Player Features and Ideas Discussion

I have done this myself for other MMOs that do use two factor authentication. All it takes is a phone call.



As someone who works with systems that use two factor authentication every day I can attest that this is a very legitimate compliant. In fact it is almost infuriating. However the systems I interact with have a real need for the level of security that they have so I tolerate it because I understand why it is necessary. EVE is not a banking or health records system, it is a game. Games do not generally need the level of security that banks and hospitals do.

When I see that thread on this subforum I'll give you a like

This is an over simplification of what security does. If the cost of the security system exceeds the expected cost of the threat you are trying to mitigate then you have too much security. In a large organization the cost to daily productivity of having all employees spend 5-7 minutes at the start of the day logging in to the various security systems is not insignificant. However if all employees have access to a central payment processing system for a major bank then it is certainly worth it. However if the organization is a chain of restaurants then there is no real need for the waiters to have to pass through the same level of security when they enter orders into a computer for display back in the kitchen.

Applied to EVE this principal would suggest that two factor authentication would be useful to players who have access to a large amount of in game assets. Supercap alts, really space rich players, and directors in large corporations or alliance executor corps come to mind here. There is probably little need for every ratter or rank and file fleet member to have two factor authentication on their account. But the players that have full access to the assets of the corp or the ability to dissolve the alliance could reasonably be required by their corp to have two factor authentication on their account.

This of course assumes that account theft is enough of a problem to warrant implementing two factor authentication to begin with. Since I do not have access to this information I cannot make a judgment on this.

With regards to your bank info being stored on CCPs servers. I am pretty sure that CCPs website does not display your CC# and I am also pretty sure they store the information in an encrypted format as is required by the PCI data at rest encryption requirement, and as such it is pretty safe. As an example of modern encryption (AES), if you can tell me what this really says you will win a cookie:

ZwLMrCWJr1KXT8S2vkva8tTw1KVTgwSynQVDyuvH

-1

more loops to hop through to log in to your account, wait for authentications, blabla.

let's face it, you have a login, and a password. It is the CUSTOMER's responsibility to keep those safe. it is also the customer's responsibility to have their PC clean from trojans and keyloggers.
Don't use the same password on other sites / games, don't share it with anyone, and don't surf or download dubious sources on your gaming PC, do that from a second PC and you'll be fine.

CCP has no responsibility whatsoever, to be fair. They CAN (but don't have to) push security frther for all the mouthbreathers that seem to misplace their account data or save it on the "cloud" or whatnot.

the only thing I dislike currently is that on purchases of the character bazaar you need to provide the buyer with your login name. That's half the rent there. And we know how derpy some people are with passwords; a little social engineering and you're good to go.

I'd like to see character transfers based on your character ID (it's a unique number) or maybe an API string you can generate for that. It would really help.

But the OP proposed things? nope.

-1