[HACKING IN PROGRESS] i got 100 mails about "reseting password failure" from NCsoft

Originally Posted by Gaile Gray

9/20/06
A few days ago, GWG forum members made us aware of a possible problem with PlayNC account security. It seems that a few accounts were stolen, and the concern was raised that the thefts may have resulted because of a shortfall in security through the PlayNC system.

I don't want to get into the mechanics or the details, but I want to thank the forum members who reported this problem, and I want to apologize if any of you felt that you weren't helped as immediately nor as thoroughly as you might have been in the initial stages. I want to express thanks to one member in particular (whom I won't name right now, but you know who you are!) who provided very helpful and detailed information which we used to track down the matter. And you will be interested to know that the appropriate action has been taken on more than one of the accounts of those responsible. I am not at liberty to reveal what that was, but knowing action was taken, and the accounts identified, is probably of some interest to you.

As a matter of fact, these thefts were made possible through a combination of errors. I know that GWG has made a change that will prevent the acquisition of information. And you will be pleased to know that there is a major change in the PlayNC system coming within a matter of days. Protocols are being put in place that will greatly reduce--perhaps even make impossible--this particular kind of account theft. That is not to say that all account thefts will be rendered impossible--we could only wish! But the three or four that we know of which were a result of this recent situation will be far less likely to happen in the future.

Here are some tips I'd like to share with you:

• Use a unique account name. If you're using an email address to conduct matters that must stay secure, use an email address that you do not reveal to others. So use one "private" address for matters that require a high level of privacy and security, such as game accounts, online banking, and so forth. And then use a completely separate "public" address for correspondence, on-line trades, chat rooms, online message programs, forum memberships, etc. Stop and ask yourself: When I'm idling in IRC, is everyone in the world seeing my bank user name? My GW Account name? When I add someone to my IM list or when I post in a forum, are people learning more about me than I really want them to know?
• Come up with a complex and unique password. Use symbols, if allowed. Use upper and lower case. Toss in some numbers, but for goodness sake, don't use your birthday or other easily-found things. (See below about birthdays.) Try to not use the same password for everything. (This is called mitigating disaster; it's sort of like diversifying your portfolio. If one stock crashes, they don't all crash. If one account is stolen, not all are stolen. )
• Do not reveal your Guild Wars account name to anyone. If you are conducting a trade, use your "public" email for that, never, ever your Guild Wars user name. No one needs your user name or your PlayNC account name, ever! If you want to meet in game, give them a character name. If you want to correspond, use that "public" email address and keep your private one private.
• Do not reveal your birthdate. Sure, it's fun to have people know when it's your birthday, but it may be smarter to not make that known. A lot of contests ask for your birthday to verify your entry, so it is hard to not reveal this, at times. Heck, even the Guild Wars championships require birthday information! Maybe the best suggestion is simply to keep this info reasonably private and, if you reveal it, do not reveal it at the same time you're exposing that private email address.
• Take the usual privacy provisions. Keep personal information to a minimum on forum profiles. You can't be sure what a bank, credit union, mortgage company, or anyone else will ask to "verify your identity." Some ask things that could be found by someone rifling through the recycling on your curbside! (Yay, shredder!) Anyway, because you can't predict what you'll be asked for account verification, keep profile information to a minimum. General location, sure! But do you really need to mention online that you live on Maple Avenue in Anytown, USA? That your Zip Code is 12345? That your mother's maiden name is Smythkowicz, or that you were born on a sunny Sunday in April of '86 at St. Chuck of the Perpetual Smile Hospital in Upper East Midlothian? Think about it: TMI!
• If you are given the opportunity to come up with a security question, make it matter! Don't ask something silly like "How do you spell cat?" Don't ask the same question for every account you own. Don't make it a question for which there are only a few answers. "What's your favorite colour" is lame! Well, unless you really know the differences between purple, amethyst, lavender, orchid, lilac, aubergine... The truth is, there are usually only 6 or 8 answers to that colour question, so someone could "hack" that one pretty simply by just going through the Red-Orange-Yellow song. For your security question, come up with something obscure and something hard to guess.