Introducing the Square Enix Security Token (10/03/2009)

[Marajade]

I don't know why everyone is saying that SE should be giving us this additional security tool for free. This key is a luxury, and not a necessity. I can't think of any company that gives out luxuries for free. It's not their fault that some people are retarded when it comes to their passwords and security of their personal computer.

Two decembers Ago: Because the fact that the password Hash of POL was cracked is so totally the players fault, right?

Wish I had one of these two years ago.

 

[Lucki]

Two decembers Ago: Because the fact that the password Hash of POL was cracked is so totally the players fault, right?

Wish I had one of these two years ago.

edit: Misread

edit2: Are you talking about the keyloggers in some FFXI sites? If so, then that goes back to my original statement of people not adequately protecting their computers.

 

[Shirai]

If it was a non-complicated, easy to figure out password, then yes, it is their fault.

I think you might have forgotten how the hackers actually got the accounts?
They didn't guess any passwords, actually they didn't even get to know the passwords.

No, they found a way to download the exact file with both your POL ID and your password by executing a simple script spread over a huge amount of websites and occasionally even put into new hardware like a new external hard drive or MP3 player you bought in a store.

Is it the player's fault for allowing mailicious scripts to run on their computers?
Perhaps, but when even antivirus software and spysweepers aren't up to speed yet there's not much you can do against something you can't see until it is already too late.
Is it a consumer's fault that they are buying something that has been bugged by a kid in a factory?

Before going 'oh but you shouldn't visit somepage'.
thousands of sites hit with scripts specifically written to get your FFXI/WoW/RO/whatever MMO accounts.
And a few of those aren't small mailicious or game specific sites either.
creative.com and even my own company's site c1000.nl (grocery store site) were hit by hackers leaving this 'gift'.

And please don't go, 'you should've used firefox' because many people that lost their accounts are or were firefox users just visiting a site they normally trust(ed).
The exact same could have happened to you.

 

[Tristam Green]

I'll also say that I have recently finished cleaning multiple instances of the same virus off my company's Chairman's computer.

The virus? W32.Gammima.AG, a worm with a keylogger whose intent is to steal passwords for online gaming.

Is he a gamer? I don't know. Possibly online poker and the like, but certainly not MMOs lol.

 

[Lucki]

I think you might have forgotten how the hackers actually got the accounts?
They didn't guess any passwords, actually they didn't even get to know the passwords.

No, they found a way to download the exact file with both your POL ID and your password by executing a simple script spread over a huge amount of websites and occasionally even put into new hardware like a new external hard drive or MP3 player you bought in a store.

Is it the player's fault for allowing mailicious scripts to run on their computers?
Perhaps, but when even antivirus software and spysweepers aren't up to speed yet there's not much you can do against something you can't see until it is already too late.
Is it a consumer's fault that they are buying something that has been bugged by a kid in a factory?

Before going 'oh but you shouldn't visit somepage'.
thousands of sites hit with scripts specifically written to get your FFXI/WoW/RO/whatever MMO accounts.
And a few of those aren't small mailicious or game specific sites either.
creative.com and even my own company's site c1000.nl (grocery store site) were hit by hackers leaving this 'gift'.

And please don't go, 'you should've used firefox' because many people that lost their accounts are or were firefox users just visiting a site they normally trust(ed).
The exact same could have happened to you.

Firefox in and of itself won't protect people, it's some of the extensions that you can install (NoScript, AdBlock, etc) that give you added protection. Those addons are widely used, and highly recommended. It really is the persons fault if they were hit with something that stole their password when there are tools out there that help minimize that risk.

 

[JP]

i wonder what is the in game item that comes with it, might attracts PS2 and 360 players to buy too

I don't think they will give us any in-game item. They may, but I don't see why they should/what they will give us.

 

[Lucki]

I don't think they will give us any in-game item. They may, but I don't see why they should/what they will give us.

I don't see why they wouldn't. If an in-game item is associated with a RL item, and you buy the RL item, why wouldn't you get the in-game item?

 

[Shirai]

I don't think they will give us any in-game item. They may, but I don't see why they should/what they will give us.

Information on the Security Token's release date and price, as well as further details regarding the in-game bonus, will be announced at a later date.

Straight from SE.

Firefox in and of itself won't protect people, it's some of the extensions that you can install (NoScript, AdBlock, etc) that give you added protection. Those addons are widely used, and highly recommended. It really is the persons fault if they were hit with something that stole their password when there are tools out there that help minimize that risk.

Extensions that only got a wider variaty of users after the first wave of bannings.
By that time a couple hundred people were already victim.
From which quite a few people did have other programs on their computers that should have prevented programs and scripts installing on computers and nesting in their registries.
Yet, the hackers didn't sit still themselves and managed to find ways around that.

Therefore I stand by my statement:

The exact same could have happened to you.

 

[Tagrineth]

I don't think they will give us any in-game item. They may, but I don't see why they should/what they will give us.

As a special incentive, each Square Enix Security Token will come with an exciting in-game bonus which may just prove indispensible during your many adventures in Vana'diel!

you were saying?

 

[JP]

I was saying, fuck you guys for proving me wrong because I didn't see that <_<.

Then, yeah I wonder wtf they are going to give us this time.

 

[Lucki]

Straight from SE.



Extensions that only got a wider variaty of users after the first wave of bannings.
By that time a couple hundred people were already victim.
From which quite a few people did have other programs on their computers that should have prevented programs and scripts installing on computers and nesting in their registries.
Yet, the hackers didn't sit still themselves and managed to find ways around that.

Therefore I stand by my statement:

If the programs installed weren't properly configured (or turned on at the time of infection), then they may as well not be on there at all. I'm not going to get into how people may or may not have had their computers configured; it's a futile argument since neither of us knows. I know that I had visited those sites at the time when peoples accounts started getting taken over, but nothing ever happened to my character. I guess it had to do with me taking proper computer security measures, and not leaving my computer wide open like a 7-11.

So I guess I'll stand by my statement too:

It really is the persons fault if they were hit with something that stole their password when there are tools out there that help minimize that risk.

 

[Lucki]

Then, yeah I wonder wtf they are going to give us this time.

A neck piece with the following stats:

• 5mp/tic
• 5hp/tic
• Acc. +15
• Atk. +15
• Dmg. -5%
• Crit. hit +5%

And it's going to give you the GM shimmer effect :awesome:

 

[Shirai]

If the programs installed weren't properly configured (or turned on at the time of infection), then they may as well not be on there at all. I'm not going to get into how people may or may not have had their computers configured; it's a futile argument since neither of us knows. I know that I had visited those sites at the time when peoples accounts started getting taken over, but nothing ever happened to my character. I guess it had to do with me taking proper computer security measures, and not leaving my computer wide open like a 7-11.

So I guess I'll stand by my statement too:

Or you just didn't visit the infected sites at the time of the attacks.

Or like me, have the account password not saved on the computer and needing a password to get into the viewer's account before even loging onto my Playonline account.
(After finding out about it, I regularly checked my system and never got infected, but anyway...)

There's many things we could have done right or wrong, but my point stays that the little finger cannot always be pointed at the user every time something bad happens to the computer.
Especially since the exploit was bypassed security measures that were deemed sufficient at the time the attacks actually started.

 

[Bajaratt]

Saw this last night, I was happy about the announcement, and I'm probably going to get one as long as they aren't $50 or something like that. Yeah, improving their security for free would be nice; but when the problem is mostly on the user's end, this would be a good way to protect the user from themselves.

 

[JP]

A neck piece with the following stats:

• 5mp/tic
• 5hp/tic
• Acc. +15
• Atk. +15
• Dmg. -5%
• Crit. hit +5%

And it's going to give you the GM shimmer effect :awesome:

Either that or

Drains 5 MP/tic
Drains 5 HP/tic
Acc. -15
Atk. -15
Dmg +5%
Enemy Crit. hit +5%

Haste +1%

 

[Lucki]

Or you just didn't visit the infected sites at the time of the attacks.

I know that I had visited those sites at the time when peoples accounts started getting taken over, but nothing ever happened to my character.

I should mention though, that when reports started coming out about what sites were being infected, I stopped going to those sites.

Or like me, have the account password not saved on the computer and needing a password to get into the viewer's account before even loging onto my Playonline account.
(After finding out about it, I regularly checked my system and never got infected, but anyway...)

There's many things we could have done right or wrong, but my point stays that the little finger cannot always be pointed at the user every time something bad happens to the computer.
Especially since the exploit was bypassed security measures that were deemed sufficient at the time the attacks actually started.

95% of the time (read: more often than not), it is the users fault. But going back to the OP, depending on how fast the token generates a new password, and how quick script kiddies are in retrieving and then using the stolen passwords, this new security measure won't really be all that useful if people still expose themselves to needlessly.