15 replies to this topic

[RenegadeMaster]

[Since at the time of this post an "Ask The Devs 9" thread does not exist, and I could not easily find another relevant existing thread that address my questions & suggestions regarding login security, I am posting them here:]

While I completely trust PG & IGP to keep my payment information (hosted by a third party) and user credentials secure on their end, and I would trust that MWO support would respond swiftly to an account getting compromised, this does not mean that user's computers or network connections are secure. So I hope that there are plans at least for the release date for further assist all users with ensuring that their credentials are transmitted securely

1) Are there plans to make the forums require HTTPS certificate-based authentication? If the same credentials (notably the password) for the forums are also used for the MWO game, implementing HTTPS for any web site or interface that accepts MWO credentials would go a long way to helping ensure that user's credentials are more secured from malicious software and people monitoring network traffic with a fine tooth comb. They would be less likely to detect or compromise the credentials. Even if the credentials for the forums and MWO are somehow separated, I think some users may find their forum reputation almost as valuable as their in-game reputation.

2) Has any consideration been given to having MWO support two factor authentication, such as RSA SecurID, whether by software or physical means? I know of several MMOs that use SecurID, as well as some people on those MMOs that could have prevented their accounts getting compromised if they had used SecurID. I, and likely many other founder users would seriously consider buying a physical SecurID token either held by a 3 inch tall model of an Atlas or another mech, or a token that is integrated into its back.

Thank you in advance.

Edited by RenegadeMaster, 06 July 2012 - 01:56 AM.

[Jfrost]

Great post, I'd like to see a second layer of security as well.

[Fire for Effect]

Well I do not want a second layer of security if you mean things like RSA sticks or any other physical things. You keep searching or loosing em and if you are a frequent traveller you might loose it so in short: NO

SSL for forum is ok and I have not yet looked if it is with or without SSL.

Since most accounts are compromized because people do not keep their OS and programs up to date or worse fall for cheap social engineering tricks it is only a false safety anyway. (keeping you PC up to date also makes online banking safer...)

[Jfrost]

Fire for Effect, on 30 June 2012 - 01:53 PM, said:

Well I do not want a second layer of security if you mean things like RSA sticks or any other physical things. You keep searching or loosing em and if you are a frequent traveller you might loose it so in short: NO

SSL for forum is ok and I have not yet looked if it is with or without SSL.

Since most accounts are compromized because people do not keep their OS and programs up to date or worse fall for cheap social engineering tricks it is only a false safety anyway. (keeping you PC up to date also makes online banking safer...)

I acknowledge your opinion and respect your right to a choice on the matter. And that's the topic - choice. I believe we should have the choice of using a second form of security (mobile authenticators on phones/mp3 players work in the same way as the "sticks" you mentioned). I also believe that we should be able to "opt out" as you would prefer. If this change was made, it shouldn't be forced on the players but offered as an option.

I also think the idea of having a tiny mech that keeps my account safe and secure is a fun idea. I'm sure many people would like to pay a little for that option.

[Fire for Effect]

Jfrost, on 30 June 2012 - 02:18 PM, said:

I also think the idea of having a tiny mech that keeps my account safe and secure is a fun idea. I'm sure many people would like to pay a little for that option.

You can have that of course but what begins with voluntary might become forcibly mandatory. (just for my curiosity which Mech would you want as keyholder?)

Wehret den Anfängen..
(german roughly translated: stop it while you can....)

Keeping your PC up to date helps all your assets be it online games or otherwise much safer. You would not believe what I have already seen on PC I had to repair or analyse...

But yes piranja should definitely use at least an SSL approach for log in...

[RenegadeMaster]

These replies bring a question in my mind - Are there any MMOs that actually REQUIRE mandatory two factor authentication?

I don't believe two factor should be required - I am just asking if that has been considered as an opt-in option.
I put SecurID token out there as an option because it is what I'm most familiar with courtesy of gaming friends and my last job required the use of one. RSA makes a software equivalent as well, which could be more convenient than a physical token, but less secure IMO.

Mobile authentication as an opt-in second factor would be ideal for people who stay logged into MWO game or forum for extended periods of time, but it may be an annoyance to people that log in or play for shorter periods of time. Do MMOs ever charge for mobile authentication services? That doesn't strike me as a service that many people would "buy". I assume it wouldn't be cheap for a software developer to implement or provide mobile auth, so I didn't suggest it in my thread. It is also possible to use a man in the middle attack that would not otherwise be possible with a physical key/token.

For anyone else who reads this and asks "what is two factor authentication?", read up on it here.

[Fire for Effect]

RSA key encryption has been broken by the way they had to exchange all hardware keys....

and a MITM attack for a game... you can also only avoid a MITM attack if you authenticate client and server to each other that is completely seperate from using a physical key generator.

I assume WOW is not far from making physical keys mandatory. Blizz has a habbit of making really bad choices and then do things that annoy pretty much anyone and they have a security problem simply because these fools have eliminated the username as seperate unknown login entity that an attacker first has to guess. I bet they do not even salt the password hashes,

(sorry went a bit to much into technical details...)

[RenegadeMaster]

Fire for Effect, on 30 June 2012 - 03:16 PM, said:

RSA key encryption has been broken by the way they had to exchange all hardware keys....

and a MITM attack for a game... you can also only avoid a MITM attack if you authenticate client and server to each other that is completely seperate from using a physical key generator.

I assume WOW is not far from making physical keys mandatory. Blizz has a habbit of making really bad choices and then do things that annoy pretty much anyone and they have a security problem simply because these fools have eliminated the username as seperate unknown login entity that an attacker first has to guess. I bet they do not even salt the password hashes,

(sorry went a bit to much into technical details...)

I've read about RSA's 2011 system compromise as well as the latest research findings on a possible crack from the past month or two, but I had not known about a hardware exchange/recall. Mind posting a link? That'd be some nice light reading for a trip I'm about to take

That last jab at Blizzard & security wasn't too technical, but I test software for a living

[Jfrost]

I put a lock and chain on my bicycle when I go for a ride, but whats to stop someone from walking down the street with a pair of bolt cutters?

Any form of security can be cracked, nothing is 100% sure-proof. However, it is much more secure if the suspects have to crack RSA encryption AND collect a user name and password for a specific account just to gain access. Its an extra deterrent, but it won't stop any dedicated thief. Locks (passwords etc.) only exist to prevent thefts of opportunity.

[Sky walker]

+1 to HTTPS logins

[RenegadeMaster]

That's a good point jfrost, although I would liken "breaking the lock" of 2 factor auth to something more than bolt cutters - Perhaps a blowtorch or laser cutter?

I have renamed this thread to better depict the contents of my first post.

[Co Starring]

A generic "authenticator" would have been nice. I mean an authenticator that is usable for/by ALL games.
A seperate one for each game you have is... meh.

Never going to happen, because gamecompanies can't play nice with eachother...

[RenegadeMaster]

Co Starring, on 06 July 2012 - 02:15 AM, said:

A generic "authenticator" would have been nice. I mean an authenticator that is usable for/by ALL games.
A seperate one for each game you have is... meh.

Never going to happen, because gamecompanies can't play nice with eachother...

That is an interesting suggestion. I have noticed this for various flash games.
Just curious - What is the biggest MMO (if any) that uses a general authentication service of sorts? One could argue that it is no less secure than a game company hosting their own auth service, unless the game company would offer 2 factor auth that the gen auth can't provide.

[Alisiel]

RenegadeMaster, on 06 July 2012 - 02:20 AM, said:

Just curious - What is the biggest MMO (if any) that uses a general authentication service of sorts? One could argue that it is no less secure than a game company hosting their own auth service, unless the game company would offer 2 factor auth that the gen auth can't provide.

Guild Wars 2 uses Google Authenticator, available for all the modern smartphone os's

[bionicbadger]

I don't think its needed.
You can't trade or sell anything to another player in this game so it isn't really needed. The huge majority of account hackers wont bother, because they can't profit from it.
Your account is tied to your email address, so you can always have the password reset if someone "steals" your account.

[RenegadeMaster]

bionicbadger, on 10 December 2012 - 01:29 PM, said:

I don't think its needed.
You can't trade or sell anything to another player in this game so it isn't really needed. The huge majority of account hackers wont bother, because they can't profit from it.
Your account is tied to your email address, so you can always have the password reset if someone "steals" your account.

That's a good point - Who knows if this game will ever adopt such trading. The fact that the game doesn't have such trading lessens the desire for two factor authentication.
I don't think that lessens the business case for secure forum authentication though.

Since I made this post, I can confirm that the MWO client application transmits credential data in an obscure, yet secure fashion. I say that as someone who has analyzed connection data legally as part of doing technical/network support.