2011-02-04, 01:21 AM
Jamie_Kurosawa Wrote:What Nexon could start with is using high encryption levels between the Server and Client using things on par with WPA2-AES's level of encryption or better to where a public/private key has to be downloaded to the client, verify the client is registered to the user such as taking a hash of the MAC address or some other random ID Code from a random piece of hardware and encrypting it using SHA-2. This way only authorized PCs can access the account.
This idea is absolute crap prone to the exact same problems the existing system has.
1) You either can't register a new computer for access without already having access, which either means there has to be a security hole to let you do so, or only the person who's already compromised your account can choose whether or not you can get back in.
2) If you go the key route anyone who got your key via any number of operating system vulnerabilities and user ignorance would be able to login as you, same hole in SSH keyfile authentication.
You've seen Nexon's existing support for password lockout issues, all this would do is make users even more screwed.
Authenticators are by far the best and most readily available answer. They've a proven track record of success, major corporations use them daily to protect their VPNs. They're well understood, familiar, documented to an extent a trained monkey could implement them, and easily established on an opt-in basis so that only people who want that level of security need to worry about it.
It's not having what you want - It's wanting what you've got.