[Announcement About Account Security] Haven/Salem

[btaylor]

Had emails from H&H a few times in the past about my account password asking to be reset. Then a couple of days ago I can't access my email account because of strange activity. I got everything under control, but look at this:



Do you even lift, Latvia?

[Sevenless]

Wonder how long they would take to bruteforce a password called "Password"

bruteforces usually have a set of passwords that are common set at the start of the bruteforce attempt. In other words, it would be taken down almost immediately.

[TeckXKnight]

Brute forcing passwords is all about probability. To save time you hit the targets with the highest chance of being correct -- and so we have extensive lists of the most commonly used passwords.

[dackT-E]

Here is some news you all may be interested in. let me copy-paste the chat i had with loftar earlier instead of me trying to summarize it.

viewtopic.php?f=7&t=31016&start=30#p431095


could someone get links to these names? i know its alot to ask for but still itd make my day easier.

[borka]

what for do you want them?

[Dzedajus]

If you want to try and see why exactly those names were more actively attacked then I think we all already figured it out, at that time they all posted on ICA threads more or less actively, unless you noticed something else.

[Mopstar]

Feels good mang,although I would wonder why my account was tried.Hardly worth the effort

Last time I used the irc was when delamore still played activly I think

[Chemox]

Security questions/ sms confirmation/ ... All those things are possibilities that help against hackers.
Against bruteforce attacks the easiest way is to lock an account after 5-6 attempts and send an reactivation mail to the owner. Telling them somebody is trying to acces their account and that they may have to make their password better.
In order to counter botnets I suggest using IP checking (enable disable by account owners if they have troubles) => Lock an account whenever somebody tries to acces it from outside of the country where the original user logged in.

These are just some ideas
See what you can do with it

[TeckXKnight]

A form of security that I've absolutely fallen in love with is phone verification. If a system/device attempts to login to your account that hasn't before then your phone gets a text asking if that's really you or not. Short of stealing someone's computer or phone there's not much you can do to break past this.

[borka]

The only flaw is the connection between a forum and a Telephone number (which in most cases is connected to Real Name + adressdata) then...

Teck also my Phone would be textspamming me (changing / dynamic IP) - look at qmark... another problem would be those that need to post/ play by proxy ...