Security Issue

[gribuz]

I wanna give you guys a heads up

The Game Client has a big SECURITY ISSUE concerning username & password

If u have you computer connected too a LAN network & have your install-dir shared it is possible too copy the folder and have your stored username & password come a long on the copy if u have checked the save password box

For me that is a BIG SECURITY ISSUE

[Kalallen]

Well first of all Dont share you AO directory on a lan net. why should you do that ! its plain stupid.
and second, DONT use the Save password Box. never ever use it in any online games. Even if your not on a lan net, still dont use it.
If you dont have a firewall up, and a hacker gets in, your account is ****ed, if thats what he is after.

Celabaruge....

[Darkbane]

So, don't share it... or don't tick 'save password'. Use a firewall, use anti-virus and trojan checkers.

Encrypting the password would help too mind you...

And it is a point worth bringing to people's attention:

If you tick save password, your password will be stored in plain text in a file in your AO folder.

[svendor]

store your password. Type it in every time.

[gribuz]

Well the reason i posted this is because there is some people that do not use a password on Windows 2000.

And if the attend a LAN-party they do not need too share there folder because then its WIDE OPEN

ex : \\PC01\c$

with that u have full access if u don't have use a pwd for administrator

I personally don't store a pwd on my AO-Client. I also use a Norton Antivirus and has a HW Firewall so i do belive i am secured :-)

This was just a HEADS UP

and maybe a thing too consider too change in a patch :-)

[______________Aledif]

No offense, but if someone is stupid enough to not only leave administrative shares... well... shared and not have a password on at very least the administrative class of accounts, then they should NOT be using NT/2000.

I mean, really, it should be basic knowledge. If you're using 2000/NT and don't know this, you're using the wrong OS (unless it's forced upon you by your company, which means you're only a user, not an admin and they really should know this or lose their job).


It's sad how common this can be anyway.... I used to make around 70k USD a year just pointing out basic things like this once a week (stupid IT economy crash).

[gribuz]

He he i works as and SysAdmin now i know exactly what u mean.

But there is alot of stupid peps out there

I attended a LAN-Party with 5000 users and there were a lot of clue = none there :-)

select * from users where clue > 0
0 rows returned