:31 AM
Character: Fawenah
Clan: Dwarfhood
Location: Sweden
Contact:

November 07, 2007, 09:58:26 PM

Nimrodel wrote:Was just wondering how you are going to guarantee best account safety for your players, apart from advising them to use a non-guessable password...

I'd suggest something with Security Questions like "What's your mother's name?" as many other known, especially mail-services like GMX or GoogleMail, webpages do. I don't like the system Tibia offers, the so-called Account Personalization, because I really don't like to give away my personal data and I am too lazy to write down an eternally long code, whereas remembering the proper answers to some questions are very easy to remember :)

Kind regards, Nim~
But I suggest to remove the "easy" question, such as favorite book/movie and similar, or atleast tell people to refrain from using easy guessable ones.
And mothers name could alst be to easy to come by if you have some personal information about the player.
User avatar
Till
Staff
Posts: 3563
Joined: April 19, 2007, 06:54:42 PM
Character: Till
Location: Germany

November 07, 2007, 10:00:32 PM

Who would ask for your mother's name? lol, that'd be kinda senseless, since it's not of other people's interest (normally) ;)

Of course there should be a variety of "easy" questions and questions whose answers may differ from language, which would make them hard to guess actually.
Nilsson
Tester
Posts: 1944
Joined: May 15, 2007, 09:34:31 AM
Character: Fawenah
Clan: Dwarfhood
Location: Sweden
Contact:

November 07, 2007, 10:06:36 PM

Nimrodel wrote:Who would ask for your mother's name? lol, that'd be kinda senseless, since it's not of other people's interest (normally) ;)

Of course there should be a variety of "easy" questions and questions whose answers may differ from language, which would make them hard to guess actually.
How about this: there are acouple of guys sitting in a internet café, one of the players there sees one of the other player having some nice stuff or something similar, then it wouldn't be to hard to figure it out where he lived and his mothers name and similar stuff. You'd be amazed by some people will do to gain advantages and exploit other people.
User avatar
Till
Staff
Posts: 3563
Joined: April 19, 2007, 06:54:42 PM
Character: Till
Location: Germany

November 07, 2007, 10:08:23 PM

Fawenah wrote:
Nimrodel wrote:Who would ask for your mother's name? lol, that'd be kinda senseless, since it's not of other people's interest (normally) ;)

Of course there should be a variety of "easy" questions and questions whose answers may differ from language, which would make them hard to guess actually.
How about this: there are acouple of guys sitting in a internet café, one of the players there sees one of the other player having some nice stuff or something similar, then it wouldn't be to hard to figure it out where he lived and his mothers name and similar stuff. You'd be amazed by some people will do to gain advantages and exploit other people.

A very rare case I'd say.... normally you cannot see in internet cafés what the dude next to you is doing :o
Furthermore, what obliges you to choose exactly that question? Simply was an example ;)
You're right, though... :oops:
Redshrike
Staff
Posts: 1514
Joined: April 01, 2006, 12:39:49 AM
Character: Redshrike
Clan: The Order of the Beetle

November 07, 2007, 10:14:47 PM

Fawenah wrote:
Nimrodel wrote:Who would ask for your mother's name? lol, that'd be kinda senseless, since it's not of other people's interest (normally) ;)

Of course there should be a variety of "easy" questions and questions whose answers may differ from language, which would make them hard to guess actually.
How about this: there are acouple of guys sitting in a internet café, one of the players there sees one of the other player having some nice stuff or something similar, then it wouldn't be to hard to figure it out where he lived and his mothers name and similar stuff. You'd be amazed by some people will do to gain advantages and exploit other people.
Then I think you have bigger problems with your rl stalker than with any loss of account data...
Nilsson
Tester
Posts: 1944
Joined: May 15, 2007, 09:34:31 AM
Character: Fawenah
Clan: Dwarfhood
Location: Sweden
Contact:

November 07, 2007, 11:45:47 PM

Redshrike wrote:
Fawenah wrote:
Nimrodel wrote:Who would ask for your mother's name? lol, that'd be kinda senseless, since it's not of other people's interest (normally) ;)

Of course there should be a variety of "easy" questions and questions whose answers may differ from language, which would make them hard to guess actually.
How about this: there are acouple of guys sitting in a internet café, one of the players there sees one of the other player having some nice stuff or something similar, then it wouldn't be to hard to figure it out where he lived and his mothers name and similar stuff. You'd be amazed by some people will do to gain advantages and exploit other people.
Then I think you have bigger problems with your rl stalker than with any loss of account data...
it doesn't have to be a stalker, it could be someone you know, like a person you just met briefly in another class in your school, or a class"mate", I was just making a point that it IS fairly easy to get that information if you set your mind to it (in those situations).
Jason
Staff
Posts: 2053
Joined: July 27, 2006, 05:36:07 PM
Character: Jason
Clan: Ironfist
Location: Omaha, NE
Contact:

November 08, 2007, 11:03:48 PM

Or simply let the user choose his own question...

Or, we could have a 1-800 # that you could call, and an operator would answer (atm, us - the staff). We would ask for whatever information they have about their account, then match a record with it. Then to confirm it's them, they would have to provide some other in-depth account information, "What did your password look like, or maybe have in it?".

Or, we could offer support for the Fingerprint scanner that you can get for Windows, then store your fingerprint image in our database, then you could login using that - OR, you could use a Windows Card (Windows CardSpace) to authenticate yourself..
User avatar
Thor
The Old Dwarf
Posts: 4374
Joined: March 30, 2006, 03:19:16 PM
Character: Mezur Stonecutter
Clan: Dwarfhood
Location: Norway
Contact:

November 08, 2007, 11:05:18 PM

Or get an iris scanner! :D
Nilsson
Tester
Posts: 1944
Joined: May 15, 2007, 09:34:31 AM
Character: Fawenah
Clan: Dwarfhood
Location: Sweden
Contact:

November 08, 2007, 11:38:55 PM

fingerscanning is ok for me since I own a cheep one :)
Redshrike
Staff
Posts: 1514
Joined: April 01, 2006, 12:39:49 AM
Character: Redshrike
Clan: The Order of the Beetle

November 09, 2007, 04:43:14 AM

Uh, this is getting rediculous. Seriously, we can't do anything about some crazy person you know in RL knowing the answer to a random question in your account recovery which you shouldn't give a real answer to anyway...
K-Seppi
Tester
Posts: 2159
Joined: April 14, 2007, 07:21:32 PM
Clan: Order of the Beetle

November 14, 2007, 08:45:41 PM

Torbjørn wrote:Or get an iris scanner! :D
Aren't those called retina scanners or is that something else?
Nilsson
Tester
Posts: 1944
Joined: May 15, 2007, 09:34:31 AM
Character: Fawenah
Clan: Dwarfhood
Location: Sweden
Contact:

November 14, 2007, 09:44:43 PM

K-Seppi wrote:
Torbjørn wrote:Or get an iris scanner! :D
Aren't those called retina scanners or is that something else?
a retina and a iris is two diffrent things, but both are in the eye though!
Boxarez
Tester
Posts: 84
Joined: March 31, 2006, 04:42:00 PM
Character: Boxarez
Clan: Order of the Beetle

November 26, 2007, 06:02:47 PM

Just get some hard secret questions and you'll be fine imho. If a user is dumb enough to have "Favorite fictional character" as question and "Harry Potter" as answer I think he kinda deserves to be hacked because that is so easy to figure out.
Jac
Tester
Posts: 1790
Joined: March 30, 2006, 03:21:24 PM
Location: Sweden

December 20, 2007, 10:47:59 PM

Nah, we will have an easy solution for this problem.

You will have this navigator datapad with a screen on it. First you need to input a twelve characters long authorization code, then it has a voice check. After that you are supposed to drop some of your blood on a small glass plate, which will scan your DNA. Next from that your navigators screen will start to blink in a certain frequence, you put it infront your monitor which will also blink at this moment, and sooner or later the navigator will get synchronized with the monitor. That is when you need to use your digital key (looks like a carkey) with a 1024bits personal code.

All this for a small price of 499$ No Biggie, eh? :)
Locked