Someone at 74.132.216.39 attempted to reset your PlayNC Master Account password
for account *********. This attempt was unsuccessful. If you did not attempt this
change, please contact support immediately at [email protected].
got this same e-mail maybe 30 times on the 20th July, gg
Note: i lost all my stuff in november of last year and didn't get anything back, i'll be ****ed if it happenes to me again.
30 times?
...
I would hope it would not allow it after 3-5 failed attempts..or something. It scares me to think they could just keep trying til they got it right. o.O
30 times?
...
I would hope it would not allow it after 3-5 failed attempts..or something. It scares me to think they could just keep trying til they got it right. o.O
Welcome to minimal account security. If they do **** you though, it's your fault, typical NC.
OrgName: INSIGHT COMMUNICATIONS COMPANY, L.P.
OrgID: INSIG-7
Address: 10200 Linn Station Road
Address: Suite 125
City: Louisville
StateProv: KY
PostalCode: 40223
Country: US
There you go, go get them. Oh wait you can't its not your server, so you are going to be ignored if you report the attempted password hacking to them, NC must make the reports.
Someone at 74.132.216.39 attempted to reset your PlayNC Master Account password
for account *********. This attempt was unsuccessful. If you did not attempt this
change, please contact support immediately at [email protected].
got this same e-mail maybe 30 times on the 20th July, gg
Note: i lost all my stuff in november of last year and didn't get anything back, i'll be ****ed if it happenes to me again.
Why would anyone know your account name and birthdate in the first place?
Why would anyone know your account name and birthdate in the first place?
You dont need birthday for reset your password.
About account name, sure he put same name on his char :P it happens all the time.
Its a shame they can try automated diccionary attacks without a limit of fails x day. This is a fault in security EULA. Fix it, it´s just about change a variable. More than 10 fails its stupid and insecure.
Why would anyone know your account name and birthdate in the first place?
Maybe his account name matched one of this char names, very common mistake people make with their accounts. Or possibly someone else made a character name matching his characters name. Hackers commonly use this to strip game accounts.
As far as birthday, doubt it takes them more then 2 minutes to run a **** script checking the all the possible birthdays. Go look, see how easy it is.
That really is pretty BAD security when you think about it. If you know someone's account name and are determined enough...you can **** them. There's only 365 possible birthdays...trying em all wouldn't be an impossible task.
Why would anyone know your account name and birthdate in the first place?
You dont need birthday for reset your password.
About account name, sure he put same name on his char :P it happens all the time.
Its a shame they can try automated diccionary attacks without a limit of fails x day. This is a fault in security EULA. Fix it, it´s just about change a variable. More than 10 fails its stupid and insecure.
Yes you do need your birthdate to reset the password. Go try it, it asks for your birthdate then you are able to change your in-game password, and if your trying to do the forgot password for plaync account it asks for the birthdate and then gives you the secret question.
There's only 365 possible birthdays...trying em all wouldn't be an impossible task.
And then there's the year. That will make it much more difficult. Much more than 365, by a long shot.
Really doesn't matter, you'll get most "average" players age in under 2000 tries, at worst about 30,000. Trivial for modern desktop PC. Without any sort of image verification and account lockouts on multiple failed tries, why even bother having it there? You're also not warned when someone is failing your birthday (ie no email).
Smartest thing anyone can do with this system is make their secret answer extremely complex, a secondary password, and use all 32 characters. Unfortunately most will make their secret question something familiar and easy to guess.
yeah but on a diffrent forum from this one people pretty much know how old i am so the dates that they would have to guess would be limited. Even so, maybe an e-mail sent to you to confirm that you want to have your password changed or something would stop these issues.
Great tool, so many people attempting to **** my servers, constantly having to trace them. 99% of the time it gets you no where, but every once in a while you hit a person who is like, wow thanks, our server was hacked and used to attack yours, we will fix it. :)
I agree they need to increase the security. Anyone who has changed their password can testify the ridiculous risk involved if information got into the wrong hands. And you cannot defend yourself if it does. Once it's out there you are done for. I would really like to see a Link Confirmation through the email system. That way only the person with access to the registered Email can complete the change.