Friday with Means - January 8th, 2010 - Who took my stuff!

[Akchosen]

had the same here with someone from the org

had to pay his yearly subscribtion twice to play because FC closed his acc for not having payed the first time.

he had writings from his bank that he did pay the first time but nobody could read (or wanted) to read this stuff.


customer support 4tw

[IHaveHugeNick]

Ackshully... With Sil patches were coming out once every 2 months (excluding patches for the patch) with content and information. Means' brilliant maneuvre is to have information coming out every week, and patches/content every... uh how far apart were the last two?

Well the truth also is they do things of much bigger caliber now, even if it wont stand out on the homepage as SHINY NEW FEATURES.

[bitnykk]

yo gentz !

just to wish you good 2010, first !
then to say : speed the new engine up and noob island total relift to make AO amazingly attractive.

old people find the game ugly compared to newer games, and new people that don't think so find the beginning complicated and boring. and we need more people ingame ...

so i hope this year gonna be AO rebirth !

[Niemandsland]

/me throws in some painkillers for Means and waits for more concrete information about the transfer...

[Iamkama]

Means' Spider is now a meme.

roflllll

[Malentor]

Means' Spider is now a meme.

Haha, pure win

[Artyomis]

Imo, account panel at web-page and account login-into-game passwords should be different, to give players ability to py for other's accounts. For example, my friend don't have any online payment system that he uses on a permanent basis, or credit card, and, basically, he can't pay for his accounts. And I can, using my CC. Such payment is legit, Funcom will still recieve cash for specific period, there is nothing wrong with it.

As an owner of a company, that provides B2B services, idc who will pay for specific bill, a real client or its partner, as long as payment matched this bill and cash appeared on my bank account. Service has been granted, payment was proceeded and approved, cash were paid, deal is done. 3rd party relations between real customer and its partner are none of a business of a company that provides services.

The only and real problem atm is that account web and ingame passwords match, which gives person access to whole account, not only to payment section, which is a problem. This should be changed, asap.

And regarding hacked accounts - easiest solution here is to copypaste passwords into login window every time you're about to log in, and not to type it manually. This will give at least some protection against keyloggers that do not catch buffer's data.

By the way, account sharing is officially allowed or not? If not, then Means' 1st message in this thread is weird, and if yes - well, i'd love to recieve confirmation on it.

[omegahealer]

think you got to read it as
"It's not allowed!!!!!"...."but...do it if you want, just dont come cry if things turn out bad or we catch you doing it".

[Mikenche]

And regarding hacked accounts - easiest solution here is to copypaste passwords into login window every time you're about to log in, and not to type it manually. This will give at least some protection against keyloggers that do not catch buffer's data.

Unfortunately that's not enough. The actual game client (as opposed to the launcher) receives the user name and password on command line - in plain text! Anyone or anything with the ability to run code on the computer while you're playing can inspect process information and get your login credentials.

Means: When will you guys fix this glaring security hole?

[NoGoal]

Imo, account panel at web-page and account login-into-game passwords should be different

They are. You just gave the same login/pass for both :P

[lazarus]

They are. You just gave the same login/pass for both :P

well the truth is that this came with the new account/billing page/system

[Hacre]

Means: When will you guys fix this glaring security hole?

Won't solve the keylogger problem, or more importantly, the problem of people being stupid and not keeping their computer safe.

If someone is in a position to get a key logger onto their system, it doesn't matter what FC does in regards to what is stored in memory, your system is compromised and the uninvited guest is going to get access to your stuff.

Like I said in an earlier post, yes it's pretty silly that your password and username is clearly visible in the running process list, but if someone is in a position to see that, you've got bigger problems and they're going to get your details anyway and not just to your AO accounts.

[Artyomis]

think you got to read it as
"It's not allowed!!!!!"...."but...do it if you want, just dont come cry if things turn out bad or we catch you doing it".

Answer should only be "yes" or "no".. "Maybe" isn't an option here.
Anything that goes off "yes" and "no" borders - worth a discussion, that will never end, and it won't be called "rules", but will be called "choice".

And, lets pretend pretty simple situation.
Theres a char, its being shared between 2 persons. One day, such char is being caught in using some hardcore exploit. Whom will you ban? A single account? That won't punish abuser appropriate way.

The only right logic is - 1 account - 1 owner - 1 way to deal things - 1 clear answer.
Otherwise it won't work just, believe me...

[Edta]

I think it's more like "It's not allowed" but we don't have time or tools to seriously control against it. If you get petitioned though and we indeed notice something fishy about your IP-adresses, you risk getting banned.

[Strata]

Sorry, but your spider is missing one leg.

Spiders got nerfed?

[Matammyr]

Anyone else think this thing is damn cute? I was like awwww when I saw it

That's why I posted it!

[Hacre]

Removed the stuff from both posts because I think enough AO idiots have seen stuff that might give them half a clue.. and who knows they might know actual intelligent people who could implement this stuff.

------------------- about who is at fault-------

It has been run through the courts already in the US. IF a company discovers a security hole and they do nothing about it and their software clients are attacked via it and it is provable they have taken no action in a "reasonable" amount of time, the software maker is LIABLE FOR DAMAGES. The same way an automaker is if there is a flaw in a vehicle that is a saftey problem and they do nothing about it untill it happens and someone dies and such.

Good job no one is being attacked as a DIRECT RESULT of FC's negligence then.

Btw, with your old post, I stopped reading when you said something utterly stupid along the lines of "firewalls blocking incoming traffic breaks Windows auto updating".

Wow.

[Tinypain]

Guys it's simple. They shared accounts, someone had access to several accounts and that person got compromised and as a result compromised all the other accounts.

It's dumb that funcom even took action to help them to be honest as the next time it happens I'm sure the hammer will come down hard on them and accounts will get perma banned when they /petition "omg i shared my pw and all my stuff got taken because I'm an idiot" rather than here are some IPR's and some gear back.

[MajorOutage]

Can we all at least establish that willingly giving your password to someone and getting ****ed over by said person does not constitute "getting hacked".

[Tinypain]

Can we all at least establish that willingly giving your password to someone and getting ****ed over by said person does not constitute "getting hacked".

I would say in this case one person was indeed hacked which then caused the rest who shared their accounts to get pwnt. I do believe there is such a thing as hacking but 98% of the time it happens to 1 person while anyone else is simply the bystander who shared his accnt info with the wrong dude.