Administrivia: Some new account security options

[boshaw]

Very nice feature. I did find one issue, but it's out of the realm of normal proper use I guess, but may be useful for other people who are looking to do more stuff with this system. If you generate a token without any TokenInfo (id, desc) then you can't remove it under Account Security . It'll flag it with:

Code: Select all

Missing parameter
The query parameter `tokenid' is required but not supplied.

When trying to remove said token. Not a big issue though as you have that limit of 5 so I can just remove is by making more tokens I'd imagine. It's very nice you have that description field though as it makes it easy to track their purpose.

[TheServant]

Cool!

[maze]

To be clear, I don't think all cases of character-sharing are bad. Just which ones are and aren't can certainly be debated, but I don't think it's an intrinsic evil. By far the main problem is sharing of accounts, moreso than characters per se. That's not to say that sharing of characters is entirely unproblematic, both in terms of game mechanics and in terms of security, but we have in fact lightly considered implementing some form of more formal sharing of characters between accounts at times. It's more complex than it might seem at first glance, though, the aesthetics of it are less than obvious, and we do have higher-priority items to work on, but it's not entirely off the table.

I'm not sure I want to be seen as encouraging account-sharing by implementing the suggested changes, but it could at least be a step forward, and I could consider implementing it if only to better support custom clients. I'll have to think about it, and also have no lack of things to work on for the reset, but I'll keep it in mind.

it would be honestly awesome if you did ever Implement this feature.
I understand there is tons of other issues that come with it, but it would be an amazing feature.
On just a personal level I share accounts and alts with my girlfriend (Farmer, Cook, and so on)

But I think this might show you that there is another problem with the current system

[Zbyx]

How about making two passwords per account instead ? Password Nr1 has limited access (lets say only can use it to log-in to character in game) and 2nd password unlocks all the other options like email change,forum etc.
More comfortable/easier than sending files.

[iamahh]

after last merge my small mod client was crashing after login at Message.java

Code: Select all

Cannot encode a class [Ljava.lang.Object; as TTO

so I checked history and readded this if

Code: Select all

else if(o instanceof Object[]) {
      adduint8(T_TTOL);
      addlist((Object[])o);
      adduint8(T_END);
       }

seems to be working ok now, but I have no idea why vanilla worked, maybe it still had the if code?

[Valnar]

If character sharing was a thing to be allowed, one way to implement that could be granting other accounts to have certain permissions on a main account.

Like let's say I have 2 characters on my H&H account, Valnar & ValnarAlt.

Then let's say there is another person named bob who has another H&H account.

I could add bob to have certain permission on my account (be like a sub-user of my account) such that they are able to login only to ValnarAlt as if it was one of their characters.
Maybe while they are logged in, they can hold a lock to that character that could only be broken by me (or maybe a higher level of permission user).

This way, you can share characters without ever having to get near to exchanging any account details beyond username or maybe some other public identifying token of an account. That way you don't encourage sharing passwords or even login tokens.