These forums have been archived and are now read-only.

The new forums are live and can be found at https://forums.eveonline.com/

EVE General Discussion

 
  • Topic is locked indefinitely.
 

New Launcher - Saving Passwords
Author
Previous Topic Next Topic
Rebecha Pucontis
Doomheim
#1 - 2013-05-29 11:30:24 UTC
I just wondered if anyone knows of any plans to make it so the launcher saves our passwords?
Zak Breen
Breen Enterprises
#2 - 2013-05-29 13:00:27 UTC
Too many security issues imo.

For those of you with many alts I can see how it is a pain, though. (and for those of us, like myself, with random letters and numbers for their passwords Lol)

Maturity, one discovers, has everything to do with the acceptance of not knowing. http://www.di.fm/spacemusic
J3ssica Alba
Federal Navy Academy
Gallente Federation
#3 - 2013-05-29 13:08:30 UTC
I would more like to see a right-click -> paste functionality added .. using ctrl-v is annoying
This is my signature. There are many others like it, but this one is mine.  Without me, my signature is useless. Without my signature, I am useless
Chribba
Otherworld Enterprises
Otherworld Empire
#4 - 2013-05-29 13:12:02 UTC
There's 3rd party launchers that kicks the official ones butt any day (minus patching) they can save pw and such. There's eve-mlp which you can check through the source yourself and use.

I wrote my own to fit my needs, no more typing, and I can be lazy enough to launch my clients from my cellphone Lol

/c

★★★ Secure 3rd party service ★★★

Visit my in-game channel 'Holy Veldspar'

Twitter @ChribbaVeldspar
Sarmatiko
#5 - 2013-05-29 13:37:15 UTC  |  Edited by: Sarmatiko
Zak Breen wrote:
Too many security issues imo.


So you saying that saving your account login\password in browser (which stores passwords in simple sqlite database) for instant EVE-O forum access is already totally secure? Why do we even have "Keep Me Logged In" checkbox in Evegate if local password storages are so "unsecure"?

I like the part that we need to use 3rd party tools to store our EVE passwords, instead of getting secured solution directly from CCP.
Azami Nevinyrall
172.0.0.1
#6 - 2013-05-29 13:41:20 UTC
I'd prefer if the launcher saves my passwords.

Less chance that a key logger will snap it up.

Also, I'm guessing that most of us allows our browsers to save passwords. Even though they have the most security loopholes in any program on your desktop. So there shouldn't be an issue with allowing a secure program saving your passwords that the operator already has.

...
marVLs
#7 - 2013-05-29 13:47:53 UTC
want it nowAttention
Zak Breen
Breen Enterprises
#8 - 2013-05-29 13:48:37 UTC
Sarmatiko wrote:
Zak Breen wrote:
Too many security issues imo.


So you saying that saving your account login\password in browser (which stores passwords in simple sqlite database) for instant EVE-O forum access is already totally secure? Why do we even have "Keep Me Logged In" checkbox in Evegate if local password storages are so "unsecure"?

I like the part that we need to use 3rd party tools to store our EVE passwords, instead of getting secured solution directly from CCP.


Nope, nothing is totally secure. Saving passwords is a convenience and is not a necessity.

Maturity, one discovers, has everything to do with the acceptance of not knowing. http://www.di.fm/spacemusic
Sarmatiko
#9 - 2013-05-29 13:55:36 UTC  |  Edited by: Sarmatiko
Zak Breen wrote:
Saving passwords is a convenience and is not a necessity.

Having option to save password is better than having nothing.
Security Team washing their hands of problem with phrase "we wont implement this because there is security concerns" will just push players to use 3rd party tools, hence creating even more insecure environment.

CCP Atropos wrote:
Most of the features that are in the linked thread were on our backlog except the storage of passwords. Password storage wasn't done in the EVE client for security reasons and we don't do it in the EVE Launcher for those same reasons.

So yeah, probably eve-mlp or self-written tool is only solution now if you want to to get in the game with one mouse click.
Ge Hucel-Ge
University of Caille
Gallente Federation
#10 - 2013-05-29 13:57:29 UTC
most people use the same client on the same pc for the most time.
it would be nice to register the pc with the eve-account, so that you don't need the password anymore on that pc.
Private Pineapple
Brutor Tribe
Minmatar Republic
#11 - 2013-05-29 15:28:46 UTC  |  Edited by: Private Pineapple
Ge Hucel-Ge wrote:
most people use the same client on the same pc for the most time.
it would be nice to register the pc with the eve-account, so that you don't need the password anymore on that pc.


This is done in some places, but usually on a networking level (such as you can't connect to the Internet unless you register your PC). I like this idea though hackers could spoof their PC to seem like yours... This idea is actually less secure than the "save password" option as to hack that part would require some sort of malware on your actual computer to hijack whatever encrypted file is stored with that password (this happens a lot with Internet cookies, cookies are one of the causes of so many facebook account hijackings).

TLDR: Save password requires a hacker to actually get malware on your computer, which can be hard. Registering your PC simply makes them only need to act as if they are you, which requires hacking the modem itself or blocking the connection between the modem and the EVE Online server and then pretending to be you - sort of like packet sniffers.

Source: Educated guesses as a programmer. I do not work in computer security.

.
MailDeadDrop
Archon Industries
#12 - 2013-05-29 16:41:34 UTC
Zak Breen wrote:
Too many security issues imo.

Sarmatiko wrote:
Why do we even have "Keep Me Logged In" checkbox in Evegate if local password storages are so "unsecure"?

Security is a deeply complicated subject, and one which people frequently get wrong. For example, Sarmatiko is conflating the "Keep Me Logged In" checkbox with the idea that the browser is keeping your website userid and password. I don't have CCP code in front of me, but having done that exact thing myself (the "Keep Me Logged In" setting) I have some experience.

Usually the browser has an encrypted session cookie which is passed to the website to identify the user. That encrypted cookie is just a long string of random looking characters and doesn't mean anything special to the browser. The website takes the user credentials when they login (userid and password), generates the encrypted cookie, and returns it to the browser. That cookie is then returned to the website with every follow-up action by the browser. Normally the cookie is a "session" cookie, meaning the browser keeps it in memory, but once the browser quits *poof* that cookie is forgotten. The "Keep Me Looged In" setting causes the website to mark the cookie as a "persistent" cookie (with an expiration date in the future) which the browser writes into some local storage area (file, registry, etc.) So when the browser starts in the future, that encrypted cookie is sent back to the website (making you be logged in).

The important part of the above is the browser isn't storing the userid and password. It is storing that encrypted cookie. Hopefully the website developer uses good security practices (like using a strong encryption method), so that if you lose control of that cookie (PC is hacked) the worst possible outcome is that someone could masquerade as you on the website. There are a variety of methods to make even that outcome more limited.

Zak Breen is correct: storing credentials (userid and password) is a very risky process that must be carefully considered. I'm not surprised that CCP is leery of tackling that concept.

MDD
Sarmatiko
#13 - 2013-05-29 17:16:15 UTC  |  Edited by: Sarmatiko
MailDeadDrop wrote:
so that if you lose control of that cookie (PC is hacked) the worst possible outcome is that someone could masquerade as you on the website

If your PC is hacked, then EVE Online credentials will be the last thing to worry about.

I repeat once again - alternative tools with password storage and AES storage encryption are already here. Now it's only matter of time when new variations will come out to compensate poor implementation of official launcher.
So CCP can ignore this, creating stupid situation when users will rely their security on 3rd party, or they can implement official password storage and handle situation properly.

Also "security risks" buzz talk is not very convincing, because EVE Online still don't have standard features like email or mobile\sms authentication.
For the record: Arena Net (and I like to compare this company to CCP) implemented "save password" in GW launcher, chroma hash in old launcher, email authorization, two-factor mobile authentication and also they ban passwords that frequently used in brutforce hacking attempts. Just saying.
Rebecha Pucontis
Doomheim
#14 - 2013-05-29 17:25:35 UTC
Chribba wrote:
There's 3rd party launchers that kicks the official ones butt any day (minus patching) they can save pw and such. There's eve-mlp which you can check through the source yourself and use.

I wrote my own to fit my needs, no more typing, and I can be lazy enough to launch my clients from my cellphone Lol

/c

Thanks Chribba, but as others suggested I would only trust my account details to official CCP certified software. Or official Chribba certified software. :)
Rebecha Pucontis
Doomheim
#15 - 2013-05-29 17:30:31 UTC
I don't have much programming knowledge, but it seems you can save password already for many applications. The golden rule is to only save passwords on computers which you know only yourself and other trusted individuals have access too.

To those that are absent minded enough to save their details on a third party public computer, then the motto "eve has consequences" and "deal with it" comes to my mind. :) We shouldn't all be forced to suffer to protect the lowest denominators.
Mara Villoso
Long Jump.
#16 - 2013-05-29 17:32:47 UTC
It almost sounds like no one has noticed the little auto-play checkbox on the launcher.
Sarmatiko
#17 - 2013-05-29 17:42:37 UTC  |  Edited by: Sarmatiko
Mara Villoso wrote:
It almost sounds like no one has noticed the little auto-play checkbox on the launcher.

It almost sounds like you haven't read the first post at all.
Tau Cabalander
Retirement Retreat
Working Stiffs
#18 - 2013-05-29 18:11:22 UTC
As I suggested in the launcher thread: make the launcher remember all passwords while it is open, and forget them all when it is closed.
GreenSeed
#19 - 2013-05-29 18:31:21 UTC
the Planetside 2 launcher saves passwords, but its a different game, where there's no point in having more than one account ( and also that game has a proper character select screen)
Implying Implications
Sebiestor Tribe
Minmatar Republic
#20 - 2013-05-29 18:48:04 UTC
I don't use the launcher but I probably would if it would remember passwords.

Other games let you remember passwords and I'm sure a lot of you have your web browser remember your Facebook password or whatever.

hello