[UPDATED] Account security improvements

[Edifice]

The system has been re-enabled, the sending of codes should now be instant, regardless of volume.

We may enable the use of non-gmail emails over the coming days.
We will also introduce a username changing system, for those that receive a lot of suspicious TFA requests.

As someone mentioned, this is indeed a forced-2fa change, as with most modern platforms, security is paramount.
This is a step to bring us in line with other services, reduce our overheads for account compromise support and overall increase account security which is our #1 priority right now with recent compromising waves.

Regardless of players dislike for the system, It is a step in the right direction. The alternative is 'Bot Network' bans continue due to large target on our back, slower support due to amount of attention given to compromised accounts and restoring as much as possible for the player, following the hot-potato like movement of stolen items, gold, coins, characters between hundreds of accounts and so on.

[Neurotox6]

Hi everyone,

To maintain the security and integrity of accounts, we are modernizing how both web and game logins are handled.

From Monday, 18 September at 22:00, if you do not already have Email Two-Factor Authentication or Google Two-Factor Authentication and In-game protection enabled, you will be prompted to enter a code when logging in. This code will be sent to the email address that's currently attached to your account.

The "in-game protection" setting will also be removed.

Overall, this system will function similar to other services. Once you've entered the required code to log in, you will not be prompted again unless you are connecting from a different location.

This change affects all accounts and will be a requirement to log in.

You can review your current email by logging into the website and visiting My Account.
Emails can also be updated within the Settings page.

Frequently Asked Questions

I'm not receiving any emails

Spoiler: Show

Authentication emails may be slightly delayed during peak times.

If after a minute you haven't received the code, double check your emails Spam or Junk folders as it may have been filtered there.

If still no authentication email has been received, we recommend double checking you're logged into the same email as the one displayed within the My Account section of the website. You could also update your accounts email to a new one as your email service provider may have incorrectly labelled the email as spam.

Invalid code?

Spoiler: Show

Ensure that you do not close the authentication request when logging in. Simply log in and when greeted with the authentication request, navigate to your email and then copy paste the newly sent code in without closing the request.

Repeatedly restarting the authentication process will cause the previous code to expire.

I have lost or forgotten my email and cannot access my account

Spoiler: Show

Simply email us directly for assistance - [email protected]

It's helpful if you include anything you recall surrounding the account to assist us in verifying your ownership in a timely fashion. Such information includes but is not limited to:

- Account or Forum username (not passwords).
- Current email or a guess if you have forgotten
- Character information
- General account history. For example, "I claimed the holiday gift on my Paladin back in 2018, maybe 2019?"
- Country where you connected or registered from

You may also include a new email address that you would like your account to be updated to. If we have enough information, we'll be able to update your account immediately without the need for further verification.

You guys need to make it possible to see what e-mail is registered to your accounts...
I have so many different accounts to make it easier managing addon specific settings & I do not remember every single e-mail for every single account.

Please for the love of god... At least show which e-mail is registered to the account when you try to log in and get the new authenticator bull**** pop up.

[kngjms]

I'm locked out of all my accounts, I use the phone app Google Authenticator, it has allways worked for me in the past, I've made no changes, and it works fine on the website for every account, but none work in game. I've logged into multiple accounts, and re scanned the QR code to refresh the authenticator, to no avail.

Any idea when this is going to be fixed?

[kngjms]

also , trying to change to email 2fa doesn't work as it says the code is wrong also.

[rakeisho1995]

Your code sending is really slow also app authenticator doesn't work. I got 2 account and now my 2nd account is getting locked because i don't have access to it and i am losing my account because of that update of security. How do you keep planning saving your players from leaving while you purposely making everything harder. I've spent so many hours on my 2nd account and i can't log on it and i am not getting a response with new updated email for the account how.

[LezChap1]

You guys need to make it possible to see what e-mail is registered to your accounts...
I have so many different accounts to make it easier managing addon specific settings & I do not remember every single e-mail for every single account.

That's why they gave you notice BEFORE the change...if you click "My Account" in the top left, the email registered to the account is the 4th line of text under "Account Summary".

[Davodza]

Who is the guy behind this decision? I cannot even get into my own account with my own email! Why you make our experience worse? Tell us? Everything was fine before!

[LezChap1]

We may enable the use of non-gmail emails over the coming days.

I hope this includes allowing us to use the "." and "+" feature of Gmail (and many other service providers).

We will also introduce a username changing system, for those that receive a lot of suspicious TFA requests.

This sounds like a positive change as well, for users who have people trying to brute-force or lock them out of their accounts.

Overall, I agree that 2FA is a step towards industry norms that should reduce the impact of nefarious actors on the server.

[fengcheche021]

My other account, a Google account that I haven’t used much, has become an inactive account and was deleted by Google. What should I do if I can’t use my email?

[LezChap1]

My other account, a Google account that I haven’t used much, has become an inactive account and was deleted by Google. What should I do if I can’t use my email?

Perhaps you should read the announcement:

Hi everyone,
-snip-
I have lost or forgotten my email and cannot access my account

Spoiler: Show

Simply email us directly for assistance - [email protected]

It's helpful if you include anything you recall surrounding the account to assist us in verifying your ownership in a timely fashion. Such information includes but is not limited to:

- Account or Forum username (not passwords).
- Current email or a guess if you have forgotten
- Character information
- General account history. For example, "I claimed the holiday gift on my Paladin back in 2018, maybe 2019?"
- Country where you connected or registered from

You may also include a new email address that you would like your account to be updated to. If we have enough information, we'll be able to update your account immediately without the need for further verification.

[Blkunxpd]

The system has been re-enabled, the sending of codes should now be instant, regardless of volume.

We may enable the use of non-gmail emails over the coming days.
We will also introduce a username changing system, for those that receive a lot of suspicious TFA requests.

As someone mentioned, this is indeed a forced-2fa change, as with most modern platforms, security is paramount.
This is a step to bring us in line with other services, reduce our overheads for account compromise support and overall increase account security which is our #1 priority right now with recent compromising waves.

Regardless of players dislike for the system, It is a step in the right direction. The alternative is 'Bot Network' bans continue due to large target on our back, slower support due to amount of attention given to compromised accounts and restoring as much as possible for the player, following the hot-potato like movement of stolen items, gold, coins, characters between hundreds of accounts and so on.

Allowing custom emails will be big +, at least to old/proven not to be bot accounts.
Currently, the only way to change it to something like that is using "..@gmail|warmane.something.com" e.g. the regex allows it, but it should start with either warmane or gmail subdomain

[darkalexiao]

I'm completely locked out of one of my accounts with absolutely no way of retrieving it due to the email address i used to register the account with was the email that i registered with an old phone number at least 5 years ago....whenever i try to log into this email address goggle ask me to verify it with the old phone number that i no longer have access to. now i am totally screwed and i am 100% affirmative there are also other peoples in the same boat. how about you guys temporarily disable this stupid *** system for a few days and let us change the email address before re-enable it?? I completely understand what you guys trying to offer here is to bring more securities across the board but at the same you also screwed over tons of peoples who are in the same predicament like i am.

[fengcheche021]

[I have sent my request to [email protected] he never replied to me and kept resetting the password of my current account!

[Blkunxpd]

Allowing custom emails will be big +, at least to old/proven not to be bot accounts.
Currently, the only way to change it to something like that is using "..@gmail|warmane.something.com" e.g. the regex allows it, but it should start with either warmane or gmail subdomain

Which means that the forced usage of GMail for all the years wasn't really security measure against bots, but just discomfort for the players. :P xD

[Healerjade]

I enter the page only for the server points, then I don't even pay attention to the rest. Now I have no idea about the emails from my other 9 accounts. This was optional, why is it now mandatory? I don't want this security.