[UPDATED] Account security improvements

[RICHTER99]

omfg remove the ****ing code i cant loging


its annoying af

[blackfriars]

Restrictions on usage of "." and "+" have also been lifted, allowing the use of the same email through gmail for multiple accounts for example.

This doesn't seem to work as of right now.
At the very least, it's impossible to change to an email containing a +.

[sosad]

Typing out passwords was enough of a task for my adhd, but now I require auth codes every sign in, it wont even remember me, auth codes also change every session I play. it was a very bright idea (no) but it wont work with this game please remove this crap

[Blkunxpd]

..generate new code from the client/ingame only after 3 failed attempts, not every time when the IP has been changed
with other words..make it permanent as long as you know it, with the optional ability from the website to refresh/resend it in case you forget it.

The ingame protection gotta be reworked that way. The design made for website logins simply not work for the client and it had already been proven.
We can later edit the login @ client to remember our codes, based on which account we're logging = the security level remains, but you skip all the nasty auth process.
If 3 failed attempts are too much, then you can simply resend on every, but I doubt someone is that lucky to get your code right (after already having the login details) with just 3 attempts.

[Obnoxious]

Hey, since you keep ignoring and dismissing our concerns RE: expiration times

I'm neither ignoring, nor dismissing. It simply isn't the sort of thing for me to comment on. That goes beyond server policies. What I can tell you is that developers have been made aware of that complain, and that I, as well as others, have experienced receiving an expired code, but rarely and without any discernible pattern (like once when accessing from a different device or location, at times). Past that, it would be on a developer with direct contact with this tool to say.

Sounds like really bad timing with Gmail also announcing they'll be deleting inactive accounts, how much of the player base will get caught out by this and lose access to their accounts forever, I can almost guarantee It's not going to be 0.
I'll laugh when (not if) Warmane's flagged on gmails blacklists for sending too many emails, best of luck trying to fix that.
Maybe it also wouldn't be so bad if Warmane didn't hard-lock accounts to only gmail.

What really wouldn't be bad would be people reading the first post in this thread...

[sekolaman]

So have hundreds of others. You're in ticket line. Forum posts won't hasten the process.

I'll bet it will be thousands by next week. Let's say only 1/3 of active players (i believe more than 1/2) don't have their gmail account, how many accounts will be wiped out? Don't forget lots of players can't login, can't speak english, can't write on forum, play only once every 1-4 weeks, play other games, etc and they haven't realized that their accounts got wiped by new policy. Don't underestimated the impact.

[Obnoxious]

how many accounts will be wiped out?

None.
Zero.

No clue where you read anything that could be somehow twisted into "accounts that don't authenticate will be wiped."

[dike]

Any ETA on when 2fa reset option will be available again or is it gone forever? (support already changed email on one of my accounts to one that isnt dead, but i still have no way to reset 2fa through mail)

[Obnoxious]

Any ETA on when 2fa reset option will be available again or is it gone forever? (support already changed email on one of my accounts to one that isnt dead, but i still have no way to reset 2fa through mail)

Not sure what you mean reset.
The option to turn it off? If so, it's gone and not coming back.

[dike]

Not sure what you mean reset.
The option to turn it off? If so, it's gone and not coming back.

i was talking about an option from account retrieval page. (i used google 2fa on all of my accounts, but at some point in time i upgraded firmware on my smartphone without backup kekw, i retrieved all of my accounts back, but one. so now even tho that account is linked to proper gmail, i still cant login at website cuz it asks google 2fa code)

[Sathor]

Not sure what you mean reset.
The option to turn it off? If so, it's gone and not coming back.

He's got the same problem as me: my main account is stuck in limbo until I can disable 2FA through the website on the Retrieve page. I emailed support asking when the option will be re-enabled only to get a bunch of ETAs that never come to pass.

So this is conflictiing information: Support told me it'd be back, they never said it's gone forever, but now you are saying it is. Can we get a concrete answer on this please?

[Obnoxious]

No, this is about two separate things.

I'm saying every account will have to use 2fa from now on. That's a fact, there's no turning it off or opting out of it, everyone will have to use 2fa, be it by mail or an authenticator app.

Dike clarified he's talking about having a problem with a Google authenticator he can't access anymore in one account. That would have to be disabled, but only at the same time as the mail or a new authenticator 2fa is enabled, which could be what Support said will come, I don't know.

[dike]

No, this is about two separate things.

I'm saying every account will have to use 2fa from now on. That's a fact, there's no turning it off or opting out of it, everyone will have to use 2fa, be it by mail or an authenticator app.

Dike clarified he's talking about having a problem with a Google authenticator he can't access anymore in one account. That would have to be disabled, but only at the same time as the mail or a new authenticator 2fa is enabled, which could be what Support said will come, I don't know.

ye, i have no problems with 2fa, have been using it since implementation.
according to support email on that account was updated according my request and been told that i need to use 2fa disable from retrieve page (so i can link it to a current device) which would be available after couple of hours, but 2 days after nothing happened

[Sathor]

Dike clarified he's talking about having a problem with a Google authenticator he can't access anymore in one account.

Which is my exact same problem, so what we are asking is, when is the option to do that through the Retrieve page going to become available?

I'm not hopeful about you having that kind answer, but as I said, even the estimates I received from Support were incorrect, so it doesn't hurt to ask.

[Obnoxious]

As I said, I don't know. My guess in those cases would have been that they would be disabled internally, concurrent to email 2fa being enabled, not that disabling in the page would be available again, as that feels counterproductive to the policy that some form of 2fa will have to remain active (I can picture people wanting to disable it to not have any on). It's news to me that that was going to happen, so I don't have an answer right now.