Turbine's forum "upgrade", linking all account and forum information into one handy bundle, goes live tomorrow. This includes credit card info. It's also the root of the LotRO hack a little time ago, and we've gotten no assurances it won't happen again with this bewildering maneuver tomorrow.


Want to remove your CC info? Fastest way is to call em: 1-855-WBGAMES

Memnir wrote on Apr 18^th, 2013 at 12:49pm:


I'm very glad that I never put a CC on file.  Years ago, Mr. Wizard put together a very nicely document list of all things Turbine should do to improve their account management, security, and usability.  All of which was promptly ignored by Turbine.  Bah, I'm done with logging in, too.

They will take your details off, if you log a ticket, I got my ex credit card obliterated, because I didn't want them to even hold a billing address for me.

Silly rabbits.

logging off the official forums and making a dud account, so I can revel in their ingenious idea to make things easy to hack.

yup.

This sucks even more for VIPs that can't unlink their credit cards from account without losing access.

I'm not sure I'd have any option to make this better besides quitting ddo altogether. If they can inject sql on forums databases, they'd prolly be able to get my info from there whether I'm still posting there or not.

btw anyone wanna tell me how to set up a forum username/password with a new account? reading their faq gives absolutely no help, and I completely forgot.....

kierg10 wrote on Apr 18^th, 2013 at 1:43pm:


Sign up for DDO as a new user.  Enjoy the mule characters to hold scrolls/metal type weapon blanks for Cannith Crafting/etc along with the new forums account.

https://signup.ddo.com/ddo.php?ftui=DDOBlackDragonHC&abrs=774_1366307995

(and if you forget, just go to www.ddo.com and it will redirect you to that signup page)

Bigjunk wrote on Apr 18^th, 2013 at 1:44pm:


Correct me if I'm wrong, but that wouldn't make any difference since my posts and everything else would remain there... hence if someone could expose the databases via whatever vbulettin exploit, it'd make no difference whether I'd been posting lately or not.

Memnir wrote on Apr 18^th, 2013 at 12:49pm:


What? I haven't been paying much attention, but I'm skeptical you have any clue what you're ranting about.

The "root of the LotRO hack" was them not bothering to keep vB minimally up to date, as far as I recall. Unless you mean some other hack I hadn't heard of.

Single-sign-on - what they seem to be doing - does not necessarily involve "linking all account and forum information into one handy bundle". Heck, it could be more secure than what their vB setup was, depending on what they're doing. I guess it is Turbine though.

stainer wrote on Apr 18^th, 2013 at 3:27pm:


SQL access was gained by using a known vB vulnerability, which had already been patched. Turbine's installation hadn't been updated in like 2 years, naturally.

If they had done SSO correctly (heck, basic security correctly) passwords shouldn't have been accessible from a compromised forum installation. Maybe they've learned their lesson? Hahahahahaha.

I just don't trust them enough to leave my info there. Especially, since not one Turbine rep has even bothered to give some generic placating comment over any of the threads that raised concern over security issues.

I got them to take off my address details and the dead credit card I had on file a while back, but I'm confused why you guys are stopping posting / switching to different accounts. Surely your login and password details are going to be visible to a malicious hacker once they get into the database anyway, regardless of whether or not you are posting on the forums - you'd still be listed in the forum database as a forum person, wouldn't you?

Or are you assuming the databases with those details will be populated as people log in?

I has a confuse. Sorry if this is a daft question. I R not a techie.

Terebinthia wrote on Apr 19^th, 2013 at 3:53am:



It's not a daft question at all, you're almost certainly entirely correct (depending on how they go about it).  Whether you post from a mule account or not, your real account is probably going to be allocated a forum login and will still potentially be compromised by any successful hack.

Thing is, done properly this stuff isn't a problem; after all, people post reviews and argue on Amazon forums using the same details they sign in to shop with.  It just doesn't strike me that the likelihood of this being done properly is terribly high.

What's the betting that they "fix" the lack of blogs and so on by implementing OpenID so people can log on with their Facebook accounts?   

And then...  Earn Astral Shards by playing Farmville!