Next time you get a crash report option, take a minute to scroll through it. I thought it was very interesting. It had everything except my SIN #

Darquer wrote: »

@Vlas, I've been in IT for over 25 years in the largest companies in the world. I've run some of the largest IT shops. I would not hire you. Drop the idiocy about paranoia, etc. We are talking best practice and also about the confusion the login name versus the character name causes.

I wouldn't waste my time even replying to a troll but hey, the game is down. I'm sure you think that's good too. It gives you time to troll.

though I agree we ought to strive for "best practice"

The end user will still insist on using "password" as a password, and the recovery question "your mother's maiden name" is really asking them what color was their favorite pair of shoes when they were five.

Of course, they wont remember when signing up they thought mother's maiden name was too simple, and figured theyd remember what the REAL question was by associating mothers maiden name with a pair of shoes when they were five.

In a perfect world end users would have passwords they could remember that were at least 7 characters long, with at least one capital letter, one number, and one special symbol reducing the chance of a successful brute force attack by a factor of more than 100,000,000

All of my passwords are either a combination of english words, or latin words. Dictionary attacks would need multilingual support to crack them. And brute forcing 14 character alphanumeric password from a non standard language to get my in game gold is not worth the 3.9326 x 10^5 Years it would take a computer (for a very fast computer)

The problem here then is key loggers. And who is responsible for keeping your computer virus free?

Any way I look at it, password security is the responsibility of the user.

Limited password attempts and trusted computers. Zenimax is doing fine. Though I would still like 2 factor authentication I'm not worried about my account security.

Edited: Gooder grammar

Darquer wrote: »

@Vlas, I've been in IT for over 25 years in the largest companies in the world. I've run some of the largest IT shops. I would not hire you. Drop the idiocy about paranoia, etc. We are talking best practice and also about the confusion the login name versus the character name causes.

I wouldn't waste my time even replying to a troll but hey, the game is down. I'm sure you think that's good too. It gives you time to troll.

I love the talk about "Best Practices"... From a technology perspective the accounts are as safe as they can be. Security Through Obscurity is not a great plan.

This is the security Schema as it sits -

Log in tied to Physical Computer & IP Address - If either changes you need to re-validate that computer through your e-mail.

If they have your e-mail - they have your account anyway. I use a separate account for my games and a different one for gaming site subscriptions[This prevents site vulnerabilities from getting me hacked]. It reduces the surface area exposed in MY e-mail account. However - in the end the account name could still be obtained from you if you do not use separate e-mail accounts by just hacking your e-mail.

The best fix for this is authenticators. I am sure they are "on the list"

Motivated since the servers are still busy being raised as undead. Warning: wall of text incoming, but something the devs/CS folks need to realize, and to help folks here who don't take the issue seriously to see just what potential risk there is in the current setup.


How to hijack a TESO account through some slight social engineering in a few easy steps:
1) Set up a website, using copy/pasted info from any of the variety of sources out there, with required registration to access. Registration process should require a confirmation email, a password for the site, and a request for the new user's account name (with reasoning given in step 2).
2) Join any guild advertising for new members in /zone. Congratulations, you can now see those account names and have characters/permission access listings in an easily visible format. Advertise in /guild that you have set up a website with helpful info for the game, but want it restricted to guild members only, so it will ask for their @handle to confirm they are actually in the guild (thus alleviating concerns that there is something devious in the works).
3) Take the new list of emails, passwords, and @handles, then start testing each email account to see who uses the same passwords for everything. This actually includes far more people than you expect, especially people who want to feel high tech without knowing what they are actually doing. Any of those accounts you now have access to? Hold off on doing anything til you complete the next step.
4) Start sending out official looking emails (easy to copy, since folks have been so kind as to repost some of the email replies they got from Customer Service all around the web) suggesting there has been an account issue, and they need to log in to verify the account is theirs, using that @handle from earlier to make it look more official. Believe it or not, people actually buy into this if the email is well written with proper English. Set up the link in the email to point to a very similar looking site to the one we are on now. You now have everything you need to get into their account at your leisure, including email access to their own personal accounts to get around the "we will send you an email if we don't recognize the computer" system that is in place now.
5) Pilfer, redistribute to other accounts, profit. And for extra evil, delete the characters so customer service has an even tougher time with their resources tied up trying to recover the characters and determine was is actually missing and what was just deleted.

There you go, I just broke the current security system. Folks can come in here saying "This is why you need personal password security habits!", but that means nothing when you figure just how many people out there are... not wise enough to realize all the mistakes they are making in regards to their own password security, and firmly believe either "I am fine" or "It won't happen to me! That only happens to other dumb people!"

I expect this post to get nuked by a mod at some point, but this MUST be addressed. Especially with no authenticators being made available to us.

andrei_baruub17_ESO wrote: »

Add the fact that there are no player name plates.. i cant recognize ANYguildmates or ANYONE for that matter in game. Its like mindless no-name people running around me. Nothing matches with TS.. and YOUR IN GAME NAME THAT YOU CHOSE MEANS NOTHING. You wanted to make a game thats immersive, and you completely negated our CHOSEN NAMES? are you people working there at ZOS.

agreed, I see a big problem when trying to team up with guildmates and trying to find out who's who. Going to be bigger when everyone has a few toons they use and trying to remember what userID has what char names for which class.

If anything... guild chat should show the current toons name so can be seen in party widow later. So with the game wanting 1 name to connect the account to all guilds. Someone mention a "nickname" which that would work to show in guild window as a tab to sort by just like player name or level etc.

Yeah, this definitely needs to go. Just use our character names.. I don't get why that is a problem.

+1 for OP

I have no issue with the way things work at the moment, personally like the fact that people cant hide behind their different character names (Gold sellers for example) all you have to do is report / ignore one name and its the account not just that one character thats taken care of.

nzblustone wrote: »

Vlas wrote: »

Except that when you are in a guild, you are in a guild for all characters... so it is logical to have one single name for it. Thus the account name.

Think it through man... how else will you remove confusion of the guild leaders.

Guild Leaders worth their coin are not so easily confused. Most MMOs in the past just display your currently logged in character name in guild rosters and chat and it is a completely acceptable system.

So as a guild leader of a guild with hundreds of people, the GM needs to keep track of alts manually.

What if someone invited in a hurry and forgot to make a note? Its happened, leaving me to go wtf when no one answers who it is and I get kvetched at when I gkick the unknown, usually by the main.

If youd have told me who the hell you were when I asked...

I think the greatest problem people have with it is that it is the account name that gets displayed. If you could just choose a pseud that gets displayed instead there would be less outrage about it.

AGREED giving away 50% of your login infomation everytime u talk is not cool have a function to hide it ... or nickname it

STILL I GUESS ITS BETTER THAN GIVING AWAY YOUR EMAIL ADDY EVERY TIME YOU TALK SO I CAN C WHY U CHANGED IT BUT REALLY NOT A VERY SECURE PRACTICE REGARDLESS OF THE PIN TO EMAIL WHEN LOGGING IN FROM NEW COMPUTER

This is the response i got for bringing up this issue.

We understand there may be some concerns surrounding the userID being visible to other players in-game. We have a multi-tiered system in place to improve your security, and there are many other facets to login security besides the basic credentials in The Elder Scrolls Online. Your security is of the utmost importance, and we go to every length to make sure your information is safe and secure.
The process of getting personal information from a userID is extremely difficult, if not virtually impossible. To recover a userID associated with a specific e-mail address and password, you need the first name, last name, and e-mail address of the account owner. Provided that is correct, you are still required to answer a security question, provide the correct answer, and then be sent an e-mail with a reset link. Simply attempting to put the required information into the website will not give the attacker any information.
There are quite a few layers of authentication, as well as the security of your trusted e-mail to protect you. This is all coupled with additional security not exposed to the player or potential hacker that protects you as well.

And im one of those people who get influenced even more because i cannot change my forum name

I have no issue with 1 account name though.

Sending my guild mates to read up on this.

Easily fixed, Champions online, STO, and Neverwinter did it easy. You set a user name, and then a game handle, you log in with the user name to your account, and when in game you show up as charactername@gamehandle in chat. You cannot make the handle, and the username the same, or contain a large similar section.

Agreed, Needs to be fixed, I do not like the username being out there, aad I would also like to be able to adjust my forum handle, since it was given to me by the company during beta, and it contains part of my real name.

Bumpity bump.