PoL Comments/Suggestions
So here is what I am submitting to the comments and suggestions people. For those willing to lend a hand, I intend to make a revised version that other people can copy and paste to submit. I have finals to study for at the moment, so it might be a couple of days.
Hello, I am registered with PlayOnline, and I am an avid Final Fantasy XI player. Due to the difficulties I have encountered after my account was compromised, I have a few policy suggestions that I would like to share. I am the owner of account number ********.
Problem:
Late December 3rd or December 4th, my account was hacked by a virus called “infostealer.gamania”. I have made seven or eight calls to the PlayOnline representatives, who unfortunately can do almost nothing due to “policy.” Currently, it is PlayOnline’s policy for an account owner to provide the following before resetting a password: account number, name, birth date, first and last four digits of the current credit card, and street address. For basic policy procedure such as forgotten passwords, providing the above information is adequate. However, in cases of hacked accounts, this is not enough. In the event of compromised accounts, it should naturally follow that a different procedure should be taken in order to verify the identity of the person on the other side of the phone. This is due to the fact that the personal information of a compromised account is normally changed after it is acquired. The issue is that PlayOnline IDs and passwords have too much influence over establishing rights to an account. I have four suggestions for modifying PlayOnline’s current password reset policy.
1) A proper account owner could verify ownership via registration codes.
2) A proper account owner could verify ownership via previous credit card information.
3) There could be a more involved procedure for changing personal information.
4) There could be optional password protection via telephone.
Solutions:
1) PlayOnline could require account information that is harder to steal, for example, registration codes. Registration codes cannot be as easily leaked because they are only entered once. The most important thing however, is that registration codes can only belong to one user, and in order to be stolen, it must be physically taken, rather than virtually as we see in on-line crimes. To take it further, since registration codes could still be leaked and used maliciously, PlayOnline could additionally require the credit card information that was being used when the registration code was submitted via the PlayOnline account.
2) This proposal would effectively make account-stealing more difficult is that an account owner could verify ownership via previous credit card information. I propose that providing the full credit card and street address information that was used on the account prior to its alleged hacking to be a sufficient replacement for the current first and last four digits and address. This would allow more extensive account security for those of us who have been your customers for years. These RMT and hackers are the bad guys, we account users are the victims, and PlayOnline representatives are supposed to be the good guys. However, when victims call in complaining about bad guys, the good guys can do nothing because of a flawed policy. This leads to PlayOnline being viewed as having very poor customer service. Also, hackers do not operate within policy procedure, so, in cases where hacking is involved, why should PlayOnline? It’s an obvious barrier in getting these problems solved. One may say: “Well, following policy faithfully is what makes PlayOnline different from hackers.” This is a very admirable and true answer. However, my point is that because these bad guys have no policy constraint, the policy of PlayOnline must be flexible so that it can affectively combat complicated issues. The logic I am promoting is “If the enemy uses bullets, you buy Kevlar vests, and if the enemy uses armor-piercing ammo, you take appropriate measures to combat it.” However, the logic that I see from current PlayOnline representatives is “We built armor. The enemy uses armor-piercing ammo, but our policy doesn’t allow us to upgrade, I’m sorry.”
3) With the current PlayOnline policy, hackers only need to have the ID and password in order to take entire control of an account. Because of this fact, they can too easily gain what one of your representatives called “rights to the account.” I believe that other measures should be taken to ensure that these “rights” are not exchanged so easily. These measures would create more account security for the real owners while increasing the difficulty of hackers and RMT to keep acquired accounts. My proposal has two suggestions. The first suggestion is that the existing full credit card number (or perhaps the first and last four, as is current policy) should be submitted along with the new credit card information when a user attempts to change the credit card information. This would be similar to how you change passwords on other online accounts such as email. In these instances they make you provide the old password when changing it to a new one. The second suggestion is that upon credit card changing, an email should be sent to the user outside of PlayOnline’s account that requires activation before the new credit card takes effect. This would slow hackers by forcing them to have information outside of PlayOnline to do their dirty work. Simply put, ID and passwords have too much power within one’s PlayOnline account, and are insufficient in verifying the identity of the account’s true owner.
4) Another measure that could be taken is optional password security via PlayOnline representatives on the phone. This would offer a method of account security free from internet hacking. By this process, an account user who is able to verify his identity as the appropriate owner of the account could submit a password on the telephone with a representative that would either give him or her full access to the account’s information in the event that he or she believes the account to be compromised. Also, verbal password authorization could be optionally chosen for those account owners who wish that there information never be allowed to be changed via online means. According to this process, anything changed would have to be done over the phone.
Conclusion:
Thank you for reading my proposal. It is my wish that you put as much effort into affecting some type of policy change to benefit your PlayOnline account users as I have in recovering my account from its hackers. I have not yet recovered my account, but am taking every measure humanly possible in doing so. I can only hope that a future policy change will alleviate your employees current restraints so that I may once again roam the world of Vana’diel with my friends without having to repurchase all of the game discs and re-leveling my character. Starting over from scratch is not an option for me. It would cost too much, and be too depressing to repeat almost 300+ hours of work. Many users have enjoyed your game for years, and desire to use it for entertainment for more years to come. In light of this it is truly sickening to think that hackers are so easily able to steal our accounts and “gain rights” to them without immediate resolution by the actual owners or PlayOnline representatives. These malicious hackers must be stopped, or at least slowed, and I am sure that the aforementioned proposals can effect this.
The Special Task Force stated in one of their recent reports that RMT activities have declined, and that their gil reserves have been greatly reduced and are having a much harder time staying in business. There is no doubt in my mind, that if at least one of the measures I have suggested are taken, that these RMT companies will have exponentially more difficulty in plaguing the Final Fantasy XI game environment. Thousands of us play your game and work diligently to create our characters and enjoy their experiences. We utilize teamwork, imagination, logic, and, above all, a lively spirit when we strive to master the game that your company has created. It is my sincerest request that you approach the above account-hacking issues with the same attitude, and solve this so that many of us in your game community may reacquire our accounts and continue to make memories with our friends online.
Sincerely,
My Name
