www.ClassicTW.com
https://mail.black-squirrel.com/

Game Passwords
https://mail.black-squirrel.com/viewtopic.php?f=1&t=9057		 Page 1 of 3
Author:  Survey_Says [ Thu Mar 07, 2002 9:05 pm ]
Post subject: 
I've read a couple of topics about Sysops taking users passwords and then logging on as that user at a different server to disrupt the game. My question is why does the sysop need to be able to see or have access to game passwords?

Let's say someone forgets their password. WHat do they do, they have to talk to the sysop. Instead of the sysop telling them their password, why not just let them reset it to blank and then allow the player to log back in to change it.

I'm just guessing this is how it would work, I don't own TWGS and have never forgotten my password.

It just seems strange that this is even an issue. Also, why not hide the Corp and ship passwords when they are entered or changed like the game password is hidden with the "*" character? I'm sure there are people who use their login password as their corp and/or ship pw too. If they type in the wrong password because they can no longer see it, you can always put in a confirm, or they could always just change it again.
Author:  Kemper_3 [ Thu Mar 07, 2002 11:09 pm ]
Post subject: 
quote:
I've read a couple of topics about Sysops taking users passwords and then logging on as that user at a different server to disrupt the game. My question is why does the sysop need to be able to see or have access to game passwords?

Let's say someone forgets their password. WHat do they do, they have to talk to the sysop. Instead of the sysop telling them their password, why not just let them reset it to blank and then allow the player to log back in to change it.

I'm just guessing this is how it would work, I don't own TWGS and have never forgotten my password.

It just seems strange that this is even an issue. Also, why not hide the Corp and ship passwords when they are entered or changed like the game password is hidden with the "*" character? I'm sure there are people who use their login password as their corp and/or ship pw too. If they type in the wrong password because they can no longer see it, you can always put in a confirm, or they could always just change it again.




I would just like to say that I agree with this.
Author:  dhunt [ Fri Mar 08, 2002 3:14 am ]
Post subject: 
quote:
I've read a couple of topics about Sysops taking users passwords and then logging on as that user at a different server to disrupt the game. My question is why does the sysop need to be able to see or have access to game passwords?

Let's say someone forgets their password. WHat do they do, they have to talk to the sysop. Instead of the sysop telling them their password, why not just let them reset it to blank and then allow the player to log back in to change it.

I'm just guessing this is how it would work, I don't own TWGS and have never forgotten my password.

It just seems strange that this is even an issue. Also, why not hide the Corp and ship passwords when they are entered or changed like the game password is hidden with the "*" character? I'm sure there are people who use their login password as their corp and/or ship pw too. If they type in the wrong password because they can no longer see it, you can always put in a confirm, or they could always just change it again.




All I can say is, find another game. There are tons of games out there without this distraction. The Sysop needs to have the passwords. I enter the game as sysop and everyone knows it's me. I don't play the game. The Planet that the game makes is up for grabs to the first person that finds it. You can blow my ship up if you can find it and catch it. Since the game will give me a new one to just look into the game, it's no big thing. I don't need to use a users password but I can think of ease of things that I have it.

I run a pretty open game and really don't keep track of who plays the games. Asking me for any password is actually a fruitless request since I have no way of IDing the person. Anyone can request anyone elses Password. i won't give it out lightly. If I don't know the person, I guess they will have to start all over again.



Visit slbbs.com port 2002 for a rip roaring game of TW where you also have to battle the Klingons, Romulans, Orians and the Borg.
Author:  Survey_Says [ Fri Mar 08, 2002 2:40 pm ]
Post subject: 
Nice reply, thanks for the attitude dhunt. You reply as if I am personally accusing you of stealing game passwords.

I notice that you say you just NEED the password but don't give any good reason why that is.

And in response to the find another game remark... I don't appricate it and I'm sure anyone closely associated with the game doesn't either. I thought this was an open forum where I could voice my concerns.

Who knows, maybe someone with enough influence will think this is a good idea and something might get changed.

Or maybe me and everyone else with similar concerns should take your advice and just "find another game". Although, considering I began playing back on version 1.03, I don't think I'm going anywhere just yet.
Author:  dhunt [ Fri Mar 08, 2002 3:26 pm ]
Post subject: 
quote:
Nice reply, thanks for the attitude dhunt. You reply as if I am personally accusing you of stealing game passwords.

I notice that you say you just NEED the password but don't give any good reason why that is.

And in response to the find another game remark... I don't appricate it and I'm sure anyone closely associated with the game doesn't either. I thought this was an open forum where I could voice my concerns.

Who knows, maybe someone with enough influence will think this is a good idea and something might get changed.

Or maybe me and everyone else with similar concerns should take your advice and just "find another game". Although, considering I began playing back on version 1.03, I don't think I'm going anywhere just yet.




First, read what I wrote. This was in the body that you didn't think had a reason. This is the main reason:


I run a pretty open game and really don't keep track of who plays the games. Asking me for any password is actually a fruitless request since I have no way of IDing the person. Anyone can request anyone elses Password. i won't give it out lightly. If I don't know the person, I guess they will have to start all over again.


I made my point with your help




Visit slbbs.com port 2002 for a rip roaring game of TW where you also have to battle the Klingons, Romulans, Orians and the Borg.
Author:  Survey_Says [ Fri Mar 08, 2002 5:21 pm ]
Post subject: 
You say you don't give out the passwords lightly. So why don't you tell me how this relates in any way, shape, or form to what my original question was, why do sysops need the game passwords of the players? You just said yourself that your main reason is that, and I quote,

"I run a pretty open game and really don't keep track of who plays the games. Asking me for any password is actually a fruitless request since I have no way of IDing the person. Anyone can request anyone elses Password. i won't give it out lightly. If I don't know the person, I guess they will have to start all over again."

That's great you run an open game, and that's a good idea that you don't give out the passwords lightly.. but again.. WHY DO YOU NEED IT IN THE FIRST PLACE?

Your main reason doesn't make sense to me, the only reason I could find that you needed users passwords was because (Quoting again) "I can think of ease of things that I have it".

If your next response makes no sense and it looks like you are still not understanding the issue here, perhaps you could refrain from posting further.


My whole post here is to brainstorm an idea to stop bad sysops from cheating at other servers by using stolen user passwords, and eliminate the need of players to "start all over as you put it" but doing away with giving the sysop access to the password and simply letting them reset user passwords upon request of the player.
Author:  dannic [ Fri Mar 08, 2002 10:04 pm ]
Post subject: 
dhunt your post made no sense what so ever. As a sysop you shouldn't be giving out passwords period. You have no reason to need a password from the players. I can't think of a single situation which would require you to use a persons password. Giving out passwords or just knowing passwords is a serious breach of security imho.

I agree with the original poster in this. Maybe.... oh.. just maybe... you might possibly have to do something with a player when it was only accessable via BBS.... but I can't even think of a situation when that would be necessary as well. I know I never needed that when I ran it as a door and I don't need it now as a TWGS server.

I also run a MUD. I have absolutely no need for a players password. There is never a situation where I will need to log on as a specific player on either of these two things. Encrypting passwords would be a good idea.
Author:  dhunt [ Fri Mar 08, 2002 10:12 pm ]
Post subject: 
I disagree and let's leave it at that. Being abusive won't get a thing changed. In fact, I have a feeling that it strengthens any changes one would wish.

Visit slbbs.com port 2002 for a rip roaring game of TW where you also have to battle the Klingons, Romulans, Orians and the Borg.
Author:  Kemper_3 [ Fri Mar 08, 2002 11:22 pm ]
Post subject: 
quote:
I disagree and let's leave it at that. Being abusive won't get a thing changed. In fact, I have a feeling that it strengthens any changes one would wish.


I don't think it's unreasonable to want an explanation. You obviously have a reason why you think you should be able to see users passwords. I, personally, can't think of one, so I would like to know yours.
Author:  dannic [ Sat Mar 09, 2002 1:23 am ]
Post subject: 
quote:
All I can say is, find another game.

I made my point with your help.


I disagree and let's leave it at that. Being abusive won't get a thing changed. In fact, I have a feeling that it strengthens any changes one would wish.


perhaps you should pick your words more carefully so you dont' sound abusive your self when replying to anothers post. If you don't like abusive posts dont' be abusive in your posts. And lets leave it at that.

I'm glad we can come to a disagreement. Three for.... one against. Odds don't look so good.

There are no practical reasons or situations for you to have a password of a player.


"Well what do you know. It disintegrated."

http://www.orpgs.com port 5555 for TWGS
http://www.orpgs.com port 1863 for Karealia
Author:  Rave [ Sat Mar 09, 2002 9:07 am ]
Post subject: 
Make that two against, three for. Odds are looking slightly better.

I can't think of any -solid- reasons why a Sysop -must- have access to a players password. On the other hand, I can't think of any good reasons why a change is needed.

1) Play on boards where you know and trust the ServOp if you feel your password might be "collected" on specific boards. I'm not even going to get into names, but there have (and probably always will be) ServOps that are less than fair, and it's up to you as the player to determine whether or not you want to play at boards that have or had have "reputations."

2) If you use the same password in every game and a ServOp decides to steal it to log into your account on another server and CBY you or some such thing, you're equally to blame as the ServOp. Use different passwords for each game, and for the love of money, if you have a home network (especially Windows) don't use your network password as your game password. Or your router login password if you have a router with remote administrative functions. -You- are primarily responsible for the security of your password (and thus your games), -not- the ServOp.

3) If it ain't broke, don't fix it. If you follow the above two guidelines, you'll probably never have a problem.

Another long-winded post courtesy of:

Lisa M. Wilson
aka Rave
uhndagrowhn bbs

uhndagrowhn bbs
telnet://uhndagrowhn.merseine.nu
Author:  Doctor Who [ Sat Mar 09, 2002 9:41 am ]
Post subject: 
quote:
Make that two against, three for. Odds are looking slightly better.

I can't think of any -solid- reasons why a Sysop -must- have access to a players password. On the other hand, I can't think of any good reasons why a change is needed.

1) Play on boards where you know and trust the ServOp if you feel your password might be "collected" on specific boards. I'm not even going to get into names, but there have (and probably always will be) ServOps that are less than fair, and it's up to you as the player to determine whether or not you want to play at boards that have or had have "reputations."

2) If you use the same password in every game and a ServOp decides to steal it to log into your account on another server and CBY you or some such thing, you're equally to blame as the ServOp. Use different passwords for each game, and for the love of money, if you have a home network (especially Windows) don't use your network password as your game password. Or your router login password if you have a router with remote administrative functions. -You- are primarily responsible for the security of your password (and thus your games), -not- the ServOp.

3) If it ain't broke, don't fix it. If you follow the above two guidelines, you'll probably never have a problem.


I think your wrong here lisa .. it's not the users fault .. I'me in 6 games atm .. combine that with the fact that 3/4 of those will end each month .. and i'll start a new one to replace it .. so by the end of the year .. just for game passwords i'me playing .. i'll have a total of 48 passwords .. lets combine that with bbs/system passwords that are needed and we'll have more like 55 or so now .. what about the games I log into to look at the settings .. different passwords there .. 2 a month? 79 passwords a year ..

I do enjoy the game .. but i am not going to make a database to keep up with passwords used and passwords not used .. if someone is really wanting to steal info they'll do it regardless .. I think the idea of keying out the login password itself is fine .. the ship and corp passwords may be a little ott .. but the login passwords being blocked from ops would be fine .. as far as dhunt goes .. I'me sure he wants to log into see if they are superscripters or something .. but he can do this using the features that the twgs provides so he shouldnt need to log in .. and if your going to change someones password for them because they have forgotten it .. then why should you see it? ..
lets add in a mothers maiden name or something feild ;)



quote:
Another long-winded post courtesy of:

Lisa M. Wilson



Yea heh .. we could tell when the browser waited 20 mins to load

<<Doctor Who>>
Author:  XenoPhage [ Sat Mar 09, 2002 11:40 am ]
Post subject: 
I wanna chime in here too... :) I work for an ISP and deal a lot with security, so this can be a sore spot for me too. One thing I never liked was having access to a users password. IMHO, it's just not a good way to handle things. All passwords should be encrypted. It's the user's responsibility to remember their password, and be able to provide proof of ID should they forget it.

I agree (a bit) with both Rave and the good Doctor.. No, you shouldn't use the same password for everything, but there is a limit.. Personally, I use different passwords for all of my "absolutely secure" stuff, and basically the same password for games... However, I don't expect gameops to use those passwords...

Having the passwords encrypted would at least up the security a little. I don't think there have been many attacks on TWGS, but should there ever be, I don't want some little script kiddy having my password... :)

--------------------------
~~ XenoPhage ~~
--------------------------
Author:  Survey_Says [ Sat Mar 09, 2002 12:08 pm ]
Post subject: 
Dr Who and Xenophage make good points Rave. I'm a network administrator so I'm probably one of the last people that you need to be telling don't use network and router passwords for tradewars. It is ridiculous though to have to change my password for every game I choose to play in. I already have to remember a gazillion passwords for work and home, and now it is expected that I remember a gazillion more just for one game? Any security person would tell you never write down a password, which is what Dr Who has suggested to remember every password for every different server you might choose to play on.

Your suggestion to only play on servers where you know the server op is also sort of ridiculous. How would new servers (which there are alot of) ever get new players?

And this line is beautiful:
"If you follow the above two guidelines, you'll probably never have a problem."

Let me emphasize the word PROBABLY. That makes me laugh everytime I read it, nothing personal against you, but there have been a lot of instances in the past througout history where I can just imagine people saying the exact same thing and getting burnt for it.

If I know one thing, that's if there is a chance something could go wrong, it probably will... So if you't can't do better than probably there is probably a problem.

This is just a game, but it is also a game that a lot of people put a lot of time and effort into. The last thing players should have to worry about is someone ruining their fun, or ruining it themselves simply because they have become so paranoid and have to put so much effort into keeping track of so many different passwords.

So far I have still heard no good reason why a sysop needs a game password, and the only 2 people who have voiced that they should have them have been syops themselves.

Edited by - Survey_Says on March 09 2002 09:09:25 AM
Author:  dhunt [ Sat Mar 09, 2002 12:30 pm ]
Post subject: 
quote:

I do enjoy the game .. but i am not going to make a database to keep up with passwords used and passwords not used .. if someone is really wanting to steal info they'll do it regardless .. I think the idea of keying out the login password itself is fine .. the ship and corp passwords may be a little ott .. but the login passwords being blocked from ops would be fine .. as far as dhunt goes .. I'me sure he wants to log into see if they are superscripters or something .. but he can do this using the features that the twgs provides so he shouldnt need to log in .. and if your going to change someones password for them because they have forgotten it .. then why should you see it? ..
lets add in a mothers maiden name or something feild ;)

>


I really don't need the passwords since, as you said, The Sysop has access without even knowing the passwords. I don't even know most of the players and there is no reason for me to even know personal information unless that player sends me the data before he or she enters the game just in case they forget their passwords. Otherwise, why would I even bother looking. But, some do forget those pesky things and ask for help. The only thing I can tell most of them is to log on as a new player and start over. I think there are two players that can write me for their passwords and I will respond with it.

You may be onto something about the test question. If a Player, upon login, must answer a personal question, the Sysop could use that to ID that particular individual and then, and only then, release that password. Even though it's a game, security is still important to all of us. If it's not important, why bother having Passwords at all?

Easy answer. To keep people from coming in as YOU and wrecking your game. It's happened to me but due to a very alert Sysop, it was stopped and that person was sent packing. Since, to me, it's still only a game, the Sysop was more nerved by it than I was. Since I have spent a few years getting to know that Sysop on a personal basis, I can write the Sysop and get any password I wish on anything that I am in. People that continuously operate in an ANON basis had better keep track of their passwords. Neither that Sysop nor I will issue those passwords to any individuals we don't know. If you have a Sysop doing this, like I said, find another game. That is your only recourse.

I don't think a drastic change is necessary. The BBS that TWGS is based on always has allowed the Sysop to access those passwords for the convenience of the User. The BBS usually collects enough information to enable the Sysop to do a positive ID on the requester. If this is a problem, add something that the user MUST id before they can even enter the game. Otherwise, just leave it alone.



Visit slbbs.com port 2002 for a rip roaring game of TW where you also have to battle the Klingons, Romulans, Orians and the Borg.
Page 1 of 3 All times are UTC - 5 hours
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/