Guild Chat- @Username SECURITY ISSUE

spitfire1525 · April 2014

Why the hell do you have our login names show in guild chats? who cares if you can belong to 5+ guilds? Its a security issue, allowing users to see @Usernames. that's half of whats needed to hack into someones account. I don't care about having the "unknown IP address protocol", which is broken btw, if I try logging in a few times, I bypass it.

The point is, 90% of people use the same username/password for almost all their ***.
2. People know you by your CHARACTER NAME, not your LOGIN. ITs hard to establish identify in guildchat by USERNAME. Wtf were you thinking devs?

wc5b · April 2014

The email authentication needs to be removed. It is broken and takes me HOURS to get in because the only way I get in is because you can sometimes get lucky. I have NEVER received a code. EVER.

Liekos · April 2014

You know the entire mail system uses the @Username also, right?

Vlas · April 2014

Hearts · April 2014

The username is NEVER secret in ANY Game, service or anything (unless they explicable state that its anonymous).
Its not 50% of your security, anyone with knowledge can find your account name.. You wouldnt even need any computer knowledge..

The point is, 90% of people use the same username/password for almost all their ***.
Wtf were you thinking devs?

My answer is "Wtf were you thinking players".. who the hell uses the same password as username and expects to be safe..

But i do agree with you, it should be Character name, not account name, I have no idea who half of the people in my guild is because i only know them by their character name.

Kevinmon · April 2014

I agree, this is a huge security flaw and needs to be fixed.

plastercaster · May 2014

It just baffles me that Zenimax or anyone in charge of the security seems so reluctant to install a simple authenticator system? Is it that expensive that they would rather loose subscribers due to being hacked and no restoration services from their customers support? I started this game solo and hooked up with a group of about 15 people in the first week. Our GM got hacked and lost his vet 12 character last week. According to him after 2 days with customer service on the phone they informed him that they could (or would) not restore his character and offered him free game time going back to the start date of the game and 100k in game gold. It seems customer support fails to realize how much time goes into developing even one character that level. The Skill tree with researching items alone is a huge deal with a lot of people. Needless to say the GM has stopped playing and has taken about 12 people with him. They have refused to ever purchase or deal with Zenimax or Bethesda ever again.
ESO has the capability to be one of the greatest games on line. However it seems that Zenimax does not care its their future is literally hacked and stolen away from them.

Soap box is down.. thank you for your time.

pema · May 2014

old news... this has been said over and over. just make a strong password and you are fine... or find another hobby

Grimm · May 2014

We have been yellin about this since early Beta. Definitely agree but noone ever seems to listen.

pecheckler · May 2014

If you have a unique password for ESO and someone accesses your account, then there is malware on your computer, or a computer from which you logged into the game and also accessed your e-mail from is compromised. Your username being publicly visible is not contributing to this (not that I agree with it being visible - for other anonymity related reasons).

Consider that between 30 and 50% of all computers (depending on country) are compromised by malware. Add to that insecure or out of date OS's and remote access tools, or people's willingness to leave their e-mail credentials saved in browsers, it's no wonder players' accounts are being compromised.

Korozenn · May 2014

@Usernames (sorry if I'm mentioning an actual user there in the future) have never been set to private in any online games I've EVER played. You've always been able to view account names the moment you add someone to your friend's list or join a guild and view the roster.

Why? Because that's usually what people unanimously prefer to go by. Just like I prefer going by "Kor" or "Koro" or "Korozenn" instead of my character name "Vincent". If people called me "Vincent" in guild chat, they'd start to think that was my real name, when it's far from it. I prefer going by my internet alias, not a character name.

Point blank, you're not going to know someone for the long-term by their character name because chances are they're going to log-onto another character, and when you see that other character name in guild chat, you're going to think "Well...who is this that I'm speaking to now?"

I prefer going by people's account names when addressing them in guild chat. It's a lot less complicated because I can tell easily who is sending the message and don't have to tie a bunch of separate character names to whatever person has all those characters in guild chat all the time (which becomes a pain to do in larger guilds if you've ever tried using the X4DChat add-on to remove player names from Guild Chat in place for character names).

It's not a privacy concern; you need a better password. The first thing that ZeniMax states before creating your game account or resetting your password is to make one that is unique, make sure it is long, and that you use letters, numbers, special characters, or anything else you need in it for security purposes.

Korozenn · May 2014

Hearts wrote: »

But i do agree with you, it should be Character name, not account name, I have no idea who half of the people in my guild is because i only know them by their character name.

The only thing I think should be done is to give users the option to view both at once in guild chat, like I do with the X4DChat add-on. That's what I use when I identify somebody more by their character name than their account name.

Other than that, I don't really see a problem with this current system in-place. That is...unless people really make their username the same as their password (lulz). <- I've seen that happen one-too-many times in other online games, so trust me when I say it 'does' happen, and I have no idea how users should even be permitted to use passwords like that.

Anyways, back on topic, it's much easier for me to remember 24 people by their account handles in a service such as this that is reminiscent to Twitter in its usage of these @handles than it would be to remember 24 x 8 = 192 Character Names in the case that all of them had 8 Characters they used.

Zyffyr · June 2014

Korozenn wrote: »

@Usernames (sorry if I'm mentioning an actual user there in the future) have never been set to private in any online games I've EVER played. You've always been able to view account names the moment you add someone to your friend's list or join a guild and view the roster.

Ultima Online - was always by character name, not user name (at least until I stopped playing ~3 years after release.
Everquest - always by character name, or was so until I left ~5 years after release.
World of Warcraft - until they decided to force integration with Battle.net several years after release, it was 100% by character name. After that, friends were either/or with options for per-character friendship or per-account. Guilds, to this day, are 100% by character.
Warhammer Online - I admit to only playing for the first 2 months, but I am fairly certain that it was 'by character' as well.
Anarchy Online - Again, I only played for a few months quite a while ago but it was 100% by character not by account.

Of those, only WoW would ever reveal username and then ONLY when you explicitly allowed it to.

Why? Because that's usually what people unanimously prefer to go by.

If it were unanimous, this conversation would not be happening. I, in fact, want my characters to have semi-separate identities. I want to be able to log to 'Character X' and play without my online-only friends knowing that it is me - sometimes I just want to be left alone.

Point blank, you're not going to know someone for the long-term by their character name because chances are they're going to log-onto another character, and when you see that other character name in guild chat, you're going to think "Well...who is this that I'm speaking to now?"

Those of us who have been playing these games for more than a few years expect to be per-character, not per-account and have sufficient mental capacity to remember who is who.

ThisOnePosts · June 2014

A way to fix this would be to allow unique Display names, so that only we can see our own usernames. The unique display name would cover the entire account, so no one knows each others login names.

Bouvin · June 2014

Why can't your in-game handle and your login be different. Seems like a pretty simple concept to me..

plastercaster · June 2014

This will be an ongoing discussion. I do realize that it has been a request from players for some time. Just wanted to bring the idea of extra security to the front again. A strong password is only the first line of security (like having a fancy looking lock on your front door). However, an authenticator would be like adding a deadbolt to the door. With as many persistent thieves out there on the internet making things harder for them just makes business sense. Or otherwise ESO ( a game I was excited about and have enjoyed thus far) will have customers choosing the path that Pema so eloquently suggested... " find another hobby"

Sidney · June 2014

I think we should have separate @ handles in game that we choose instead of our login. Give us a choice at least so some people can keep theirs the same if they really want to. I hate my @ handle but i didn't know what else to pick when mine was taken. I can't stand when people call me by my login name. I'd never have picked it if I knew it would show up like that in game.

Calorath · June 2014

I have never played an MMO that shows your account name. Think of WoW or Guild Wars. No account names shown. This is something I too complained about in the beta. Stupid decision.