@ Chthon: I have to agree with Fril that you probably don't want to go there.
Quote:
Originally Posted by upier
This isn't so much about pissing all over A.Net. This is more about us knowing that is potentially unsafe behaviour and as users it's best to refrain from it.
|
As I see it, there are presently three problems to overcome:
1) Players are unaware of the identified problems with NCSoft accounts.
This has been a topic of somewhat muted debate for months, if not years. The volume of reports of accounts getting hacked via password reset using the NCSoft account, coupled with the fact that many of these reports cannot be explained well by the usual keylogger/trojan source of hacks, is what has pushed the topic onto the front burner. Most players were not following the original discussions about possible vulnerabilities. The last two weeks have changed that somewhat, but I suspect that the vast majority of players still are unaware. Hopefully, the word will spread.
2) Convince NCSoft/ANet that these problems will cost them more if left unresolved.
It will cost them resources to fix the issues that have been raised. That costs money. This is at the heart of why the problems exist in the first place. We want perfect security, but it costs too much to be feasible.
Many of you posting here are dancing around this issue. You suggest boycotts and announcements as the way to address this problem. Neither will work; there's ample evidence and quality economic theory to tell you otherwise. What NCSoft needs to understand is that hacks kill MMORPGs. It doesn't matter whether it's hacking the client to dupe/scam/etc. or hacking players' accounts to loot them. Such hacks undermine the reasons why many of you still you log in - to accomplish something in a virtual world. If you can't trust that your efforts won't pay off, you won't play or make future purchases.
Account thefts are even worse for an MMORPG, because players certainly aren't going to spend money to add things to their accounts when they fear having the account taken away (again). That undermines the revenue model.
Now, NCSoft might argue that GW is a dead game from which they derive no revenue, and that it therefore doesn't make sense to fix the problems. However, if these problems are left unresolved, then what is happening now will likely seem a child's prank compared to what will happen at the release of GW2. Delaying fixing these issues will only convince players that they cannot trust the company they are doing business with to care, and abusing that trust is likely to lead to lost future sales.
3) ANet's communications with us.
Gaile and others don't seem to understand that their communications are less than reassuring. Let me put this bluntly. The players cannot discriminate between the following motivations for the continued stance that hacks are our fault:
a) Gaile is being truthful, and ANet has valid evidence that proves that the NCSoft accounts are not a matter of concern.
b) Gaile is being lied to by the security staff or by managers relaying their communications.
c) Gaile is being told to lie by Legal, Marketing or both.
d) The people managing the security of NCSoft accounts are incompetent.
We know that admitting that the breaches in account security are the fault of ANet/NCSoft might be costly, so there are incentives to lie. We also know that the people in charge of NCSoft security, if incompetent, don't want to admit it for fear of their jobs. So there are incentives to lie there as well. In the absence of evidence that shows that the NCSoft accounts are not the problem, anything from a) to d) could be true.
If a) is true, I understand why you do not want to release such evidence for public consumption. However, you need to realize that in the absence of evidence, we're going to rationally believe that b), c), or d) could be true and that your protestations that a) is true are wasted effort. The evidence that we observe suggests that it very likely is not true.
Moreover, your past commentaries suggest that you do not understand the problem. You have posted on the wiki that your investigative strategy is to find the common thread that links the account thefts together. However, it is a virtual certainty that you have multiple individuals, likely with different strategies, attacking the integrity of game accounts in multiple ways. If you're looking for an archvillain behind it all, you're going to discard correct hypotheses about how accounts are being hacked due to evidence that doesn't fit your approach.
The combined effect is the impression that you don't understand the problem and don't care about your players. I know that this is not the impression that you wish to leave with us, but it is what I take away, and it appears to be what others are taking away judging from their posts.
Such as case would not only be unwinnable in the US, it might even be considered frivolous and result in fee-shifting and sanctions for wasting the court's time. In the US, a defamation claimant must prove the falsity of the allegedly defamatory statement. Moreover, for pressworthy matters (and this is one), the claimant must not only prove the statement was false, but also that it was uttered with actual knowledge or reckless disregard for its falsity. Is NCSoft ready to prove their lax security isn't responsible for a large chunk of recent account thefts? (And that a person couldn't reasonably believe they were responsible given the available information?) After American-style discovery proceedings? I very much doubt that.
