Persiflage wrote on Apr 19^th, 2013 at 4:10am:

Madcow430 wrote on Apr 19^th, 2013 at 8:25am:

Get a card specifically for DDO. Talk to the credit card company and have your credit limit set at $1 or some other limited amount. You can readily increase your limit for points sales or when your sub payment is due, pay the balance and lower the limit. This covers the problem they've engineered where a security breach will likely not be for just people who are posting, but for everyone.

Pre-paid from the teller. $100 with no names attached. "Valued Customer" will be the name of my second born. And when turdbin tries to do an auto subscription, the satisfaction of it bouncing is great

Terebinthia wrote on Apr 19^th, 2013 at 3:53am:


Your understanding is 100% correct.  Posting with mule accounts will make it less likely that your ID will get noticed, but your "real" account will still be up on the forums for everyone to see if they decide to go looking for you *and* if someone grabs the entire database, then you'll absolutely be in there as well.

By the way, when I asked Turbine to remove my CC info, they asked me to verify my credit card or my address.  After they removed my CC info, I asked them to remove my address information from their database as well.  The CSR that was on the phone with me said that he would do/did that at my request.

And for prepaid cards in the UK, I googled and found this.
http://www.money.co.uk/prepaid-cards.htm

cdr wrote on Apr 19^th, 2013 at 11:30am:


If I remember right, it wouldn't let you do that. You are obviously an internet security expert, so you may have known that.

I think Jaxx has my credit card linked to his account SINCE I BOUGHT STUFF FROM HIM

cdr wrote on Apr 19^th, 2013 at 11:30am:


My account login and password were different than my forums login and password back in the day. 

Because I made a typo while I was creating my forums account...

cdr wrote on Apr 19^th, 2013 at 11:30am:


yet again, someone who says "because there are idiots in the world, might as well treat them all as idiots".  There are people who don't wear seatbelts so lets remove them from all cars... Do you work for Turbine?

Yes, there are a lot people who do not practice safe internet (e.g. using different login names / passwords).
That is no excuse.

In the beginning, the game accounts and game login were totally separate from the forum accounts. In fact, you could sign up without having a forum account (that is why some people had a later forum account join date than their paying account). It was subscription based, so anyone who paid, had the same level of access on the forums.

When F2P came along, they needed a mechanism to separate the unwashed masses. They had accounts linked, but it only linked up to their name and whether they were VIP, F2P - it never exposed the actual password in their game login nor their game account.

Now, you will have a single game login and password that vBulletin will pass on. What could this expose? All of your game data and possible your credit card data (based on how they linked it up).
Just by linking a forum account to a game login, someone can use that to buy stuff from the DDOStore and dump it to other accounts (the DDOStore never asks for your game account login).
Have you ever clicked on the DDOStore / My Account? It shows your game account name (hack point) and minimal credit card info (not much). Now, click on the ENTER DIFFERENT CARD and they now have your BILLING ADDRESS for that card. Yes, if you have your billing address the same as your home, they know it!


I am troubled that they didn't come forward and said they were maintaining the segregation of accounts between the game login and the game account (where your pay information is stored). If they didn't do that, someone can harvest the database for ALL the credit card information.


How could I know? I ran vBulletin for several years and knew their bugs and how data got exposed to outside security agents. There are kiddie scripts to do this very thing.



tl;dr   You are an idiot...shut up.

Dark_Helmet wrote on Apr 21^st, 2013 at 1:24am:


You think you know shit because what, you admined a vB board? Right.

I'm no Turbine fan, but you don't know how their system is set up and neither does anyone else. They got caught with their pants down before from not securing vB and they have corporate oversight from WB so they hopefully are doing it better this time.

There's certainly reason to be concerned, but what bugs me is:
A) You weren't really any more secure with separate forum accounts.
B) People like Memnir are having a mental breakdown about it and it's not that important.

NOTpopejubal wrote on Apr 21^st, 2013 at 1:38pm:

???

That's NEVER happened!!! 

Kalari wrote on Apr 21^st, 2013 at 6:05pm:



Because the truth of it is those warnings are merely there to 1) cover themselves in the case of mouthbreathers and 2) give the appearance of caring about security.  reality is the company wants to look like it's being security conscious because it's cheaper and eaaier to do that than actually securing anything.

you are neither more nor less secure now than you were.  Residual risk remains the same because barring being absolutely stupid with your password; all accountability and responsibility lies with the system owners.

i totally agree, however, that they're being inconsistent.  woulda been better to own the risk and communicate more intelligently back in the day so they didn't have to look stupid now.

Silky wrote on Apr 22^nd, 2013 at 1:24am:


FUCK!!!! how do you know all my passwords .. are you a wizard ?