@WhiZard
ultima03 wrote...
I'm not sure for how long this thing is down but there is a security breach for all servers
1 - Anyone can enter any account without knowing the password
2 - Inside the account they can delete the character if the server offer the option
3 - They can delevel - relevel if the server offers the option
4 - They can impersonate
5 - They can mess with the purchased items (sell them) and also mess with quicklots
Some server offers the option to protect their character with an in-game password, and thats another security problem :
1 - We don't know if they encrypt password
2 - No notice to prevent people from using a password that's used for an email or other importants things.
Putting
a password in-game only protect against server options (delete/relvel)
if coded properly, it won't protect from selling all items,
impersonating, etc.
It is therefore critical that the master
server authentification comes back as fast as possible. It has been away
too long and that caused a lof of torouble, character wipes, and vault
wipes.
Please take this into serious consideration
This is what
Ultima03 the concern troll has stated as his concern; none of which are possible on any server using halfway decent code.
1 - Anyone can enter any account without knowing the password
True
2 - Inside the account they can delete the character if the server offer the option
False. They would be KeyBanned the moment they logged in.
3 - They can delevel - relevel if the server offers the option
False. They would be KeyBanned the moment they logged in.4 - They can impersonate
False. They would be KeyBanned the moment they logged in.5 - They can mess with the purchased items (sell them) and also mess with quicklots
False. They would be KeyBanned the moment they logged in.Some server offers the option to protect their character with an in-game password, and thats another security problem :
1 - We don't know if they encrypt password
You also don't know if they encrypt your password on most of the PW websites/forums. It is nearly impossible to extract anything from the PW's database without direct access to the database.2 - No notice to prevent people from using a password that's used for an email or other importants things.
Most players likely use the same password that they use when logging in to the PW's forums/website, which may be the same as their e-mail. Stealing your password from a PW server would be considerably more difficult than stealing from/hacking the PW's forums. The PW admin already has direct access to all of that from their website, so there is not an increased risk from them having access to the PW database.Putting
a password in-game only protect against server options (delete/relvel)
if coded properly, it won't protect from selling all items,
impersonating, etc.
False. They would be KeyBanned the moment they logged in.
Modifié par wyldhunt1, 07 janvier 2012 - 11:57 .
