Dev Blog: Security: Different times - Different ways

@CCP_Guard @CCP_Peligro are you looking at Market Bots too…? the major trade hubs feel completely infested with bots

2 Likes

Here is my idea…

Non-transferable Permanent Bot-Squad skin license for every account that is using 2FA.

The Skin is a carrot and has to meet the following conditions for the desired behavior to occur.

  1. Permanent unless the person disables 2FA on the account
  2. Non-transferable, not an item that can be listed or sold.
  3. Must work for most if not all ship hulls, it’s an all or nothing type of incentive.
  4. Must be something unique from other current skins and stay that way, ideally having a police or security theme with frills and frippery evocative of the subject matter.

Achieves nothing.

A SKIN doesnt prevent you from botting, and most, if not nearly all of hijacked accounts are inactive anyways (as far as the original owner is concerned).

CCP doesnt care what SKIN you use.
They dont/cant detect botters or hijacked accounts based on that either.

Xenuria is offering an incentive to encourage players to use 2FA… nothing more. Perhaps “bot squad” is not the best name for it, that’s all.

I think you completely misunderstood what I said. The skin dosn’t prevent botting. The skin is a reward for using 2FA. 2FA makes it almost impossible for an account to get hijacked. Less accounts being hijacked means workload of CCP Team Security can be shifted more to preventing and banning botters.

In an ideal world Team Security wouldn’t have to worry about hijacked accounts at all because everybody would practice good opsec, use 2FA and complex unique passwords for each and every account. They would be able to focus primarily on exploits and botters.

If I am a hypothetical botter the last thing I want is for CCP Team Security to have a bunch of extra time and resources on their hands. I want them to keep being focused on hijacking and fixing peoples accounts after a hack.

So that is what my idea is aimed at doing, freeing up a large portion of time and resources for CCP Team Security by means of behavioral modification. Even if only 25% more people enable 2FA that’s a huge damn win.

Im far more cynical than you.

In my view the majority of “hijacked account” reports to CCP are infact botters/RMT cycling accounts amongst themselves. Its not coincidental this has increased since Alphas.

Example:

  • “CCP why did you ban my account for botting? It wasnt me!”
  • When infact it was that account holder sharing account details, against TOS/EULA, of their own volition.

I promise you, the actual legit rate of account hacking/hijacking is far, far lower than the rate of botters using it as an excuse.


Let me explain:

If I could hack/hijack someones account, the first thing I would do, is stripmine all the SP, assets, isk and characters off it before the original owner returns, and maybe even biomass it to purge evidence.

I wouldnt start botting with it, or playing with it.

Wouldn’t you do the same?


In other words, this isnt really an issue of hacking/hijacking/2FA.
Legit hacked/hijacked accounts are stripmined and biomassed, ASAP.
Its an issue of botters/RMT lying to CCP, to re-institute suspect accounts, under the pretense of having been hacked/hijacked.

Ankama Games has a choice of 2 additional security programmes.

1st a shield which is basically you authorising your computer to access the game, if anyone tries to access it from anywhere else, including the account holder you go through extra security questions regardless of you knowing the password.

2nd is an authenticator linked to your mobile phone via an app into which you enter your passwords and account name for each account you own. So when you try to log on you have 30 sec to open the app and unlock the log in. it’s just a button that opens a timer for each account.

When you first download the app you’re given a unique code to enter into it, a code that will only ever be issued once so you better not lose it as it’s used to open the app if you lose your phone and have to download it again.

It sounds like a pain but you soon get used to having the app open and ready.

LOL at 3 day bans for 1st offense. 30 days, or why bother?

1 Like

Doesnt make sense.

CCP said they want to crack down on botters, yet they reduced a 30 day suspension, to 3 days.

Even if everything you say is true, a scenario in which more people use 2FA adds increased difficulty to both account sharing as well as hijacking and botting and rmt.

2FA is an inconvenience to the end user otherwise everybody would use it. You have to make that inconvenience pay off in more than just added security.

Sure. Fine.

A SKIN that you get for an account going 2FA.
Why not. Its not going to hurt.

My point exactly, it hurts nobody and benefits everybody.
You trade the minor tedium of 2FA for something only 2FA people can ever get or use.

You make it harder for bad people by >0% to do bad acts.

Peer pressure and normal social behaviors perpetuate a momentum that coerces others into using 2FA. At which point the only people left not using 2FA fall into 2 categories.

A. People that were never going to in the first place for misc reasons
B. People who share accounts, like alliance directors, FCs and other people who feel the rules shouldn’t apply to them.

The people in B. have really good opsec so their chances of being impacted by hijackers is already pretty low. CCP also dosn’t need to support them in the same way if they are account sharing.

The people in A. were never going to be reached anyway. A is a very very small group.

Its just a SKIN.

Its not going to fix problems.

I think you underestimate the impetus that is player ego. This dosn’t even have to do with eve perse. This is basic entry level psychology.

It’s not as complicated as some people are going to try and make it seem.

A SKIN isnt going to make people go 2FA.
Botters have no incentive to do so either (infact they dont want to, cos more data to CCP to trace them)

As I said earlier, account hacking/hijacking is mostly a result of account sharing.
Its very, very hard to hack/hijack someones account, even without 2FA.

That’s kind of the point my good human…
Behavioral factoring around 2FA cuts through more fog and makes it more obvious who is up to no good. Try not to get hung up on the idea of the skin it’self and instead think about it like a flood light that shines on a bad area of tama.

It dosn’t prevent bad things, it reduces their occurrence.

1 Like

CCP cant hold accounts that dont activate 2FA as anymore likely to commit illegal acts ingame, than those that dont.

Not choosing 2FA is no indicator of a current illegal player, nor a future one.

I don’t think anybody has said that but you.

Yes, I, said that. I dont need anyone else to have said it.

What is the fking point?

If you aren’t understanding the point or the goal behind a system like this than I can recommend some light reading for you. At the risk of sounding mean I don’t feel like repeating myself when you can just scroll up and read.