Hacked today. Certainly on GGG's end.

"

GGG dont seem to stand up against all these people accusing them of ruining there gaming experience where its 99% of the time on the players fault and they just whining like little kids.

"

bluelightningflik wrote:

Just adding to the flood. My username and password combination are entirely unique to this game. And, like most players, I haven't typed the username and password in anywhere since initial install weeks ago. This is on GGG's end, in that somewhere they are storing credentials is not secure. Will not be playing until GGG has an acceptable solution in place, inlcuding recompense for those of us who are victim to their shoddy security. Very disappointed with their current handling of the situation.

"

lagwin1980 wrote:

"

bluelightningflik wrote:

Just adding to the flood. My username and password combination are entirely unique to this game. And, like most players, I haven't typed the username and password in anywhere since initial install weeks ago. This is on GGG's end, in that somewhere they are storing credentials is not secure. Will not be playing until GGG has an acceptable solution in place, inlcuding recompense for those of us who are victim to their shoddy security. Very disappointed with their current handling of the situation.

http://news.cnet.com/8301-1009_3-57563337-83/java-flaw-draws-web-attacks-reports-say/

Have you bothered disabling java for your browser...that's like a month old and still no one seems to know about it.

Your PC is never truly secure...why do you think anti viruses update practically daily?

"

bluelightningflik wrote:

"

lagwin1980 wrote:

"

bluelightningflik wrote:

Just adding to the flood. My username and password combination are entirely unique to this game. And, like most players, I haven't typed the username and password in anywhere since initial install weeks ago. This is on GGG's end, in that somewhere they are storing credentials is not secure. Will not be playing until GGG has an acceptable solution in place, inlcuding recompense for those of us who are victim to their shoddy security. Very disappointed with their current handling of the situation.

http://news.cnet.com/8301-1009_3-57563337-83/java-flaw-draws-web-attacks-reports-say/

Have you bothered disabling java for your browser...that's like a month old and still no one seems to know about it.

Your PC is never truly secure...why do you think anti viruses update practically daily?

If GGG is storing cached password on the client machine in a way that can be both scraped and deobfuscated (as some posts in this forum have posited) by any program including a java hack, that's absolutely GGG's problem to fix. Either way, this requires the player to have visited a site that ran this exploit. This is something that I can say has not happened to me, and also something that the community would likely have noted by now and be able to point people towards directly.

"

Asonex wrote:

I actually have worked in IT, and I know a few things about Internet security.

Saying GGG was "hacked" is just completely nonsense.
All of the hacked accounts are on the client end, and GGG has even stated that every thorough investigation into this has proven so.
Although it is true that certain ways GGG has built their game allow for easy "hacking" of clients. The password being clearly saved in the config file being one of them.

There are new key loggers and vulnerabilities being discovered and patched every day. To be confident that you weren't exposed to one, is to be ignorant.
The only way to be mostly safe, would be to run your gaming computer and gaming account on a separate computer, and have a different account for logging into the forums and browsing the Internet.

So, just have some maturity, and take responsibility for the fact that SOMETHING got you. Whether or not you know what it was, or if you like it.

"

bluelightningflik wrote:

"

Asonex wrote:

I actually have worked in IT, and I know a few things about Internet security.

Saying GGG was "hacked" is just completely nonsense.
All of the hacked accounts are on the client end, and GGG has even stated that every thorough investigation into this has proven so.
Although it is true that certain ways GGG has built their game allow for easy "hacking" of clients. The password being clearly saved in the config file being one of them.

There are new key loggers and vulnerabilities being discovered and patched every day. To be confident that you weren't exposed to one, is to be ignorant.
The only way to be mostly safe, would be to run your gaming computer and gaming account on a separate computer, and have a different account for logging into the forums and browsing the Internet.

So, just have some maturity, and take responsibility for the fact that SOMETHING got you. Whether or not you know what it was, or if you like it.

You use quote marks incorrectly. I never said with complete certainty that GGG was "hacked". Just that they have something that needs fixing on their end, that they store credentials in an unsecure fashion.

I don't just "work in IT"... I'm a professional web/client dev that has worked for years on products used by many times more users and targeted by many times more hackers than PoE (statistically speaking) even could be, let alone by any other metric. This is wholly unimportant, except for the fact that it means you can be pretty certain that when I say that my machine is as secure as any machine used for such purposes can be reasonably expected to be, I know what I'm talking about. For you to assume otherwise is what's ignorant, and counterproductive.

The only possible ways for my hack to have occurred is either:

1)GGG caches passwords in an unsecure fashion on the client, allowing for a (very doubtful in my case) java client scrape hack from sites not directly related to PoE, OR
2)GGG has security issues not related to the client

And, to be honest, it really doesn't matter to me whether or not you can understand this, it matters that GGG understands and addresses this.

And I'm an exceptional case. GGG cannot makes the assumption they can make with me with 99% of their users. Their current approach for this issue is untenable.

So, just have some maturity, and take responsibility for the fact that this is indeed an issue and one that is currently not being handled acceptably.

"

bluelightningflik wrote:

"

Asonex wrote:

I actually have worked in IT, and I know a few things about Internet security.

Saying GGG was "hacked" is just completely nonsense.
All of the hacked accounts are on the client end, and GGG has even stated that every thorough investigation into this has proven so.
Although it is true that certain ways GGG has built their game allow for easy "hacking" of clients. The password being clearly saved in the config file being one of them.

There are new key loggers and vulnerabilities being discovered and patched every day. To be confident that you weren't exposed to one, is to be ignorant.
The only way to be mostly safe, would be to run your gaming computer and gaming account on a separate computer, and have a different account for logging into the forums and browsing the Internet.

So, just have some maturity, and take responsibility for the fact that SOMETHING got you. Whether or not you know what it was, or if you like it.

You use quote marks incorrectly. I never said with complete certainty that GGG was "hacked". Just that they have something that needs fixing on their end, that they store credentials in an unsecure fashion.

I don't just "work in IT"... I'm a professional web/client dev that has worked for years on products used by many times more users and targeted by many times more hackers than PoE (statistically speaking) even could be, let alone by any other metric. This is wholly unimportant, except for the fact that it means you can be pretty certain that when I say that my machine is as secure as any machine used for such purposes can be reasonably expected to be, I know what I'm talking about. For you to assume otherwise is what's ignorant, and counterproductive.

The only possible ways for my hack to have occurred is either:

1)GGG caches passwords in an unsecure fashion on the client, allowing for a (very doubtful in my case) java client scrape hack from sites not directly related to PoE, OR
2)GGG has security issues not related to the client

And, to be honest, it really doesn't matter to me whether or not you can understand this, it matters that GGG understands and addresses this.

And I'm an exceptional case. GGG cannot makes the assumption they can make with me with 99% of their users. Their current approach for this issue is untenable.

So, just have some maturity, and take responsibility for the fact that this is indeed an issue and one that is currently not being handled acceptably.