Forum and game security discussion

[Jarod "Brickwit" McBrickerton]

A combination of digital and physical two-factor authentication is probably the highest possible security that is feasible for a game, however the physical side is probably fairly expensive, at least in terms of start-up costs. Once your volume gets high enough the costs get very cheap, but the first few hundred units could cost thousands of dollars to get to your customers.

On the other hand the all-digital pin system, especially one that changes with each login, is very cheap. I think they'd be smart to take Google's two-factor authentication system and use it for logging into AWS and the forums (especially after it becomes fully RCE) by creating authentication apps for Android, iOS, WinPhone, BlackBerry, and maybe others as well. It would have to be optional since not everybody has a mobile phone and you'd have to opt-in and link your mobile number to your game account, but it would solve a lot of the potential issues and cost the devs very little. If the app contacted a specialized authentication server to request a new pin at each login it would be faster than waiting for a pin to be sent to the phone like with Google's system.

[Alyx "Daisy" Johnson]

It should be possible to piggy back off the google app. lastpass does this, and the api is open source: https://code.google.com/p/google-authenticator/

[AW "Dr.Butler" SSB Officer]

Thanks everyone for participation.
We are very aware about the potential security issues this (same login/password for game and forum) could lead to.

At first, we would like to inform you, that this forum is constantly being modded by us. We had to rewrite the authorization module here in order to get it connected with authorization module of the game (it is a complex system).

Second, we don't store or transmit any passwords in plan text, so there is no way to retrieve it.
Even I don't have ability to change the password for anyone else except myself via forum software, and the Administrator's account is restricted from accessing the forum only from the internal network, where the web server is physically located.

Fifth shared some good info:

Now the password changing procedure. What exactly happens when passwords are changed?

If you change your password yourself, your old password is asked first, encrypted, sent to the server which will compare this hash with the hash stored in it's database. If this operation succeeds the old password hash is overwritten with the new password hash. Nowhere in the whole process is the encrypted password decrypted into human-readable form.

If it is administrator who changes your password for you, the administrator password has to be entered first, all the rest is the same. It's the administrators responsibility to have a good, safe password on his account.

You can read more about password hashing and salt by following links (wikipedia).

Next... the database itself is split into "parts", so there are no chances that gaining access to one section will give you ability to get to others. The access to the databases is restricted by some complex rules, and to get full access to the database is possible only from the devs' office (where servers are physically located).

Now, about integration of the 2 factor authentication or other ways (getting additional pin-code via SMS, like in Google)...
We would love to implement it, but we don't have funds for this atm.

In a close future we will implement additional protection like "lock to IP" and "lock to computer", so you will need to do more steps in order to authenticate yourself if you try to login not from your "home computer".

As of using open-source forum software... There are no 100%-secure forum software. We have chosen SMF over others because it is easier to change the authentication mechanism and integrate it with the game database.
We continue working on it by extending its functionality and improving the security. We have already changed internals on how the login/password are parsed, and will do even more on that topic.

Thanks again for sharing your ideas and thoughts, keep it coming. We are watching the discussion very close.

[Paul "Cuey" Darkmane]

In a close future we will implement additional protection like "lock to IP" and "lock to computer", so you will need to do more steps in order to authenticate yourself if you try to login not from your "home computer".

The lock to IP may not work as many people have dynamic IP address so would have to use redirection software such as "DNS2GO" to keep track of their changing ip addy.. which may be beyond the average player to use.

[Event "Janе" Horizon]

...
In a close future we will implement additional protection like "lock to IP" and "lock to computer", so you will need to do more steps in order to authenticate yourself if you try to login not from your "home computer".
...

Thanks for sharing this information.


In regards to the above text - could you reveal more about what addition steps will be involved (e.g. if there method makes the player go to their email account to verify themselves by clicking a link)?

[Zen "ZenX" Star]

The MMOs i have played with lLock To IP request the Answer to a Secret Question, to proceed.
You are normally required to provide 1 - 3 questions and answers when the game is setup.

Zen

[AW "Dr.Butler" SSB Officer]

...
In a close future we will implement additional protection like "lock to IP" and "lock to computer", so you will need to do more steps in order to authenticate yourself if you try to login not from your "home computer".
...

Thanks for sharing this information.


In regards to the above text - could you reveal more about what addition steps will be involved (e.g. if there method makes the player go to their email account to verify themselves by clicking a link)?

There are a couple of ways to get that.
It may require you to enter the answer for the secret question, enter additional pin-code or draw a figure (similar to HTC Android phones unlock feature).
Any ideas are welcomed! The more ways to authenticate, the more secure it will be (as a potential breaker will need to choose between lots of authentication methods and only some are valid)

[Leopold "Shaqan" Mutter]

In a close future we will implement additional protection like "lock to IP" and "lock to computer", so you will need to do more steps in order to authenticate yourself if you try to login not from your "home computer".

The lock to IP may not work as many people have dynamic IP address so would have to use redirection software such as "DNS2GO" to keep track of their changing ip addy.. which may be beyond the average player to use.

might be good idea to at least have such option among others choices..
I got dynamic IP which depends on NIC MAC address. As long as MAC stays same, I have same public IP all the time, even after network modem and firewall reboot.. There are other ISPs having DHCP servers giving IP-s out based on MAC..

good news that forum software is being heavily modified, less chance that exploits working on SMF generally would work on this forum. And that databases are compartmentalized..

what about card with passwords..? identical to ones being used by banks but sent to email. Player could simply print it out at home, and delete the email afterwards. And upon login into game, you get asked for user name, password, and then numbered password from that card.. That "card" could be generated by Support and being sent to player as pdf file in email attachment. PDF for better printing quality. At least some added security, since all that trojan could see from numbered password that it´s different each time, and number of a password asked is not showing in captured keyboard log.

[Jarod "Brickwit" McBrickerton]

At first, we would like to inform you, that this forum is constantly being modded by us. We had to rewrite the authorization module here in order to get it connected with authorization module of the game (it is a complex system).

Second, we don't store or transmit any passwords in plan text, so there is no way to retrieve it.
Even I don't have ability to change the password for anyone else except myself via forum software, and the Administrator's account is restricted from accessing the forum only from the internal network, where the web server is physically located.

Fifth shared some good info:

Now the password changing procedure. What exactly happens when passwords are changed?

If you change your password yourself, your old password is asked first, encrypted, sent to the server which will compare this hash with the hash stored in it's database. If this operation succeeds the old password hash is overwritten with the new password hash. Nowhere in the whole process is the encrypted password decrypted into human-readable form.

If it is administrator who changes your password for you, the administrator password has to be entered first, all the rest is the same. It's the administrators responsibility to have a good, safe password on his account.

You can read more about password hashing and salt by following links (wikipedia).

Next... the database itself is split into "parts", so there are no chances that gaining access to one section will give you ability to get to others. The access to the databases is restricted by some complex rules, and to get full access to the database is possible only from the devs' office (where servers are physically located).

Now, about integration of the 2 factor authentication or other ways (getting additional pin-code via SMS, like in Google)...
We would love to implement it, but we don't have funds for this atm.

In a close future we will implement additional protection like "lock to IP" and "lock to computer", so you will need to do more steps in order to authenticate yourself if you try to login not from your "home computer".

As of using open-source forum software... There are no 100%-secure forum software. We have chosen SMF over others because it is easier to change the authentication mechanism and integrate it with the game database.
We continue working on it by extending its functionality and improving the security. We have already changed internals on how the login/password are parsed, and will do even more on that topic.

Thanks again for sharing your ideas and thoughts, keep it coming. We are watching the discussion very close.

It's great to read that you are not only aware of the potential security issues and that you are capable of implementing increased precautions and safeguards, but that you have already implemented many methods! I, for one, feel much more confident that my game/forum login and password are safe.


As for the 2-factor authentication via SMS or email, could you explain where the costs lie in implementing it? I haven't tried anything like it myself, but it seems like the only cost would be labor hours based on the skill levels your group has shown. Are there licensing costs of some kind or does it come down to not having available devices to test the system? If the problem is test devices (Android, iOS, Windows Phone, etc.), you could always implement the system as an optional choice for the kinds of devices you already have access to (I'm assuming that's at least one of the three main mobile OSs) and add other OSs later on.


For "lock to IP/computer," it sounds like a good setup for me. I mostly only play on my home tower but I sometimes like to play on my laptop when I'm away from home, and since it's fairly rare, I wouldn't mind having to answer a security question, enter a pin, or provide a second-level password in those cases. On the other hand, some couples play together and will likely switch PCs from time to time, so this might be more annoying for them.

[Event "Janе" Horizon]

The complexity of implementing other security features was why I wondered if the email verification method was going to be used.

Dedicated Logic already have processes to 'activate' an account (this is part of the new account process).

Detection of a security risk could re-invoke the activation process by placing the account in a 'de-activated' state then send an email to the account
holders email account with an activation code / link (existing process).

Clicking on the link / entering the activation code then re-activates the account and the player logs on as usual.

The advantage of this is that most people have fast and easy access to their email accounts, and the effort and cost for DL to implement this is low.

[Jarod "Brickwit" McBrickerton]

True, but the potential problems Fifth brings up are valid too. If there was a way to ensure that players had very secure email account passwords, I think that would be the default idea. But since so many people's email accounts are hacked every day, it creates a big potential for reduced security.

[Event "Janе" Horizon]

True, but the potential problems Fifth brings up are valid too. If there was a way to ensure that players had very secure email account passwords, I think that would be the default idea. But since so many people's email accounts are hacked every day, it creates a big potential for reduced security.

1. If someone's email account is hacked - then I suspect having it linked to a game is the least of their worries.
2. The implication here is that the email account has been hacked with the sole intention of getting access to the players in-game account.
3. A lack of personal security is something DL should not have to address.

[Jarod "Brickwit" McBrickerton]

All are possibly true, but that doesn't mean that the devs shouldn't take it into account either. If they want to assure people that their game is as safe as possible, they need to avoid potentially easy sources for players' accounts to be hacked. And if all it took to take over any rich player's account was a reset email, you can bet your bottom dollar there will be people trying hard to hack that account.

[Event "Janе" Horizon]

The hacker would need to know the following:

• The player's game login
• The player's game password
• The player's email address
• The player's email password

In my humble opinion, the risk that a hacker would have all the above is minuscule.


In addition, this risk is already existing in Alpha:

• If you know the player's email address - you currently can get player's password reset and have a new one given to you by email
  However - you do not know the players login so cannot get login as that player
• If you know the player's login - you can get the player's password reset
  However - you do not know the players email account name nor password so cannot login as the player
  
• If you know the player's login and the player's email address and email password - you can get into the game
  

If a player has revealed their login name and email address and have an easy password and have signed up to an email service that has not implemented simple security features then no amount of security will help.

[Zen "ZenX" Star]

For us, gamers, instant access is important, we dont want to wait to get entry to the game.
Secret question works well, or its equivalents, because it has no real delay, you log on, it says you need to answer question, you answer it and all is normal, it has slowed you down maybe 20 seconds.
Methods that really on external aspects such as emails or devices require you to have that device with you if you are on a different PC, or have your default email already setup and available on the different PC.
This is why Secret Question is really the standard in MMOs for IP change.

I appreciate "some" people would have a resolution to the email aspect, and "some" people would happily carry a device with them, but "all" will be able to answer the Secret Question, again, that is why it is used by other MMOs.
Personally i dont carry a smart phone,( i dont even own a smart phone, i have no need for those aspects) or a handbag with me when out    If i am travelling and i have the game on a laptop i can have email setup but i still dont really want to rely on the email for the ability to play, it still has potential for a problem that can delay entry.

These are just my preferences, i am sure others will have alternate preferences.

Zen