Questionable Actions?

Well, I mentioned in Jarki and Jen's B-day thread that someone attempted to
hack into my account, but I didn't go into much detail, so I will do so here.

The other day I was reading my email when I noticed a notification from DF,
someone had tried to change my password and it sent me a request. I figured
that maybe I had hit something by accident until I noticed that the I.P addresses
were different. So I went to Crynsos about the situation and sent him the following
message.

Quote :

Greeting Crynsos!

I was looking at my email account today and noticed that I received an email
from DF informing me I had requested a password reset. I thought maybe I
had accidentaly hit something in order to send the request but when I compared
I.P Addresses, I noticed that the request had been from someone else.

This is my current I.P: censored

This is the I.P of the person who sent the request: censored

If you wish to see the automated email in it's entirety I would be happy to forward
it to you. I hope to hear back from you soon, and I apologize for any inconvenience.

It took him a whole day to reply, but finally, he did.

Quote :

Well, usually I'd instantly ban whoever requests the password of another person and thus tried to steal their account, but sadly this IP is related to several not too unknown and totally different players here, so I can't really do much about that now... its probably best for now to simply double check your password's security and possibly choose a more secure password if you feel the need to...

~ Crynsos

So I get the feeling he's trying to sweep thee whole situation under the
rug and decide to push things a bit further, so I sent this to him.

Quote :

My password is pretty strong, but I can't say I get what you mean, why
can't you ban this guy? The fact that he tried to change the password
for my account shows intent.

to which he replied with:

Quote :

IPs are randomly distributed among users of a certain ISP and we automatically see all the accounts which still exist and were ever accessed via that certain IP, although we don't get any information on when that IP was used. Since multiple different people appear on the list for that IP I can't simply ban them all at once, and no one of the people on the list are known for being problem users in the past...


~ Crynsos

I didn't save what I replied to him with, but suffice to say, I called
shenanigans and asked him what he'd do when someone else who
didn't practice safe internet protocol and have their accounts taken?

I await his reply and probable ban for ludicrous rule infringements.

Go above the petty mod and straight to an admin.

you cant directly PM xaelith or admin =/

His reply to my last reply

Quote :

Quote :

Ok then how do you punish people if you can't distinguish people
share the same I.P? Whether you feel anyone on that "list" have
done wrong before or not is irrelevant, one of them tried to hack
my account.

That IS in fact important, since that is the only way to distinguish the culprit from the normal players. I can't exactly send messages to all of them to ask if they recently tried to hack your account...

Quote :

I'm not wanting to cause you trouble, Crynsos, but I've got a right
to some degree of security from the staff of this game. I've logged
a lot of hours on both of my accounts and I've put my own cash
into the game. I've taken preventive measures to stop my account
from being stolen, the mods are the ones who're supposed to take
an active approach.

Sure you got a right of security and I'm helping with that as much as I can, but I can't go beyond the technical limitations of our system and even our admins can only rarely change anything about that situation. The best preventive security is still a solid password, since even if people attempt to steal accounts, they can't get past the password control, which is entirely up to you to keep (in)secure.

I can and will only act against illegally acting players as long as I got exact and trustable evidence. Acting by sending out mass-warnings or bans without solid proof is far worse than not acting in a case where proper proof is missing.

Quote :

I've used the password checker you posted to increase my security,
but not everyone does. What will you say to them?

I don't force anyone to use it, nor is it truly necessary to use it if you have some common sense in your brain when creating a password. As long as you have an idea what a password is good for and how valuable your account is for yourself, you'll pick a rather hard password and thus prevent pretty much any attack of potential intruders all by yourself already. if you don't, its your own fault and you will have to rely on the restoration of lost items while thinking more about password security after that experience.

No matter where you go, it is always up to the user to ensure account security, both of their email and main account.


Also, cases like this are extremely rare. Whenever shit happens and we get contacted to fix it, we can and will practically always pretty easily catch the responsible person and punish them accordingly, although that is not possible in this case due to technical limitations and I can't do anything about it either.


~ Crynsos

So what do you guys think?

I think you should change your password. Even if no action has been made against you yet, your attacker may have already gotten your password.

I also think you should change the e-mail associated with your account. Your attacker obviously attempted to intercept the e-mail, and may have succeeded. That means your e-mail account may also not be secure.

It's all basically a 'be on the safe side' kind of thing, but you can never be too careful.

As far as Crynsos, he is basically correct. There isn't much he can do that wouldn't interrupt the experience of all the players using that IP, and there is no way to know who it was.

Neither my email or DF account were breached, or I think the hacker would have
succeeded in doing what it is he/she intended to do. Unless he was trying to get me
to go to a fake log-in page, which failed too, since I went through my browser's
address.

My account's password would be hard to crack, it comes out as a piece of java script
coding. So I'm not worried about either being broken in to, but it's the principle of the
matter. Someone tried, they failed but they may not fail against someone else. I turned
to the moderator force and they tell me there's nothing they can do until the inevitable
happens, and even try to defend the perpetrator. That's what bothered me the most.

Maybe I'm making more out of this than there really is, but I've got a lot of expensive
equipment that won't be reimbursed if this guy happens to crack my account. Any hacker
who's determined and smart enough can get in if given enough time, no matter how easy
or hard the password is. There's tons of programs available online that lets you crack
passwords, too.

I'll change my password, but this isn't fixing the problem, it's just delaying the inevitable.

Account hackers are on every game. I will use Endless Online as a reference, as people walk down the street bragging in hacked accounts about selling all the items for $1 to their main account or friends.

If you did not give out your password to anyone, then your items/cash may be reimbursed should AdminPwn/Xaelath be in a good mood.

All I read is that he was going to go fix it, and ran into some difficulty. It was a problem averted, just it couldn't be followed up with a ban.

Crynsos is a good moderator. I can't say the same for the other two. But of all people to have Questionable Actions, I'm somewhat surprised. XD

I talked it over with buck and we're both in agreement that Crynsos was genuinely at
the end of what he could do, so I issued an apology to him. He really is a good mod and
I'm sorry that I let my temper get the best of me.

The first mod I've seen that isn't looking for an excuse to ban people.

I actually agree with you.

oh
a big wall of text...

sorry
but seeing all that, got too lazy to read
I hope that you can sort it out

We did, Claude.

TL:DR version: some jerk tried to hack me and failed. I reported said jerk, but the mod
couldn't exactly do anything in my particular case. I got paranoid/emo and questioned
their claim and found it to be true and apologized.

lol
nice

thanks for the short summary

Quite an unfortunate situation this random person has put you in... I hate thieves that simply try to take other people's things, even if it's only data for an online game.

Dirty rat deserves whatever nastiness that karma decides to throw at him.

If by some horrible twist of fate you end up losing your account, I'd be more than willing to help you get back on your feet.

yea hackers suck ass.

this is why i like DF alot, mods will fix your shit if it goes bad. Hacking is near impossible in the game other then repeatidly trying passwords.

i want to be on the top 100 strongest or richest player in DF but that just puts a bullseye on you.

And with me leaving to the Navy June 3rd prolly not a smart idea. I would give my stuff over to someone but theres no garuntee they'll be here till i get back. kinda want to buy GM on an alt so it wont get deleted and store my shit there.

More than likely I'll be here, Kyo, and I'm still game for holding your stuff.

Of course I'd give you every means to contact me, should I not be here o.O

If I didn't know better, I'd say someone's out to get us.

Did anyone else get the email containing changes made to the wiki a few days ago?

"umbrella has changed tactics" followed by gay black porn posted on our wiki...

I think someone doesn't like us.

I remember the help guide on the old wiki was replaced with lesbian porn once.



It was on there for 3 days before I noticed and changed it. No one ever claimed responsibility.

They didn't only change that Wesk, they changed a BUNCH.

He got chased down by a Wikia Community Manager. Obviously he was attacking several wikias.

Wiki vandals are just the next gen graffiti artists, the problem is, we can take down their
"art" as fast as they can put it up, and then we can stop them from doing it again.

They're an annoyance at best.

Except their paint doesn't work on all walls. Some pages are locked to prevent more updates. What walls do you know that paint doesnt stick?

Oh I could so put in a dirty joke, but I'll take the high road and behave.

someone does have the old information saved right so we can post it all back up?

nevermind just looked and its all good again.

yeah. wiki's save versions, so you can just roll it back to the way it was before.