This was posted on blah, but some of you may have not seen it lol, read from the bottom up.
Response (Brad)08/06/2006 09:24 AM
Greetings Charlie,
We apologize for the earlier response.
Thank you for writing us with your feedback and suggestions! We always appreciate hearing from our players. The Lineage II Development Team is continually making changes to improve the game, and looks at your feedback very closely to make this happen. Please note that in addition to writing us, you should always feel free to post your constructive opinions/feedback/suggestions on the Lineage II message board (
http://boards.lineage2.com) where your fellow players and the development team will be able to view them first hand.
Regards
**************************************************
**************************************************
Customer (Charlie)08/06/2006 06:00 AM
Did you actually read what I sent you guys ?
My account is fine, I have had no trouble resetting my password, I am meerly pointing out a security flaw in the account system.
**************************************************
**************************************************
Response (Joe)08/06/2006 04:32 AM
Hello Charlie,
Thanks for sending this in to us. At this time we need to verify that this is indeed your account. In order to assist you, we will need you to verify the following information:
-- What first and last name did you use when you created the account?
-- What physical address did you use when you created the account?
-- What date of birth did you use when you created the account?
-- What are the 20-digit serial codes for all games you added to the account?
-- What is the Unique Account ID for the game account you are referring to? (This was sent to you via e-mail on the date your game account was activated with a subject header of 'Game Account Activated'.)
Again, thanks for your time and patience as we work to resolve this issue for you.
**************************************************
**************************************************
Customer (Charlie)08/04/2006 02:14 AM
Its come to my attention that there seems to be another fairly large hole in your security, sepcifically, the verifying of a users birthday when attempting to change their in-game password.
There is no limit on ammount of attempts before a lockout is issued on the form, nor is their an image verification.
This leaves open to an attack from a very simple script that can run through all the dates in the form in a matter of minutes.
To alleviate the problem, a lockout timer, for example...cannot attempt to guess the date of birth for 12 hours, once 5 attempts have been used...and an image verification on every attempt, example...a randomly generated image that needs to be typed into a form and sent to a server for authorisation, would both increase the security on changing peoples passwords a whole lot stronger.
If you can guess someones secret question, all it takes to change their details is to guess their date of birth..and thats not hard, hence this letter.
Just pointing out a flaw in the system, while you are in the process of upgrading software re: security.
Shouldnt take much to get that up and running