Password Recovery sugestions!! Open discussion

[slapen]

Originally Posted by naekko [You must be logged in to view images. Log in or Register.]

I'm really against anything that allows users to change their passwords in-game (via a command in chat or something). I give out my password to a lot of people I know in-game (so they can log in my cleric at Seb entrance and res their group if they need to, etc.) and I like the separation of EQEmu and loginserver. It means they can't ever change my password and take off with my character.

I hope we maintain that separation in any system Rogean decides on. It's superior to any of the MMOs out there where giving your login means possibly losing your account if you're not careful.

What we are sugesting would actualy make your pw more secure because currently if someone hacked your eqemu he could change your pw and you would never be able to recover it. This way the original owner always can get it back I love it.

[nambar]

The issue as I understand it:

There are people out there with outdated Eqemu forum databases dumps with hashes of all the forum passwords. Any method of recovery has to take this into account.

Why not make a new form hosted on EQemu that for a short time will allow people to reassociate their loginserver account with another forum account? Make it last two weeks or a month to give everyone a chance and those who miss it, too bad (if you're that inactive does it matter if hackers control your accounts?).

Then after this grace period you can react whatever recovery method you want knowing most accounts are secured. Those who lost access to their EQemu forum account but still had access to their LS account have had a chance to get it straighten out.

I like the idea of e-mail being included someway in the recovery option but that's up to you.

Something as successful as EQEmu and P1999 really needs a password recovery option. I've lost access to one of my LS accounts and I cry a little every night thinking how much time I wasted that I can't recover. <-- Truth

[Zereh]

Bump ~ because it's a huge issue not to have a method of recovering or resetting passwords without having Rogean do it.

[SpartanEQ]

Originally Posted by Rogean [You must be logged in to view images. Log in or Register.]

The email address for an eqemulator account can be changed without requiring any confirmation; That's the point... The system was designed to be used in situations where a user didn't have access to the email address currently on file, so why would it require confirmation from the old address? That would be silly.

I may be dense, but I don't get it. Why wouldn't the person have access to the current email address on file? How often would that be true? Maybe if someone gave their forum account to someone else, and if someone forgets how to log in to their old email account, all email providers that I've ever seen have their own password recovery methods. What am I missing?

EDIT: I just read my post and realized it may have sounded like I was being critical. I'm not. I just really am that dense and don't get it.

[Littlegyno]

What could happen is Rogean use his 10 million dollars he's stolen from P99 peoples and have those WOW account key dongle's made. Then he could use tax records and SSN's to verify the account ownership and send the account owners the key dongles.

[Dalsegno]

I'm trying to think of a way to handle ls server account account recovery/password recovery options I have a few questions for Rogean though since I don't know how the servers operate.


From reading here i have gathered the only way the Forum account is tied to the LS account is through creation and display you can't control anything on the ls account from the forum account correct?


Since they are tied in some way albeit limited is it possible to pull known characters on an EQEMU server just by knowing a forum account name?

Example: I have my forum account and 1 LS account, On that LS account I know I have a character on P99 named Newguy. By knowing a forum login only and possibly required the EQEMU server name is there a way to return Newguy from a query?

My idea is to have a dropdown of server listings and build a query to return a character name that exists on an LS account that would have to be an exact match on an input. This should be a complicated but good way to verify original or existing owners of an LS account, you have a main you should remember it's name.

the downside is LS account names being compromised if you know a character name on the LS account you would be able to gain access, which, I would hope the EQEMU users would be secure enough to not give out their LS account names.

It's not 100% foolproof as people do forget things so in extreme cases GMs/Rogean would have to manually reset password for LS accounts but it might be a nice thing to try out for automation.

[SpartanEQ]

Originally Posted by Rogean [You must be logged in to view images. Log in or Register.]

The email address for an eqemulator account can be changed without requiring any confirmation; That's the point... The system was designed to be used in situations where a user didn't have access to the email address currently on file, so why would it require confirmation from the old address? That would be silly.

How about a three security question set-up that doesn't involve email addresses at all? Just brainstorming here.

On a side note, after hours of trial and error after error I somehow let my mind wander and my fingers just typed the correct password. I'm in (5 months later)! It's a password I've never used before and is not used anywhere else.

So, I guess the final solution to this problem is hypnotism.

[bomaroast]

After having not played for several months I can't remember the password to my account. I can't imagine why its not one of the few passwords that I've used over and over. So much gone [You must be logged in to view images. Log in or Register.]

[bomaroast]

If I could get my password back I would be a daily player until spring.. I wonder how many others have been in this same position.. start from scratch on a server with way too much platinum on it or nothing... sigh

[Adnan]

bump.