EVE General Discussion

After having been hacked just once - it wouldn't surprise me to find out that you have e-mail access on your mobile phone.

Unless you have as robust a firewall and anti-malware s/w on your phone and your PC - then you are wide open.

Personally I'll never have e-mail on my phone again - and will never use any banking apps.

My guess would be reuse of login credentials combined with CCP implementing fallback in case you lose your authenticator data.

Your email should also be secured by proper 2factor auth with no fallback. which means don't use gmail. use something like protonmail.ch and, for love of god, backup your auth data or you will lose access to the account!

That's what I've always done.

I've played a lot of games over the last few decades. Many of them MMOs and many more that require an email address for online DRM. Never once have I had any acct compromised.

I don't know what you are doing wrong, but you are doing something wrong.

Mr Epeen

This more or less.

If you use duplicate or similar passwords anywhere, there will be that one fail admin who stores your password in plaintext and loses it. 16 characters of pure random won't help you if someone was that stupid.

I remember a single Tahiti (R9 280X, Radeon HD 7970 and family) GPU could make about 400M guesses against MD5 (an old, fast method for one-way encryption) every second. If you use any kind of predictable pattern or stupid dirty trick (i.e. "password1", "p@$$w[zero]rd", or any clever thing where you have a base pattern), your password isn't anywhere near as strong as you think it is and needs to be taken out of service before something bad happens.

Also check here and see if they've seen your email address before.

Also something about how encrypted passowrds are broken.

I use password123.?!#_blurp for all of my web logins. It's just easier that way.

Also, if you don't use your computer for shady ****, you minimize the risk of getting infected with something. It's like if you don't sleep with the neighborhood ho, you reduce the risk of your **** rotting off.

Make sure you split things up. This worked will with the Titanic. Unless you have a ****** captain that keeps clicking on everything except "NOT THROUGH THE F*CKING ICEBERG" to which the captain says "Calm down, miner!" and keeps going.

The most insecure thing someone can do is have 1 email account, use it for all games, work, access to top secret data, vpn and combine that with a single ultracomplex password, not only does that guy store it in every browers and addon, those people also click one EVERY bleeping fake link they get on their youpoop, twatter and facialbook accounts.

I can give tons of tips on securing a password but none, NONE OF THEM will do any good if the single point of failure is the person himself blaming "Russian Hackers" for their perverted click depravity. WTF is wrong with "you people"? HTFU. Or at least stop clicking every site, link and mail you can find on your screen. You are not the special snowflake that I am. Your life is ending one click at a time.

Also, if you stop using devices maybe, just maybe you could put in an effort to remove them as trusted? Unless you trust everyone that will get their filthy hands on it to watch pr0n and fap at your recovered pics while logging in all of your accounts thanks to your "remember password", "Password keepers" and general clicking the "don't ask for the password or 2nd auth". If you want to clean a device, think like Hillary Clinton and use "BLEACHBIT" so no one finds out about your EVE Accounts. Even if you store the password on a draft mail on your blackberry or ipad.

I did exactly that. And I asked my E-Mail provider for country blocking but they won't do that sadly. I asked the EvE support about that feature but sadly it isn't available either...

Alas, as I still have not found a keylogger on any on my 2 machines with which i log in to my webmail, I really wonder how they got that password which is completely unique to all my other passwords and it is only 3 months old... makes me absolutely paranoid. Tried F-Secure (the only tool which prevented ransomware attacks on our company!), Eset online Scanner, malwarebytes and panda antivirus and sophos virus removal tool... Nada. if you have any tips i would be realy glad. Just not possible to reinstall completely at least on my workstation in the company...

Well with sms authentication on my e-mail I realy should be safe now... the only possible option to breach now would be to steal the login session token or some **** like that and there is nothing on my end i can do to prevent that.

I still have an itch all the time and an urge to check my e-mails if there is someone else requesting some account information, god damn that made me absolutely paranoid... probably scarred for life

Thanks again to ccp to restore my stuff!


Edit:

@Aedaxus
You speak the absolute truth and i should have set up two factor authentication for my e-mail a looong time. I swear to you that i never clicked on any bad link :) I work in IT and while i am not an expert in security I know how to move in the internet... i also use noscript addon for my firefox and the days where i watched some series on some dubious streaming sites are definitely over... still it happened. Granted the unique password was not to complex so it may have been brute forced but which service doesn't have a protection against these types of attacks nowadays? It's always more important not to share the same usernames/passwords for different services...

and as said i never log in to my private mail from my mobile phone.

well lessons learned the hard way i guess.

Please, please DO NOT ever use SMS as a second auth. It is trivial to defeat and should never be even offered by the companies. Always use time based auth (OATP with google authenticator). That is the only remotely secure 2FA other than actual dedicated U2F devices. If your mail provider doesn't offer proper auth then change the provider!

How many of the people here actualy even use a second auth method on their e-mail? would a skript kiddy go to the length to try and circumvent a sms authentication? man i am just a gamer not a specific target :) Or at least i hope that

in the end i will use a top secure service and lose the authenticator and lose my accounts this way lol