Do we really need to buy a security token?

[Kailea]

Re: Do we really need to buy a security token?

No, there wasn't anything on his system.

if thats the case, then I am truly confused

[TheGrandMom]

Re: Do we really need to buy a security token?

As far as TGM story though..... that is really odd, not sure how they got his info *shrugs* but I am sure there is something on his system.

No, there wasn't anything on his system.

[Kailea]

Re: Do we really need to buy a security token?

To the the security key is the safest way to do pass codes. no one can screw with it, or intercept your code from the device (at least anyone wanting to hack you)

Using other devices can only lead to error on the part of those devices, and adding the in game storage, was just the extra boost SE needed to get more players to get the token. If 100% of the players would get said token, there would be alot letss problems.....

but of course then we have the morons that get the key, just for the game storage, then turn their key off... -.- or the ones that don't get it to begin with, now you really don't have any excuses to cry about, when you do get hacked.

As far as TGM story though..... that is really odd, not sure how they got his info *shrugs* but I am sure there is something on his system.

at first I was not going to get it, then they talked about the storage, and I was like "mmm thats cool I will think about it" then hearing that it would work for FFXIV as well, and that it would use the new site SE made. I figured I would make a future investment and get my stuff over to the new system ;p

[Durahansolo]

Re: Do we really need to buy a security token?

Well i thought I'd give it a go and went tot eh order page only to find "we appologise but all keys have been purchased, we are awaiting a new shipment for the manufacturers"

I was wondering when that was going to happen. I kinda figured it would've been closer to launch though.

[Jarre]

Re: Do we really need to buy a security token?

Well i thought I'd give it a go and went tot eh order page only to find "we appologise but all keys have been purchased, we are awaiting a new shipment for the manufacturers"

[Telera]

Re: Do we really need to buy a security token?

It does seem vaguely RMTish to me. Yes, I know it was an incentive to push the people who were 'on the fence', and as a large portion of the players of this game are PC players, it makes sense for them to do. Those of us on the console though, essentially buy a useless piece of equipment to get the space, and for me, I see it as a bit unfair that there is no in-game method to obtain the storage. I have no designs on ever moving to PC for XI. Nor XIV. I need an excuse for my PS3 to exist anyway, what with the utter lack of games that interest me on it at the moment. And incentives can't cure people of stupid. Plenty of PC people are clearly still not using Tokens anyway (see: the fact that there's still account jacking), so it didn't seem to alleviate the problem that much even with the incentive.

I would love to have the space, so I could cancel my mule and save myself a dollar a month. Not much but it'd be something. It'd also save me time muling shit around when I changed jobs. 'Who has my rings? Caeryn? Aeria? Fuck, I don't remember.' and I proceed to waste time finding out. If I had a Satchel I could keep it all on Telera. Aside from the account issues, it's just an extra hassle for me to have to have the thing, deal with the code, all for inventory. Sure, I could unsync it from my account, but then it would make it super-for-realz! RMT for me, as I would've paid money just for in game space, and that leaves a bad taste in my mouth. No, the space isn't a need, but it's a want, and RMT in MMOs has always preyed on that aspect. So I'd feel compelled to keep the Token active, only to be annoyed by it, as someone would have to literally jack my XI cases to get access to my codes as it currently stands. And if they take those, they probably also took all my actual valuables, too, and a MMO account would be the least of my worries.

[Feba]

Re: Do we really need to buy a security token?

It's not RMT, because it's SE's game, and they can do what they want.

Uh. That's nothing to do with it.

RMT stands for Real Money Trading. As in, the act of trading Real Money (legal tender) for in game bonuses or benefits (items, gold/gil, leveling). Plenty of MMOs endorse or even encourage RMT. There's nothing wrong with that, per se, it's just the way some companies do business.

[WishMaster3K]

Re: Do we really need to buy a security token?

It's not RMT, because it's SE's game, and they can do what they want. Hell, "our" characters don't even belong to us.

That is all.

[Feba]

Re: Do we really need to buy a security token?

And I never said it would be the only solution, but it would always be the inferior option.

For you personally? sure.

On a practical level, nobody has shown how they are anything but equal. The cell phone has strengths the token lacks, and the token has strengths the cell phone lacks, but neither is really anymore secure or flawed than the other. One will appeal to some people, the other will appeal to others.

Many people, including most hard core PC players, were planning on buying the token before SE announced the Satchel.

I would say most were on the fence, judging by my recollection. And again, I'm not arguing that they used the satchel as an incentive to get people to buy the token for security. That doesn't mean it's not RMT, just means it's as good a reason for it as any other. The idea that "we only paid for this, those guys charge roughly the same" as again based on the fact that everyone bought it for the token to at least some extent, which just isn't the case. The point isn't really whether it's pure RMT or not, though. If it makes you feel better, I'll say that everyone bought it for the token and the satchel. The point is, if it's truly a matter of getting everyone as secure as possible, why not offer the option to use another authentication method?

Being able to reach less people, working slower as it requires you to send and receive the information, possibly incurring charges each time you use it, are any of these reasons that other people have mentioned sinking in as to why SMS is inferior to Security Tokens?

Again, none of those make it inferior. They are trade offs.

1- They might reach less people, they might reach more. There's little way to tell based on things as they are now; I would guess that many people that play online games also have cell phones. I would guess many of those people would prefer using what they have instead of getting a new thing. Whether it reaches a larger audience or not isn't really important, as any significant increase in coverage is a good thing for everyone. Less account theft, less RMT making the effort to steal accounts, less stuff being sold by RMTs.
2- I already admitted it's slightly slower, but really, it doesn't take more than a few seconds from the time the server sends the SMS until the time you receive it. It's barely any larger a problem than the user having to read the screen and type it in.
2b- In a way, this is a disadvantage of the token. The SMS can give you a full minute from the time the number is sent to receive, open, and enter the code. The token simply updates every minute; this means you could type in a code, only to have it die right before you submit it, or you could have to wait for the next minute to roll around in order to type in the next number. That also makes the token slower, but not significantly so.
3- Yes, some people will incur charges for using it. Those people would probably be better off investing in a data plan (if they send and receive that many texts) or a token (if SE is the only real source of texts they have). Again, it's a trade off-- some people will get the messages for free, where they'd have to spend $10 on a token. Those people would be very much inclined to join a secure program, where they're not so much now.

The token also has problems:
1- Obviously, you have to pay $10 for it, and wait for it to arrive. People that already have cell phones can take advantage of the service without cost, and instantly.
2- You have to carry it with you; if you want to play FFXI somewhere else (for example, an LS party, or on a business trip), it becomes another piece of plastic you must take with you. Most people would already take their phones
3- As mentioned above, it changes every minute, instead of on demand.
4- When it is lost, or the battery dies, it must be replaced. A lost cell phone will be replaced anyway, and will generally keep the same number. A cell phone's battery can be easily recharged or replaced.

This doesn't make the token inferior, though, it just means that it's less suited to some people than others.

And you can still be just as effective as any other player with or without the satchel.

Same as selling any random piece of armor. Again, I'm not debating that the satchel and token should be independent of each other, I really have no problem with linking an authentication system with an in-game bonus. My problem is that, if this is purely a matter of securing our accounts, why not offer a free (in terms of money-to-SE) approach that accomplishes the same thing? The costs would even out for them, and work well for some of us, while proving that the satchel isn't an RMT'd good.


On merchandise and mini-expansions, please reread what I wrote. I already responded to your criticisms, I think we actually agree, at least for the most part.


You kinda suck at big letters. A $10 token will not reach everyone that a free SMS service would. A free SMS service would not add a significant cost that wouldn't already be covered by the money they save by not having to recover accounts (and hire/pay employees to do so). There is a very clear reason to do both: to secure more accounts, and appease players who are concerned about SE gouging the playerbase more and more.

Is it clear to you that adding an unneeded expense on SE's end to please a few cheapskates would be a bad idea for everyone? There is no reason to do both when doing one can cover everybody.

As I've explained, more authenticated accounts is good for everyone. And there's a very good reason to do it-- because SE cannot force people to authenticate their accounts, unless they intend to send out tokens for free. Sending out SMS is extremely cheap, plastic dongles not so much. I highly doubt there are just a 'few cheapskates' out there that wouldn't prefer this option.

This *entire* topic is a strawman argument based on something you disagree with because you refuse to believe the truth.

Right. Saying "you disagree with it because you refuse to believe the truth" is pretty much the definition of a strawman argument.

And your defense of "SE bundled it with this because they care about us, not because they're making any profit!"-- if they're not making any profit, why is the SMS service a problem, exactly? Like the token, it would be an acceptable cost. If it's really a matter of making secure accounts, why not take a small cost in order to widen the amount of people that will secure their accounts? The same argument applies-- there are 'dim-wits' who wouldn't secure their accounts even with the satchel, so why not offer a service that plenty of them could use absolutely free, so long as it protects their accounts and prevents problems for SE?


The hilarious thing is that we believe basically the same thing:
1- Physical Authentication methods are a good thing.
2- The Token and Phone systems both have some problems, but have their appeals to different people.
3- SE bundled the Satchel with the Token primarily to get people to buy the security measure.
4- SE should be providing security authentication for little-to-no profit.

The only real difference is that you think the SMS option isn't worth the cost to SE, and I think it could really help increase the amount of people using it.

I have a question, then-- if SE charged your POL account for however many cents it takes them to send an SMS, minus the savings they make by not having to deal with accounts being stolen, could we agree that it's the best solution? The net cost to SE is nil, and players get a security solution and inventory increase which is inarguably non-profit. That seems like a win/win to me.

---------- Post added at 03:57 PM ---------- Previous post was at 03:50 PM ----------

I guess that means both of these are secure, right?

Of course not. The point is that your claim that 'these guys know what they're doing' flies out the window when they do something which is what I'm supporting. It means either:

A- They don't know what they're doing.
B- They know what they're doing, but don't care as long as they make a profit.
C- They know what they're doing, and you are wrong.

All three of those undermine your argument.

People like you who don't understand (or willfully ignore) why it is so damn stupid to send a code simply to have the user send it back are why those devices have those abilities.

Go ahead, Mhurron. I've been asking for it for three pages now. Explain why it's so damn stupid, explain how sending a code to a person's cell phone as part of the login process (not replacing the password! working with it) leaves them vulnerable to having their account stolen.

I've said it at least three or four times now. I want you to explain precisely how this leads to a real-world security issue with regards to MMOs. So far, all you've managed to say is that people can intercept SMS-- yes, but is there any reason to believe that FFXI account theft could realistically do that? Or that someone who could do that could easily get into FFXI account theft?

Put up or shut up, Mhurron. If all you can say is "I'm so much smarter than you, I don't need to explain why I'm right! HAHAHAHAHAHAHA.", your point is clearly invalid.

[Mhurron]

Re: Do we really need to buy a security token?

Yeah, like those scam artists that make RSA SecurID Appliances. Oh wait, you were just lauding them, weren't you?

PAM on UNIX supports clear text passwords. UNIX still ships with telnetd. I guess that means both of these are secure, right?

People like you who don't understand (or willfully ignore) why it is so damn stupid to send a code simply to have the user send it back are why those devices have those abilities. They still get to sell the expensive box to a company so the company can make a check box on a document with out actually really increasing security.


O hai! What's that account again?

[Ziero]

Re: Do we really need to buy a security token?

Again, as an option. Not as the only solution.

And I never said it would be the only solution, but it would always be the inferior option.

And you can keep saying it's just an 'incentive', but that the 'incentive' has nothing to do with why people are buying it.

Many people, including most hard core PC players, were planning on buying the token before SE announced the Satchel. Adding the satchel just pushed over more people who had no problem risking everything to save them a few bucks. SE wasn't selling the satchel just to sell the satchel, they added it with the Token because they knew many people don't care enough about security to buy the token on it's own. This is not in any way shape or form a for-profit issue that RMT and micro-transaction systems are based on. The cost of the token in it's entirety, including shipping costs worldwide, was the only thing we paid for. Blizzard sells security tokens too for roughly the same price.

For all of you calling it 'inferior', you've provided absolutely zero proof or even examples of it. But then you also provide no reason to believe that there is a 'barely there' population of people that play online games and have cell phones. And yes, it would cost more, but between the service fees we already pay (which we might stop if our accounts are hacked) and the costs they save through recovering accounts, it would probably pay for itself.

Being able to reach less people, working slower as it requires you to send and receive the information, possibly incurring charges each time you use it, are any of these reasons that other people have mentioned sinking in as to why SMS is inferior to Security Tokens?

Oh please. People have gotten along without tons of things for years. Yes, they're wants, not needs. That has absolutely nothing to do with whether something is RMT or not. Again, if SE started selling Ridill +1, it would be something people don't need to survive, but it's a significant advantage over those that don't have it.

Everyone has the ability to get the Token+Satchel and SE wants everyone to get one, not because it makes them money but because it makes us safer. It was a dick move on their part, but it was for our own good. And you can still be just as effective as any other player with or without the satchel.

Like hell it was. If you want to see if people are interested in merchandise, you offer them merchandise, not merchandise with a special bonus. Giving people an incentive to buy it other than the merchandise itself would be undermining the entire point of testing the market.

On the weekly teleport thing, no, I think they planned it to be better than that, but scaled it back after seeing peoples opinions on it.

And yes, ACP is exactly what I mean. Sure, plenty of people bought it because they thought it would give a lot more than it did, but there are still people buying it that have no interest in anything but the armor.

They DID offer other merchandise. I listed some of the other merchandise they've made and it won't surprise me when they come out with more. Of these items, only *one* had an ingame bonus and it was purely for looks. If you seriously think SE would try to sell an ingame, fairly useless item for 40 bucks you're nuts. The pendant *was* what they were selling, and the ingame item was just a free bonus.

And again, ACP was supposed to be a "Mini-expansion" and people who thought it would be an epic, detailed, and fun storyline to play jumped all over it. No one bought it just for the armor because the armor itself is not that great. Most people already have AH bought gear that is just as good or better, myself included. If I knew the Add-On would have been as trash as it was, I certainly wouldn't have paid for it. Lesson learned though because next time I'm waiting for reviews.

On the token, yes, more people bought it because of the satchel. They bought it because they know that having double inventory is a huge advantage in FFXI. And no, I have said it many times. I will say it again in big letters, so maybe it will get through to you:

And I'll say it again in big letters so maybe you will get it:

Using both systems would just cost SE far more money to see far too little worth since the Token alone can reach as many people as the Token+SMS system. There is no reason to do both when one works better and can reach everyone. <Edit by TGM: see post above /sigh>

Is that clear enough for you? I think providing both is the best course, not picking one over the other, as I have been saying. For some people, receiving an SMS is much more convenient than having to carry around a token. For others, receiving an SMS is basically impossible, whereas the token requires no such thing.

Is it clear to you that adding an unneeded expense on SE's end to please a few cheapskates would be a bad idea for everyone? There is no reason to do both when doing one can cover everybody.

If you want to draw up a strawman argument to debate, go elsewhere. If you want to debate the points I am making, the words I am actually writing, do it.

This *entire* topic is a strawman argument based on something you disagree with because you refuse to believe the truth. The Satchel+Token combo wasn't done for-profit, it was done because SE knew that the majority of dim-wits that play this game would happily choose to let their accounts get hacked then cry to SE about it over spending 10 bucks. So they bundled it with something people want so people would have no choice but to secure themselves better. In the end, it's a win-win situation, SE is able to not only secure the accounts of everyone playing FFXI, but of everyone who will play any future online based SE title(FFXIV included) while players get a few more spaces to hold onto their useless junk.

[Feba]

Re: Do we really need to buy a security token?

You're missing out on the cost for SE.

No, I'm not. I'm saying that the cost of it isn't that significant.

If it was a viable option I'm fairly sure they would have implemented it.

And if adding more inventory was possible, they would've done it, but there were PS2 limitations.


Oh wait.

Sometimes businesses don't do things right away, or at all. In gaming, see the SD card solution for Wii; it's not that Nintendo couldn't have done it earlier, they just didn't. They could've even designed the console with SD cards in mind from the start, which would've been far better, and probably not been significantly more expensive. But they didn't.

an SMS service will just reach out to a niche audience

Stop. Scroll up. Read the big goddamn letters. The point is to offer both, to appeal to both audiences, the three people that play MMOs and have cell phones that would opt to recieve SMS, and the five people that play MMOs and would opt to spend $10 on a piece of plastic to provide the same security. Both options appeal to a niche audience anyway; most people think they're safe until something bad happens to them, or near them. Because people are idiots.

people have presented plenty of reasons why they think an SMS service would be inferior but you choose to dismess them

Wrong. People have presented reasons why they would not personally want an SMS service. Which I brought up from the beginning. They have not given reasons why it is practically inferior in terms of stopping account theft; the closest anyone came to that was Mhurron (and Amberly, iirc) who said it was moderately less secure because the SMS had to be transmitted. But there's little reason to believe that someone who has the ability to intercept an SMS and within a minute (or two, or three) use that to access your account (in addition to your regular user ID and passwrd) would have a problem hijacking your account (or far more important accounts) anyway.

I'm still waiting for someone to say something like "oh, the SMS system doesn't provide as much security because someone could to XYZ to have the number sent to their phone/email address instead"; something which is a practical security hole that the cell phone would be exposed to, that the token is not. Something that could be used by actual account thieves, not something that only matters if you're dealing with government databases or the like.

The burden is on you to prove why we should consider an SMS service as an option instead of the security tag but all you have done so far is not listen to what other people have said.

1- No, the burden is on you to explain why the SMS service shouldn't be an option. I'm not trying to sell anyone on the idea, just ask why (if the Satchel isn't an RMT good) SE cannot offer this service or something similar. If the security token works better for you, wonderful, go use it. That doesn't mean there shouldn't be an option; that's about the same as saying "everyone has a PC, why don't we just get rid of the PS2/360 versions?".
2- I have listened to what other people have said. Which is why I reply to them and explain why their point is either not a real concern, explained why I'm concerned about what I'm concerned about, or explained why their concern doesn't really apply. Again, if someone can point out why this is truly a practically inferior idea, I'd love to hear it. If someone can find some non-trivial flaw, I want to know. But if the concern is "hackers are intercepting your SMS messages so that they can log in to your FFXI account", I think it's pretty damn fair to break out the tin foil hats.

---------- Post added at 03:10 PM ---------- Previous post was at 03:06 PM ----------

It is not SecureID. The server sending you a code and you sending it back is not a secure exchange.

I've not debated that. An SMS can be intercepted, yes, and a generated keycode cannot. You have failed to show how this is any more practically insecure, though.

You've failed to show how anyone can exploit the transmission from the server to log in to your account using non-extraordinary means. Again, if you can do this, I want to know. It would shoot down my argument very quickly, and would probably be fascinating on a technical level.

For further reading that is similar and sometimes clearer, look up how Kerberos works since the 'why is this so much more secure' is very similar to SecureID.

There is a reason why people more intelligent then you did not choose to send codes via SMS for anything other then scam contests.

Yeah, like those scam artists that make RSA SecurID Appliances. Oh wait, you were just lauding them, weren't you?

[Mhurron]

Re: Do we really need to buy a security token?

For all of you calling it 'inferior', you've provided absolutely zero proof

It is not SecureID. The server sending you a code and you sending it back is not a secure exchange. Your cell phone is not a secure device, and if you think I'm talking about someone not being able to walk off with it you don't even have the beginnings of the knowledge to understand why your idea is just bad. There is a reason you can not change the battery in the dongle. There is a reason why you can not reuse a dongle once it has been disassociated from the system. Do your own research, look up and understand how RSA's SecureID works. For further reading that is similar and sometimes clearer, look up how Kerberos works since the 'why is this so much more secure' is very similar to SecureID.

There is a reason why people more intelligent then you did not choose to send codes via SMS for anything other then scam contests.

[Firewind]

Re: Do we really need to buy a security token?

You're missing out on the cost for SE. SE isn't going to provide a service like this for free. They have a business to run and what you are suggesting simply wouldn't be as cost effective as making a bunch of plastic keychains.

SE may well have considered an SMS service during their research and development stages . If it was a viable option I'm fairly sure they would have implemented it. The token reaches every player and makes SE look like they are doing something about account hijackings to boot, an SMS service will just reach out to a niche audience which will make them less money from it in the long run and it will just annoy players who want SE to do something about account hijackings.

If you want to draw up a strawman argument to debate, go elsewhere. If you want to debate the points I am making, the words I am actually writing, do it.

I would also check your own argument before attempting to call out someone on a strawman argument. people have presented plenty of reasons why they think an SMS service would be inferior but you choose to dismess them and ram the same argument down out throats. The burden is on you to prove why we should consider an SMS service as an option instead of the security tag but all you have done so far is not listen to what other people have said.

[Feba]

Re: Do we really need to buy a security token?

And they realized an SMS system would turn off more people then having a far superior Security Token because not everyone who plays this even has the option of getting a cell phone while the vast majority can spare 10 extra bucks to secure their account.

Again, as an option. Not as the only solution.

And you can keep saying it's just an 'incentive', but that the 'incentive' has nothing to do with why people are buying it.

And in the end doing both would be more money and effort on SE's part to service a barely there, small percentage of the population who would want the SMS service over the token. And on top of that, the SMS system would still be an inferior option to the Security Token so it is just not worth it.

For all of you calling it 'inferior', you've provided absolutely zero proof or even examples of it. But then you also provide no reason to believe that there is a 'barely there' population of people that play online games and have cell phones. And yes, it would cost more, but between the service fees we already pay (which we might stop if our accounts are hacked) and the costs they save through recovering accounts, it would probably pay for itself.

You're just in such a rush to defend SE that you forget that some criticism is constructive, not just insulting.

The inventory space is nice, but people have gotten along for years without it. It's not needed, it's wanted.

Oh please. People have gotten along without tons of things for years. Yes, they're wants, not needs. That has absolutely nothing to do with whether something is RMT or not. Again, if SE started selling Ridill +1, it would be something people don't need to survive, but it's a significant advantage over those that don't have it.

The "teleporting clothing" was a test, it was SE seeing if people would be interested in FFXI merchandise,

Like hell it was. If you want to see if people are interested in merchandise, you offer them merchandise, not merchandise with a special bonus. Giving people an incentive to buy it other than the merchandise itself would be undermining the entire point of testing the market.

On the weekly teleport thing, no, I think they planned it to be better than that, but scaled it back after seeing peoples opinions on it.

And yes, ACP is exactly what I mean. Sure, plenty of people bought it because they thought it would give a lot more than it did, but there are still people buying it that have no interest in anything but the armor.



On the token, yes, more people bought it because of the satchel. They bought it because they know that having double inventory is a huge advantage in FFXI. And no, I have said it many times. I will say it again in big letters, so maybe it will get through to you:

I do not think that using SMS instead of the Security Token is the way to handle it. As I have said from the beginning, SMS should be an alternative for those that would prefer it. Still nobody has shown how it is in any way practically inferior, simply that it has benefits and weaknesses compared to the token, which I explained from the start. <Edit by TGM: I don't think the size is necessary.>

Is that clear enough for you? I think providing both is the best course, not picking one over the other, as I have been saying. For some people, receiving an SMS is much more convenient than having to carry around a token. For others, receiving an SMS is basically impossible, whereas the token requires no such thing.

On thinking SE is going to turn RMT, no, I don't. I think they're experimenting with it, however, and testing the waters. Again, I have made this clear. If they think people will stick with them (which they'd be more than correct in thinking at this point), they will probably expand it. I think that people should be wary about FFXI turning away from subscriptions and towards micropayments, or worse yet using subscriptions and micropayments.

If you want to draw up a strawman argument to debate, go elsewhere. If you want to debate the points I am making, the words I am actually writing, do it.