Keylog Attack ~How My Story Ended~Follow

There are other information that SE can asked for as a secondary proof before billing information can be changed, but yes I am all for that.

The thing is... a lot of people do play on pre-paid credit (i.e. "web money", they are not even credit cards). It would probably be best some personal information is used instead of some billing information.

SE can do things reduce this from happening, but a big part (in fact the most important part) to prevent such things to happen is end user care of internet security. No one, SE, your ISP, your neighbor, even your dog, can do anything if you install things like Gator on your PC, and type your credit card info on a "Ebay account validation".

That's understandable. Either some personal info could be used instead, or should SE make this change they can put out an announcement encouraging such users to keep their pre-paid credit information from the previous month handy. Should pre-paid credit players (or anyone else) misplace their info, well there are worse things in life than being denied FFXI for a few days.



I agree wholeheartedly with that, and I did not intend for my post to cast all of the blame at SE's doorstep. My post was simply prompted by my surprise at how religiously SE treats current credit card info, yet how easily such info can be changed.

1. No I have not posted yet.

2. I have read every post in the thread and have been following it since yesterday.

3. I think we can all agree that the blame game is not really serving a purpose.


I think we can also all agree that SE's policy about this needs some revision to protect the player base from this in the future. We can protect ourselves but there needs to be some safeguards against this sort of thing. This would also make it harder for people to steal accounts that someone foolishly shared thier contact info.

To the OP please keep us posted on the status of your account. I hope all is resolved and you get your character back. It sounds like you were a valued member of your server and it would be a loss to the FFXI community for you to lose everything. Best wishes from me for a positive resolution.

I can see a simple and easy fix for S-E for this. Just like the banks use to add an extra level of security to their accounts when using online features.

Ask a series of three questions of which the answer ius supplied by the user and save them to the PoL servers. For example.


What is your mother's maiden name:

What is the name of your favorite Pet:

What city were you born in:

etc etc. Typically a person selects a series of three questions, choosing one out of a list of 4 possible to choose from in each and answers it. They then are shown the answers and confirm them and they are saved to the online server.

Whenever the user wants to change the information attatched to the account, such as home address or billing or password the bank asks the user to verify these 3 questions. If they cannot verify them and keep trying the account is locked and requires a customer call to the bank's service reps to reopen the online transactions.


Why can't s-e do this? This would be 100% keylogger/hacker fool proof because it adds a level of scurity to the system that ONLY the creater of the account knows. Sure a keylogger or virus can hack information stored on the client side, such as passwords and account ID's, but they cannot hack the server side information which would be the answers to the three questions. And they certainly cannot hack the users brain. So with this safeguard in place even with the current info a hacker is unable to alter data because they don't know the answers to the security questions.

Why is this so hard to implement? Why does s-e give such a lame *** response to the situation? I don't know. But I think its a very easy fix, and one that has been in place for a very long time. Banks and websites use it all the time, why can't s-e?


Edited, May 17th 2007 4:54pm by Melphina

It's a good thought, but it's not going to add any security because it's trivial to monitor the clipboard content (the container of copy/paste data) in addition to keyboard input.

Or possibly somthing like this:

"We regret to inform our players that as a result of a recent court case we are forced to suspend FFXI in North America. We apoligize for any inconveniance this may cause"

SE might be petulant bastards and just stop supporting the game rather than be forced to fix their crappy illegal policy on identity theft.

This post saddens me. My heart goes out to the OP.

And, I'm scared. I have other FFXI users that access the
game from my PC... what if they infect my computer? I don't
have any high level characters but I have worked hard for what I
have.

Yes, I run a virus scan and a firewall. But is that enough?

Also, I'd like to re-address the privacy issues. What information
was available to this individual that hacked the account?
Do we need to worry about our identity being stolen also?

I think we need a response from SE about this issues and the protection
of our privacy. I think we should demand it.

Surely there are many questions about this account that only the OP
could answer. SE should investigate this further.

SE, I'm waiting for your response. It will decide my future with a game
I love dearly.

So its ok for people to prey on the old and simple minded because they werent smart enough to catch the Scam artist tactic is that what your suggesting? who's Sock are you anyway?

Normally, I would suggest a week long boycott...

SE's customer service is an F at the BBB (as has already been noted).

The only way to get them to see a problem is to SHOW them there's a problem.

If they were to suddenly see the amount of people drop off for a significant point of time, and everyone were to call up with complaints as to how they are being handled, we might see some action.

Sadly, boycotts will never happen though as there'd be a large group of @%%@ who would just see this as an opportunity to camp a NM.

I do think, though, that everyone should contact SE with their complaints in this matter. I have.

No ones saying it's OK, but go after the perp, not SE. All they do is host the game.

That's like getting into an accident with another car and blaming the city cuz you were driving on their roads. Christ people.