Tell (tweet) Nexon that We Want Authenticators NOW!!

That's just the samples. They can be ordered branded to look like anything. MapleStory mushrooms for example

Google search WOW's for the colorful ones.

Oh cool. I wouldn't mind a customizable authenticator.

Yeah MapleStory copies a lot of things other MMORPGs already have, might as well copy authenticators too.

PS:^ Nice DeathWing avy.

Tweeted, although I don't expect to be able to use it, even if they do implement it, since I'm not in North America (so they would never ship me the physical device) and I don't have an iPhone.

@Jamie: do you leave your car, house, or office unlocked, just because it's been proven time and again that anywhere can be broken into?
Also, your suggestion based on authorized PCs: I've actually been thinking of algorithms for "verifying" a PC which would make it hard to hack but still possible for the legit user to switch PC's. The basic concept is that a PC (or even IP address, it doesn't make much difference) becomes more "trusted", for a specific account, the more cumulative hours that account is logged in from it. At first, you can log in, but are in a mode resembling "hellban" - can't transfer any meso, nx, or items to any other account, can't drop, use scrolls, divorce, delete chars, etc. As you accumulate time on that pc (training and chatting?) you slowly gain trust and are allowed more and more actions. However, thinking about it a bit more carefully shows there are a lot of "what if's" that need to be addressed, and the algorithm would necessarily end up quite complex. Complex = buggy, especially where Nexon is involved.
So, I'll just take the tried-and-true authenticator, tyvm. Only problems I see with that
- It makes it impossible to share accounts... which Nexon forbids anyway.
- What if you lose the device? Nexon's customer service being what it is, their way of getting around that would either be too easy for hackers to use, or so hard you'd pretty much lose your account permanently if you lost the device.

I think the most important thing they should add, though it's not really security related, is the ability to recover deleted chars. I would be upset if I got hacked, but I would be 1000000x more upset if they would have also deleted my chars.


As for authenticaters, I'd 100% sure buy one if they ship it to europe (probably not)

Tweeted, although I don't expect to be able to use it, even if they do implement it, since I'm not in North America (so they would never ship me the physical device) and I don't have an iPhone.

@Jamie: do you leave your car, house, or office unlocked, just because it's been proven time and again that anywhere can be broken into?
Also, your suggestion based on authorized PCs: I've actually been thinking of algorithms for "verifying" a PC which would make it hard to hack but still possible for the legit user to switch PC's. The basic concept is that a PC (or even IP address, it doesn't make much difference) becomes more "trusted", for a specific account, the more cumulative hours that account is logged in from it. At first, you can log in, but are in a mode resembling "hellban" - can't transfer any meso, nx, or items to any other account, can't drop, use scrolls, divorce, delete chars, etc. As you accumulate time on that pc (training and chatting?) you slowly gain trust and are allowed more and more actions. However, thinking about it a bit more carefully shows there are a lot of "what if's" that need to be addressed, and the algorithm would necessarily end up quite complex. Complex = buggy, especially where Nexon is involved.
So, I'll just take the tried-and-true authenticator, tyvm. Only problems I see with that
- It makes it impossible to share accounts... which Nexon forbids anyway.
- What if you lose the device? Nexon's customer service being what it is, their way of getting around that would either be too easy for hackers to use, or so hard you'd pretty much lose your account permanently if you lost the device.

Blizzard ships their auth to any country, but nexon probably won't do it.

and about losing the device, if you do it with blizzard auth, you will have to call blizzard support, and give all your info and they will ask you questions about your account to deactive the auth, after that, you will be able to log on your account again.

EDIT: after you add the auth to your account, even to log on battle.net site you will need to put the auth code.

- What if you lose the device? Nexon's customer service being what it is, their way of getting around that would either be too easy for hackers to use, or so hard you'd pretty much lose your account permanently if you lost the device.

A good point to exactly why it could be a bad idea as I motioned at with Nexon "supporting" this in it's implementation and their track record. If Nexon can bork up as much as they do God (or whoever) help you if you lose an Authenticator.

The verified PC method would be easier and just as effective. In fact one company uses it already to thwart piracy. That company is Microsoft and how they validate Windows. My method is similar.

The idea is this:

• Each PC system contains at least 7 Hardware ID and 7 Subsystem ID codes and a MAC address code.
  
• Of these, 5 IDs for both Hardware and Subsystem have to verified within so many usages for the client to verify the PC is the native client and account PC. For the first week on an account, a user can not perform any transactions other than with an NPC and the Storage.
  
• On initial installation the information is recorded to the account to a hash file and encrypted using SHA-2 (256 bit) and a copy is recorded to the server for authentication purposes.
  
• Depending on the user, a user can register a max only 2 PCs, like a desktop and a laptop. If any other PC attempts to log in on the account that isn't verified, the log in is refused, the user is sent a warning e-mail stating ????? from IP address x.x.x.x attempted to log in at xx:xx on your account.
  
• Log ins to the server are handled using encryption methods similar to WPA2-AES to encrypt the username and password being sent to the server for authentication.
  

Now with that method the only drawback would be if you had to unregister a PC. However, this could be limited to 1 PC per week and you can not unregister another until the newly added one has been verified for a week, and this can ONLY be performed through a secure section of the website.

Now if your curious as to the steps involved:

1. user on a verified PC logins into the server over a secured channel.
   
2. client checks the hash from the previous login, if at least 5 hashes check out with the hash recorded to the server, the user is verified and allowed to login and the new hash is recorded.
   

The only major involvement is upon account creation and installation:

1. user signs up for account and downloads client and creates a 10 security question bank.
   
2. user installs client and client records initial encrypted hash from the IDs on startup
   
3. user logs in and initial 7 hashes are recorded to the server
   
4. after 1 week of successful authentications with no less than 5 consistent hashes verified the PC goes into verified status upon which a user can add a second PC that must match the IP address and be recorded.
   
5. after initial PC is placed in verified status, user is allowed ability to perform user to user trade interactions as well as item, money dropping, and the ability to use Game Cash.
   
6. If the chance occurs both PCs suffer a failure the account can be placed, at the user's discretion, into a stasis mode until a new PC can be verified. During this time the account can not be logged into using a game client, and upon reactivation from stasis, a user must answer 5 security question from a batch of 10 questions made upon sign up, however user must go through steps 2 - 5 once again.
   

The upside of this would be...

• No PIC or PIN needed of ANY kind. In fact add using birthdays to the list also.
  
• No probable and possible way to hack the account unless someone actually STEALS your actual PC and can successfully duplicate your ISP's IP address and fully duplicates your exact hardware, subsystem, and MAC ID codes.
  
• Nothing to lose or break or replace batteries in.
  
• E-mail notification of attempted account tampering would be VERY welcome.
  

The downside...

• Unless your completely impatient, having to wait a week to get fully verified to have full usage of trading and dealing goods is about it.
  
• It might take a few nanoseconds longer in the log in process.
  

Now unless you think I'm talking mumbo jumbo or gobbledygook, go bury your face inside a CompTIA Security+ book and learn something.

I think the most important thing they should add, though it's not really security related, is the ability to recover deleted chars.

That ability already exists for them, they've done it, rarely, for certain 'famous' users who had that happen.
If they had better security that would be an issue a lot less.

For the people going on and on about shipping; Nexon wouldn't have to handle the shipping themselves. You're generally responsible for buying them and in most cases paying for S&H if there is any and the entire order goes through a 3rd party that actually provides the authenticators.
Nexon wouldn't even be truly involved until you actually paired your shiny new authenticator with your account.

The verified PC method would be easier and just as effective. In fact one company uses it already to thwart piracy. That company is Microsoft and how they validate Windows. My method is similar.\

Sure. Let's use the method that Microsoft uses. Not like anyone is running dozens of pirated copies of their OS so obviously it's working, right?

Your idea is convoluted, complicated, time consuming and not guaranteed to work. MAC addresses can be changed. Anything that relies on communication to another server can be lied to. Anything that requires verification from another server can be lied to. You can easily setup a proxy, redirect traffic to it and tell your client it got any response you want to from the verification system. They don't need to steal your PC, they can either spoof the MAC address themselves, or just send their own for five days and walk in. IP addresses are not static by the way, so everyone on a leased IP, or a publicly shared IP, are screwed by your idea in slightly different ways. As is anyone who bothers to upgrade their PC in any significant way.

The key pineappleup in your logic is it requires Nexon to design, build and maintain.
Authenticators are configured and setup by 3rd party security specialists who know a hell of a lot more about what they're doing than Nexon, you or me.

Rather than trying to reinvent the wheel with our own highly limited understanding of what constitutes "round" (or in this case technology in general) why don't you admit your ignorance in the matter, stop trying to one up everyone else and actually support a tried and proven method of security?

Typical case of Jamie not knowing a thing about what she's talking about and spreading her horrid "logic".

Oh so having to pay for security that is licensed and outsourced to and from a 3rd party of which then could anything happen should the contract expire or come into arbitration, and you the user are contracted with a service fee for this is better security to protect your account of which then you have less control over, is so much better and risk free than doing what should have been done in the first place for free and no cost to the user and consumer?

Yes Nexon has it's flaws and yes servers and some things can be spoofed, but here's a word of info straight from the text book... to date encryption methods like SHA-2 256/512 and AES have not been broken by anyone or anything and nothing can be perfectly spoofed if the information isn't attainable and if the encryption methods haven't been broken yet or can't be.

However to have any security that works it has to have a foundation that works as well. Adding a bandaid is just that, a bandaid.

And Secun for your halfwitted remark... Go buy a copy of this and read it: http://www.amazon.com/CompTIA-Security-S...0470038217

Blizzard gets their authenticators from a 3rd party manufacturer (Because obviously they have a sub-branch called Blizzard Manufacterers, Inc. ).

It's worked just fine for them so far.

And does Nexon have a subbranch called Nexon Manufacturers, Inc.?

However, as stated nothing really will work until you fix things at the base level. The free security offered should be good enough to not require an additional layer like an Authenticator that required a usage fee. An Authenticator should be at best a novelty option. If that's expecting too much, well maybe it's time people expected more, asked for more, and got more rather than sitting quiet waiting and twiddling thumbs making sarcastic remarks, rude comments, and doing nothing but criticizing.

I expect more and better from Nexon all the time. I submit tickets often suggesting things like that as well. At least someone wants stuff to be better and has ideas about it, even if that's only me. However, at least I'm thinking up ideas rather than waiting and seeing what someone else brings along only to criticize them for either being smarter than me, or actually having an idea good or bad thats got some originality to the usage.

At least I came up with something to work with that was original if not derived from something else, and targets the base, not the bandaid.

And does Nexon have a subbranch called Nexon Manufacturers, Inc.?

No, and neither does Blizzard. Because that was the whole point.
You're trying to poke holes in an established and functional system while standing up your paper mache wanna-be security out in the rain.

And I suppose you can come up with something better that doesn't require a bandaid fix like Authenticators?

At least I came up with something to work with that was original if not derived from something else, and targets the base, not the bandaid.

And I suppose you can come up with something better that doesn't require a bandaid fix like Authenticators?

That is not necessarily a good thing. Especially since it wouldn't work, has no preexisting proof to drive support for it and ultimately you have zero chance of either explaining your idea to Nexon or getting them to adopt it over an actual tried and trued method. Companies don't just pick security schemes up off the steet, they look for things that have a proven track record and that existing customer comfort can be demonstrated with. All you're offering is a Pandora's box of new potential complications.

This is the part your brain isn't parsing - We don't want your ideas. No one does. Not a one of us in this thread. Because this thread is not about you This is not your moment to shine. There are already solutions available. We don't need you to be our savior. All you have to do is support the already proven and available option, or shut up and let people who do care about it show their support.

I am frankly sick of dealing with you making everything about you. This ends now. It is your own first and final warning that the next time you enter a thread and make it about you I will remove you for good. That includes replying to this subject any further. If you (or anyone) wish to argue with me regarding this particular edict, take it to PMs.

Sadly this won't stop hackers: http://www.southperry.net/showthread.php?t=38990

There will always be a perverbial back door, but more effective security is welcome (as long as nexon doesnt screw it up like their PIC or costs more than it is worth like Item Locks).

And I suppose you can come up with something better that doesn't require a bandaid fix like Authenticators?

So what if you passed your A+ exam, that doesn't change the fact that account authenticators are an easy solution, that is proven to work.
You're trying to make this thread about you, when it's not.

Somewhat relating to Veneni's post: I think deleting (or disabling) a character should not be allowed at all. The fact that Nexon lets characters be "deleted" is just dumb. At least put a level restriction (say...lvl 100+) from being deleted. Okay, you may argue that someone might legitly want their character to be deleted, for that Nexon should add a reasonable amount of character slots to an account and that's that, the characters 100+ cannot be deleted. Simple solution to one flawed security aspect of the game.

As for the authenticators, if they are proven to work in other games, then why not?

I digress, let's not forget we're talking about Nexon here, an unprofessional company to say the least. They can't even proofread their own public notices.

I'd appreciate an authenticator system, I had a bit of a scare back in january.

One of the things that's nice is the whole account deactivation thing that they currently do.


"Welcome back to Nexon.net!

Your account has been deactivated for your protection. This has occurred due to account inactivity or improper access attempts to your account. "

The verified PC method would be easier and just as effective. In fact one company uses it already to thwart piracy. That company is Microsoft and how they validate Windows. My method is similar.

made me laugh hard

because theres not a ton of win7 activator in the internet, no one cracked the win7 protection....

Like eos said, your idea will just not work, people have more than 1 computer, they want to play the game, its like the iTunes thiung that you need to autorize your computer to use itunes, you can only do it to 5 different computers, very limited.

Did assassin creed 2 DRM protection works? no, it didnt, people complained about: hey, i bought the game, its ONLY SINGLE-PLAYER GAME, but why i need 24 hours internet connection to play? after a few months, ubisoft did a patch to remove it.

auth is the best option you have, I have it on my bnet account, and im sure, to get hacked, or the hacker steal my ipod, or he crack the algorithm my unique ID uses, then find out what code it is using at the x time he wanna log on my account.

I don't know why you say auth arent safe, if even banks use it to auth customer bank accounts.

When i try to connect to my bnet account, since i don't have my ipod here at work, i can't do anything with my account:

 Spoiler

Somewhat relating to Veneni's post: I think deleting (or disabling) a character should not be allowed at all. The fact that Nexon lets characters be "deleted" is just dumb. At least put a level restriction (say...lvl 100+) from being deleted. Okay, you may argue that someone might legitly want their character to be deleted, for that Nexon should add a reasonable amount of character slots to an account and that's that, the characters 100+ cannot be deleted. Simple solution to one flawed security aspect of the game.

As for the authenticators, if they are proven to work in other games, then why not?

I digress, let's not forget we're talking about Nexon here, an unprofessional company to say the least. They can't even proofread their own public notices.

Character deletion should be allowed, both because of limited slots (even if Nexon decides to give up the revenue from additional character slots, I assure you people will quickly fill up the maximum 12 or 15 or w/e the limit is) and because of limited names (people often make mules to reserve a good name, before a character of that class can be made. Then they must delete the mule to create the real char). Or people want to remake a character whose stats they messed up on, again with the same name it had.
However, it should get harder and harder the more "meaningful" a character is. High level, full inventory, cash items, significant meso, all should be indications to require birthday, lastname, e-mail verification, etc. And if that means people who've lost their e-mail can't delete any chars beyond level 50 or with more than 100k meso worth of inventory, so be it.

Couple questions about authenticators and, ummm, ToS-breaking common practices:
- Can the same physical device or phone number be used for more than one account? (Multiple accounts for one person)
- Can two authenticators be used for the same account? (Shared accounts)