Previously on How To Murder Time! “…Information security is one of those tiresome airy-fairy subjects until something goes wrong on your own patch…”
And now the conclusion! In rather predictable fashion I’ve now become a little bit RAGING PARANOID about online security and passwords as a result of it all, although it is somewhat reassuring to note that it wasn’t just me, and news sites seem to now be picking up on what turns out to be a fair sized rash of identical hacking stories to my own:
Eurogamer: XBL accounts hacked to buy FIFA packs
Ars Technica: As Xbox Live-FIFA 12 fraud continues, Microsoft’s response becomes maddening
Giant Bomb: Microsoft, EA Claim FIFA Isn’t Causing Rash of Xbox Live Hacks
Lots of mealey-mouthed damage limitation fluff from EA and MS there “We don’t comment on security”, “Don’t give out your passwords”, and so far, my own account is still suspended and under investigation (at my own request), and I’m still £60 out of pocket on the credit card.
My raging paranoia hasn’t been helped by receiving an unrelated email from Turbine, telling me that they think their forums were just hacked, and would I like to think about changing my password?
The nature of the medium throws doubt and uncertainty on the innocent and the victim. “Are you sure it isn’t your fault somehow?” they ask. Well, I was, but now I’m not so sure, hence my newfound paranoia, and associated Twitter ranting. It’s a vicious spiral of distrust which eventually ends up with me demanding to be paid my salary in gold nuggets, which I then stuff under my mattress, in my house that I never leave!
Get a grip, I hear you think, and indeed, that is the trick. Somewhere between just tweeting my bank details and hoping everyone only takes what they need, and becoming some shotgun-totting backwoods hermit who fears electricity and hates government, there must be a middle ground, combining caution and usability, suitable for continuing to usefully live in an increasingly online digital age.
I can’t do much about the original problem itself, squarely an EA/MS fault, but there were things I could have done differently and better. Here are some security tips I’m currently implementing which should help stop this kind of thing in future. Many of them were suggested by Askgar in previous comments! Feel free to add your own or dispute these – only YOU can stop me being robbed again!
Unique Usage Passwords
Use a different password for every online service. It may help to use a different account name as well. The reasoning here is straight forward. If, to pick a random example, EA are flipping idiots and just give out Xbox Live passwords to anyone who phones them up and asks nicely, then that’s bad. The Xbox Live account is in for a clearing out that its legitimate owner won’t forget in a hurry!
Much worse though, is when that Friend of Humanity goes on to successfully log into PSN, WoW and your bank with the same details. It makes sense to try the login on multiple similar services, because some people are lazy, or just have trouble keeping forty or more different usernames and passwords straight in their heads.
I did this a lot, but have now made them all unique. I’ve re-learnt how to write letters with a pen, and now I keep them in a physical book. Old-school! I’m in trouble if my flat is burnt down or robbed, but it’s more about making disaster less likely, than removing it altogether. They might take the PC, but probably won’t take the innocuous looking book under the pile of junk on that other shelf.
Particularly important with peripheral systems; forums, fan sites, etc. While Triple-A MMO Corp may have watertight security, do you really know or trust amateur owner-admin of Triple-A MMO Fansite dot com? I don’t. Using the same password for both makes the MMO’s security dependent on the integrity of the fansite owner. If you’re happy that everyone who ever asked you to create a password online is to be trusted, then you can probably ignore this one.
Strong Passwords
See XKCD comic here: http://xkcd.com/936/
Long beats complex, although in my recent paranoid password reset adventures, it’s dismaying to see that some online systems have password length limits of as little as eight characters. In these cases, use them all, and go with the punctuations and numbers, as suggested. EVE Online wins here with a staggering 64 character password limit. I approve!
Online systems could do more to improve this, but within reason. Runes of Magic wins the HtMT Ultimate Security Award here. On my recent attempt to retry the game, I went through all the forgot/reset password stuff to get back in after long absence, only to find it then wants a second password at character select, the resetting of which proved to be so bureaucratic and awkward that I gave up and will probably never play it again! I wish I’d written that down two years ago, and it does illustrate the dangers of security, which can become so secure even authorised users are kept out!
Remove Payment Methods
This one is what got me. If my XBL account didn’t have a permanent set of credit card details saved as part of itself, the Friend of Humanity would have just stolen 120 leftover MS points I wasn’t using anyway and then moved on, rather than gone on a 6120 point spree. I’d still be cross, but would not now be distrustful of all online payment as a whole. This is because online shops value One-Click Impulse Purchasing over security and this should not be encouraged.
Of course it suits Microsoft for me to be able to give them money by just pressing ‘A’ four times. (I’ve heard stories of six year olds, and dogs, racking up huge bills because of this sort of nonsense.) However, it doesn’t suit me that someone pretending to be me can steal £60 from me by just pressing A four times, thanks to their own flawed security procedures.
It’s not just MS though, and it is telling that in Turbine’s account management pages, upgrading to a subscription or buying Turbine Points is a one-click operation, but to remove attached credit card details, (because, to pick an example at random, their forums have just been hacked), requires a string of grovelling emails, and probably will each time I want to buy stuff from them in future.
In a sensible world, we should be required to re-enter our details every time we want to actually buy a thing, after which, those details should be deleted. It’s more awkward for us, but serves to disconnect automatic links which can be easily abused, as I found out to my cost. As it is, I am not happy with online services having my credit card details any longer than is absolutley necessary to make a purchase or renew a subscription.
I guess the real point here is not distrust of the service provider so much, but prevention of hackers stealing from you by tricking the service provider into thinking they are you. I’m fairly sure Microsoft isn’t out to steal from me themselves, but some other bugger did trick them in to being an accomplice in a theft of my stuff anyway.
Game Cards and Paypal
On the subject of not just leaving your credit card details on a post-it note stuck to the shop till, why use one at all? Many online services have one-off points/time cards which provide an identical service, in a more secure manner. The underlying account isn’t any more secure, but at least it contains no onward money links. My paranoia recently sent me to GAME to test this out. I bought two £9 Station Cash cards (worth 3000 SC or two months of subscription for thier non-F2P games), which I then took home. Scratch off the back, enter the code and then spent the points on EQ2X Silver and one of those floating island player houses I was going on about a while back. Still have some points left, but it’ll only be those that get lost if my Station account gets hacked. Oh…did I mention the latest SOE account security panic, making for three security incidents relevant to my interests in as many weeks. These buggers are at it all the time, and everywhere!
Paypal is a useful alternative, requiring another password on a different system to be entered before cash is dispensed. This password is different to the purchasing applications one – see point one, above. I guess one day Paypal will be hacked, but I guess we’ll all have bigger problems than missing EQ2 points to worry about on that day.
Sadly, some systems offer neither points/time cards or Paypal options – Amazon being one example. Treat these with caution, and try not to leave the payment details on file unless actually in the process of paying. Remove them after the pruchase, if you can. With an increasing move to F2P design, it should become easier to find risk free ways to charge up the MMO MicroPoints that don’t expose the credit card.
Authenticators
My bank now makes me use one of these, a physical gizmo that tells me a number to type in when asked by the website. I do worry what happens when I put the authenticator on a 40C Non-Coloureds Spin Cycle, as I inevitably will one day, but anything that requires a physical object present to log in, can only help. CCV numbers on the back of credit cards work in a similar manner – you need the card in your hand to use it – and since the primary worry I have is people in remote places across the world pretending to be me online, this sort of thing does the job. WoW offer these and I think SOE have one too. It’s annoying that we have to pay extra for them, but they are probably worth the cost for extra peace of mind. You only have to worry about burglary or assault now!
Secret Questions
Quick tip here; lie. The person at the other end of the Lost Password Helpdesk isn’t marking you for accuracy. All they care about is that the answer you give matches the answer you said you would give when you filled out the form two years ago. Treat it as another kind of password rather than a General Knowledge Quiz with “You” as the specialist subject. When asked for your mother’s maiden name, make one up. With surprisingly little effort, some Friend of Humanity can look up your mother’s maiden name, but unless they’re already inside the system they are trying to break in to, they won’t know exactly how you lied about it on the original form. As long as you can consistently remember the lie and repeat it back correctly later on, you’re fine.
More advanced setup forms of this type have a user-enterable questions instead, which helps a lot here. Make it fairly obscure, but memorable to you!
Many of these tips are designed to deliberately break linkages, to internally compartmentalise our online selves. It can be very easy to create an online gestalt which is made up of many interlinked systems; accounts, logins, forum personas, avatars and so on, all of which lie behind only one universally shared and weak password. Get that from some weak link out on the periphery and the entire online you is laid bare, including the important stuff in the middle; the bank, the credit card, the employment records, the real you.
By resisting the pressure from these online services to create a unified one-button purchasing network around ourselves, and by resisting our own laziness, we can partition our online lives; insulate them from each other, so that if one element of it is compromised, the rest of them remain untouched. Pre-emptive damage limitation is fairly easy, but takes a moderate and sustained effort to keep it up.
All in all, I’ve learnt a lot in these last few weeks, so that’s something I suppose! I don’t even do MyFriends or BookFaces or SpaceVilles or the like, so have no security ideas for those, other than to not bother in the first place. Hopefully someone can comment on those!
With any luck, I’m preaching to the choir here and you all know all this stuff anyway, but if anyone reading this has learnt something, then that’s good too! If not, then I hope I’ve amused somewhat with tales of my own naivety! Regardless, good luck out there, remember that they are all out to get you, so don’t let the buggers get your monies!
Back to talking about things that aren’t online security soon!
Recent Comments