Master Server not responding

[Legacy_FunkySwerve]

               

PlasmaJohn wrote...
  Frankly I'm much more comfortable with that than I am with in-game passwording or connection matching techniques.

Succinctly put, you shouldn't be.

Funky
               
               

               
            

[Legacy_PlasmaJohn]

               Logins not cdkeys.  I take nothing at face value even the authentication performed by the MS.  I'm familiar enough with it at the protocol level to say "could have been done better but good enough".

If you have something provable instead of hearsay, feel free to drop me a PM with details.
               
               

               
            

[Legacy_FunkySwerve]

               Nothing I've said has been hearsay. Hearsay is, generally speaking, out-of-court-speech (or a document) submitted as evidence of a substantive matter in controversy before a court by someone other than the speaker. Used more loosely, as you are, it refers to secondhand, or anecdotal statements, rather than those based on the experience of the person speaking. Everything I said is based on extensive personal experience. If you don't want to avail yourself of it, it's no skin off my nose. But complaining about inability to schedule events because of MS downtime, and then turning up your nose at more practical approaches to security that don't require the MS at all, is just bleeping silly. '>

Funky
               
               

               
            

[Legacy_WebShaman]

               I can only agree with what Funky has said so far - on one PW that I was part of the Admin, we had such a system (no, I did not script it).  It worked very well.

Especially for the DMs.  AFAIK, we never had a break-in.
               
               

               
            

[Legacy_PlasmaJohn]

               @Funky: Sorry used the wrong buzzword.  Maybe "facts not in evidence"? 

Sorry, "in your experience" is not good enough for me to switch to a) sending passwords in the clear and authenticating passwords after they have an active connection.  If I'm understanding other lore that itself is a very bad idea (but can be mitigated by using an entry server).

Look, if you want people to take you seriously about "your experience" you need to find somebody else outside of your circle to verify your claims.  Otherwise it's all a load of grade school "nyah nyah nyah nanny-nanny boo-boo"

@Web: we've never had a break-in either .
               
               

               
            

[Legacy_FunkySwerve]

               As I said, I'm really not fretted if you don't want to listen. Given that WebShaman has already confirmed what I have said repeatedly, and is in no way, shape, or form related to me or my PW, it's a little hard to compass who you'd consider to be outside  my 'circle' - apparently my powers of influence are grander than I'd ever imagined. '> Never mind that I've already told you where you can find more information on this. If you really don't understand why I'm not going to discuss it on a public forum, there's no point in explaining it to you.

As for authenticating passwords after they have an active connection, it is not a very bad idea. It is in fact a very, very good idea, if you're as interested in the security of your players as you profess, because it is the only substantive, proactive protection you can give them from account theft. It does not require the use of an entry server, and an entry server will not protect you or your players from this risk. Whatever it is you think you understand about 'other lore', you are seriously out of your depth here.

Furthermore, if you've never had a break-in, why all the confidence about MS protection being superior to serverside cd-key verification and passwording? Your security - and calling it that is rather generous - has never even been given a chance to fail. Fail it would, in spectacular fashion, since you rely on the MS. Ours, by contrast, has evolved in response to repeated attacks, and includes our own nwnx plugin - a plugin that is the only protection out there against one serious threat.

Before you make more inane accusations of grade-school antics, we only distribute the plugin to confirmed server ops running linux, because there is no windows port, and the plugin reveals the nature of the security threat. We've distributed it to around 10 ops so far, and you're welcome to it as well if you're running linux.

In summary: you should not rely on the MS for security, and MS downtimes are simply not a reason to cancel scheduled events.

Funky
               
               

               
            

[Legacy_Khuzadrepa]

               

PlasmaJohn wrote...
Look, if you want people to take you seriously about "your experience" you need to find somebody else outside of your circle to verify your claims.  Otherwise it's all a load of grade school "nyah nyah nyah nanny-nanny boo-boo"

I've been active on these and the old forums for a fair number of years, and it's pretty easy to substantiate that FunkySwerve has been an admin for the Higher Grounds action server for quite some time.  That server is and has always been well-populated from as far back as I know.  I have witnessed him being actively helpful in the community, especially in the area of security, both here and on the NWNx boards.  I've also seen him trying to squash bugs, plug exploits, and just generally try to give assistance to other community members.

From all I have seen, if I had a question about security in NWN, he is the first person I would ask. In this particular case, I also feel that creating your own player authentication is the way to go, especially going into the future.  At some point, the Master Server could go down for good, and we'll need our own way.

By the way, I'm not sure what you mean by a 'circle', but I have no affiliation with FunkySwerve other than via the forum.

Just my two cents. '>  Cheers!
               
               

               

                     Modifié par Khuzadrepa, 01 juillet 2011 - 09:18 .
                     
                  

            

[Legacy_Calvinthesneak]

               They are right, we've just started implementing all sorts of security via database, because we were having issues with hackers and the master server being down.  Checks of IP's, CDKeys, loginnames, so that if things do show up out of sorts we simply are warned and then can perform verification if an account is hacked.

Funky Swerve has continuously given to the community over the years, from teaching NWNx, to letoscript to whatever else people looking to put the game to advanced use asked about.  Between work both he and Acaos have done, they have advanced the game and the community.  And the only relationship I can claim is that I know Funky via these forums and the old bioware ones.