Diablo 3 Discussion Thread

I don't remember the cost, but when they only had the keyfob way back when I got it for my GF. The authenticator itself didn't cost anything, they just wanted a few bucks for shipping. To ensure the security of her account the ~$10 was well worth it.

Both Android and iPhone apps are free. They probably have ones for tablets to or whatever considering it uses the same OS.
 
LeninGHOLA said:
Clue me in, then. If I have to deal with being hacked, I probably won't be playing Blizzard games.
Click to expand...

It's not just Blizzard games. Don't go to shady sites and choose a secure password you don't use on any other site.
 
Skizzy said:
It's not just Blizzard games. Don't go to shady sites and choose a secure password you don't use on any other site.
Click to expand...

I don't. I've never had an MMO account hacked, it just *seems* there are more issues with Blizzard games.
 
My friend got hacked last Tuesday, and his characters were completely wiped-- Demon Hunter and Witch Doctor.

Blizzard did restore his account 72 hours after he got hacked. He didn't use an authenticator before the hack and he's changed his password to his Battle.net account about three times in the last year.

After he got hacked, I recommended he do the following:
1. Change the password and be sure it uses the MAXIMUM length of characters allowed by Battle.net, which I believe is 20 characters. Be sure it's a mixture of upper and lower case characters, and numbers.

2. Get an authenticator-- mobile app (free) or from the Blizzard store ($6.50). It's practically foolproof unless some enterprising hacker figured out how to do session hijacks or bypass the login servers entirely. (Highly impossible but still likely.)

3. Make sure to set the option under Security on Battle.net to REQUIRE the authenticator everytime you log in.

4. Optionally: If you're too paranoid, get the second number from the authenticator after clicking it three times at least. A new 6 digit number should appear.

I've also scanned his computer after he got hacked. There were no keyloggers, no rootkits, no malware, no spyware, no viruses. And, this is using everything I use for my customers. His computer is practically clean. He's smart enough to not go to suspect sites or click on phishing links. Also, he's never played WoW in his life. The only MMO he plays is EVE Online.

Therefore, the hacks are coming from one of three possible places:
1. The hackers are brute-force guessing the simpler passwords on the Battle.net accounts.

2. The hackers have managed to session hijack or inject code directly onto the Battle.net/Diablo servers or Diablo auction house servers. This, of course, renders the authenticator practically useless if this happens.

3. The hackers are coming internally. Criminal but possible. What employee wouldn't want to make a quick buck? Or, what if an employee has given access to an RMT company to get to these accounts? Still not outside the realm of possibility.

Having played Final Fantasy XI when there was a huge wave of hacks back around 2006 or 2007 if I recall, a lot of the hackers are RMT/"gold sellers". The only way you can tell is when the character suddenly reappears on the server or is moved to another server and begins spamming chat with the RMT's website.

I would not be surprised that the same is being done here, and that some of the hackers (not all) are moving from WoW to Diablo 3. Given that the real money auction house is coming online on or around May 29th., I would not be surprised at all that the number of hacked accounts will increase unless something is done about it.
 
A lot of passwords get compromised from shady forums / sites that sell a list of emails and passwords to these "hackers".

Also, I'm fairly certain a lot of accounts were likely compromised months ago. They were likely waiting for D3 to launch before stripping people for profit.
 
ashmelev75 said:
I must point...

DIAL-IN AUTHENTICATOR ONLY WORKS FOR WOW. DOES NOT WORK FOR DIABLO3!!!!!!!!!!!!!oneoneoneeleventyone

Use a physical key-fob or smartphone app.

http://us.battle.net/support/en/article/battle-net-dial-in-authenticator-faq#q-7
Click to expand...

Well that's bullshit, why wouldn't it work for D3?

I have a lot of games in my battle.net account, so it'd suck to have it hacked, yet--this will bump the price to play D3 up to... $72, safely. Though i played WoW since day one, and have never been hacked.
 
ashmelev75 said:
I must point...
DIAL-IN AUTHENTICATOR ONLY WORKS FOR WOW. DOES NOT WORK FOR DIABLO3!!!!!!!!!!!!!oneoneoneeleventyone

Use a physical key-fob or smartphone app.

http://us.battle.net/support/en/article/battle-net-dial-in-authenticator-faq#q-7
Click to expand...

Yeah, definitely need to emphasize that. THE DIAL-IN IS WOW-ONLY!!!

It's smartphone app (FREE) or key fob (NOT FREE).

I'm not sure if the smartphone app will work on Android or iOS emulator from their respective SDK or the Bluestacks program.
 
FYI, no one said the authenticator's are required. Just helps.
 
BiH115 said:
FYI, no one said the authenticator's are required. Just helps.
Click to expand...

True, but in a world where hacking and security issues are so prevalent with the basic requirements sites/programs use, 2-factor authentication really helps. It should almost be required imo.
 
Dallows said:
True, but in a world where hacking and security issues are so prevalent with the basic requirements sites/programs use, 2-factor authentication really helps. It should almost be required imo.
Click to expand...

I think it should, especially with the sorta low level security Blizzard has. I would have bought a retail box if they included it.
 
LeninGHOLA said:
I think it should, especially with the sorta low level security Blizzard has. I would have bought a retail box if they included it.
Click to expand...

I wouldn't say they have low security, it's just that there are way more people trying to hack them. Anything can be hacked with enough time/man power. It's the same argument Apple uses when they say they don't get viruses. It's not that Windows is less secure than Apple, it's just there are way more people trying to hack Windows.
 
octoberasian said:
Therefore, the hacks are coming from one of three possible places:
1. The hackers are brute-force guessing the simpler passwords on the Battle.net accounts.

2. The hackers have managed to session hijack or inject code directly onto the Battle.net/Diablo servers or Diablo auction house servers. This, of course, renders the authenticator practically useless if this happens.

3. The hackers are coming internally. Criminal but possible. What employee wouldn't want to make a quick buck? Or, what if an employee has given access to an RMT company to get to these accounts? Still not outside the realm of possibility.
Click to expand...

I think its a combination of #1 above and stealing from other sites/forums. Many people use the same user name and password on many sites, like their email, forums, games, etc. So if they get a list of a bunch of email users names and passwords for instance, they will try them in WoW or whatever too.

We always made our guild leader and officers in WoW have the authenticators then restricted the guild bank and such to only officers could withdraw. This was after like 5 or 6 guild bank heists from other guilds in WoW and I only played during Wrath. I wouldn't necessarily say that Blizzard is doing anything wrong with security but they aren't really trying to eliminate the problem either. Like I think Rift started something where if your IP was different from the last time you logged in it coin locks you, where you can't really sell or buy until you unlock your account. Not that its fool proof, but at least its proactive...
 
LeninGHOLA said:
I think it should, especially with the sorta low level security Blizzard has. I would have bought a retail box if they included it.
Click to expand...

chockomonkey said:
that's a good idea, not sure why they haven't thought of this.
Click to expand...


Well unless Blizzard has some crazy deal/contract with RSA (pretty sure that's who makes them. That's what my company uses anyway), each physical keyfob is purchased AND licensed. So the cost is pretty high I believe.

Doesn't look like Blizzard uses RSA it seems. Either way it's not reasonable for them to do that.
 
I just picked up the Smartphone one for free..and blizz rebooted my toon to bad it took me back 5 lvls and back to nightmare..
 
Scooty Puff Sr. said:
I wouldn't say they have low security, it's just that there are way more people trying to hack them. Anything can be hacked with enough time/man power. It's the same argument Apple uses when they say they don't get viruses. It's not that Windows is less secure than Apple, it's just there are way more people trying to hack Windows.
Click to expand...

Yes, yes. Though, I visit some forums that have better password security.
 
I don't think the issue is password strength; as said before, brute force attacks are pretty easily blocked. They're getting the passwords via other methods.

I will say one thing that I notice I like much better about D2 than D3 - actually leveling your skills. I do really like the new system of being able to shuffle skills and runes; I don't like not actually getting points to level one. Leveling feels much less of a "WOW" moment, your damage hardly increases from the small stat points you get. Plus, with 60 being the hard cap, you don't have the constant psychological goal to grind up to a higher level. I loved that about D2, none of the level caps you see in every other game. No real "+3 to Hydra" or whatever; one of the most fun toons I made in D2 was a ridiculous charged bolt sorc, with something like a level 32 charged bolt and 310% increased cast speed...just hold down and fill the screen with hundreds of charged bolts!

It makes everything solely dependent on your weapon; I finally leveled to 56 and was able to use a staff that took my dps from 4k to 6k - a 50% damage increase solely due to one item. That's crazy.
 
Nice catch on the dial-in. I added mine a long time ago and didn't really think twice about it.

Going to see if the Android one works on my tablet.
 
TwistedAegis said:
I don't think the issue is password strength; as said before, brute force attacks are pretty easily blocked. They're getting the passwords via other methods.

I will say one thing that I notice I like much better about D2 than D3 - actually leveling your skills. I do really like the new system of being able to shuffle skills and runes; I don't like not actually getting points to level one. Leveling feels much less of a "WOW" moment, your damage hardly increases from the small stat points you get. Plus, with 60 being the hard cap, you don't have the constant psychological goal to grind up to a higher level. I loved that about D2, none of the level caps you see in every other game. No real "+3 to Hydra" or whatever; one of the most fun toons I made in D2 was a ridiculous charged bolt sorc, with something like a level 32 charged bolt and 310% increased cast speed...just hold down and fill the screen with hundreds of charged bolts!

It makes everything solely dependent on your weapon; I finally leveled to 56 and was able to use a staff that took my dps from 4k to 6k - a 50% damage increase solely due to one item. That's crazy.
Click to expand...

I'm with you, 100%. I like taking those 5 minutes after getting a level and pumping points into skills. Makes you feel like you accomplished something, and makes your build a bit more unique.

I'm at a point on my monk where I'm swapping a couple skills back and forth over and over trying to see which works better in most situations. I'd give anything to be able to pump one up over the other so I can actually feel the difference.
 
ob1 said:
Like I think Rift started something where if your IP was different from the last time you logged in it coin locks you, where you can't really sell or buy until you unlock your account. Not that its fool proof, but at least its proactive...
Click to expand...

TERA Online does something similar in such that if you log onto an unrecognized computer, you'd have to get a verification code via email.

I wish game companies do that more often.
 
ob1 said:
Like I think Rift started something where if your IP was different from the last time you logged in it coin locks you, where you can't really sell or buy until you unlock your account. Not that its fool proof, but at least its proactive...
Click to expand...

A lot of games do that actually. Vindictus was one of them.

I would log in on my laptop somewhere else quite often and I couldn't use the mailbox / vendor anything for 10 minutes. It delays the intruder by ... 10 minutes. The only time it would be helpful is if they logged on while you were on and booted you off. You now have 10 minutes to do something about it.
 
Do you think the hacking would be less if there was never any auction house or RMAH?
 
vary said:
Do you think the hacking would be less if there was never any auction house or RMAH?
Click to expand...

No, accounts were hacked all the time in D2 and there was no auction house in game. There's always a market for items to be traded in real currency, D2 had a strong one. Lvl 99's were constantly sold, accounts were stolen for items and the items auctioned off online. It happens regardless of an inhouse auction house.

I
 
vary said:
Do you think the hacking would be less if there was never any auction house or RMAH?
Click to expand...

No. It's a hugely popular game and big target; if anything the gold would be sold on 3rd party sites. Hell, it is already being sold on 3rd party sites. I'll be completely honest, I bought gold for WOW a few times, mainly because grinding crafting was a PITA; I'm getting spammed constantly now with D3 gold sale offers.
 
dremic said:
Ive been thinking about buying a keychain one instead. I mean smart phones break all the time. if it does youre fucked ;P
Click to expand...

My smart phone doesn't "break." Not sure if you mean physically, or software wise. They made it pretty easy to recover and move to a different phone I think. I wouldn't worry about it unless you have some issue keeping your things in once piece.
 
vary said:
Do you think the hacking would be less if there was never any auction house or RMAH?
Click to expand...

Nope. This happens in every RPG type game.

Almost all of these "hackers" are gold sellers. Botting / farming a game is so much less efficient than just stripping players and selling the gold back to them to re-gear (sinister isn't it?). And this happens regardless of RMAH or not. Gold sellers also likely won't go through the RMAH because of blizzard's fees.

BTW... 100k D3 gold is going for $5 at the moment.
 
You must log in or register to reply here.
Back
Top