4 ms·

What is the incentive for people to pretend they own those email addresses?

xupybd 8y ago
No idea the only feasible possibility I've come up is to damage Epics customer relations. I don't know maybe it was just some idiot with a list of emails and script but no real game plan. Here is the an article discussing others with the same issue https://twinfinite.net/2019/03/psa-epic-store-doesnt-validate-email-addresses/ https://twinfinite.net/2019/03/psa-epic-store-doesnt-validat... Here is the last email I got from Epic: Jan E. March 15, 2019, 11:39 +1300 | Conversation ID: #9950515 Hi (Player's Name), Thanks for the information! I know how important it is for you to update and change your country to your Epic account. No worries, I got your back and I'll do my very best to assist you with your request. Additionally, I know how frustrating it can be. Please know that here at Epic Games, we are serious about the player's security and we assure you that your email address is secured as long as you keep the password updated or enable 2FA. In order to change the country on your account I will need you to reply with an image of one of the following items with your name and address visible: Passport Personal identification *Recent rent or mortgage statement Any other personal information should be blacked out. I'll be looking forward to hearing from you soon.
- RandomTisk 8y ago
  Canned response hell. So helpful it isn't.
- philpem 8y ago
  "No worries, I got your back - here's a canned response!" That is by a considerable margin the most patronising, "how are you fellow kids" canned response I've ever seen.
- thedaemon 8y ago
  Are you required to prove your Country on sign up? I think not. So why all of the rigmarole to change it? I'm guess for legal reasons.
  - dave7 8y ago
    It's because games can be cheaper in countries where the economy is weaker. $60 in USA is a standard price, but that's outrageous in Thailand, and here Epic might charge the equivalent of $30. They do not want people shopping around for the cheapest country to purchase games from. A passport is somewhat ridiculous, as is the lack of initial email verification, of course.
RunningDroid 8y ago
Probably either Denial of Service or hoping a way to make money off it became available later.
callalex 8y ago
Epic can report huge user growth numbers in the hot and growing Asian market to their investors.
- jrockway 8y ago
  Ah, the Twitch model -- where half of its users are spambots and the other half are viewbots.
michaelmrose 8y ago
Edit: I am effected by this issue. I am of course not dumb enough to add a credit card to the account. If they allow you to log on in via a third party authentication like log in via google account or log in via facebook etc I foresee a flow like this. Create a bunch of fake accounts attached to various emails. For each account periodically check to see if a new method of payment is attached to the account. When one is immediately buy a bunch of gifts for other users that will be sold through some side channel like facebook/whatsapp/what have you. Example make a post on any sort of forum say message me to buy a copy of $40 game only $10 for the first 5 users to message me. For each user that pays buy a game and send the legit code for the game. This trust will keep you from being taken down immediately or perhaps even at all if the user doesn't notice the losses. This could work because a user could say log in via oauth via another service, link their account to the unknown preexisting account by setting the same email account. Virtually no services allow more than one account with the same email address its the unique key that defines the account. As soon as they create the account the first thing they do is buy a game because most new users installed so they could buy a game from epic. They check whatever box is required to save their method of payment. You now have an account that can be accessed via oauth via the users preferred provider and the hackers chosen password + victims email address with a saved payment method the hacker cannot access directly but can spend and monetize via side channel.
- mr_toad 8y ago
  > This could work because a user could say log in via oauth via another service, link their account to the unknown preexisting account by setting the same email account. For that to work the service would have to allow a login with email/password without verification, and then also allow oauth login to the same account.
  - michaelmrose 8y ago
    They obviously allow account creation without verifying that user controls the email address in the first place so the second isn't much of a stretch. They are grossly incompetent.

No idea the only feasible possibility I've come up is to damage Epics customer relations. I don't know maybe it was just some idiot with a list of emails and script but no real game plan. Here is the an article discussing others with the same issue https://twinfinite.net/2019/03/psa-epic-store-doesnt-validate-email-addresses/ https://twinfinite.net/2019/03/psa-epic-store-doesnt-validat... Here is the last email I got from Epic: Jan E. March 15, 2019, 11:39 +1300 | Conversation ID: #9950515 Hi (Player's Name), Thanks for the information! I know how important it is for you to update and change your country to your Epic account. No worries, I got your back and I'll do my very best to assist you with your request. Additionally, I know how frustrating it can be. Please know that here at Epic Games, we are serious about the player's security and we assure you that your email address is secured as long as you keep the password updated or enable 2FA. In order to change the country on your account I will need you to reply with an image of one of the following items with your name and address visible: Passport Personal identification *Recent rent or mortgage statement Any other personal information should be blacked out. I'll be looking forward to hearing from you soon.

RandomTisk 8y ago
Canned response hell. So helpful it isn't.
philpem 8y ago
"No worries, I got your back - here's a canned response!" That is by a considerable margin the most patronising, "how are you fellow kids" canned response I've ever seen.
thedaemon 8y ago
Are you required to prove your Country on sign up? I think not. So why all of the rigmarole to change it? I'm guess for legal reasons.
- dave7 8y ago
  It's because games can be cheaper in countries where the economy is weaker. $60 in USA is a standard price, but that's outrageous in Thailand, and here Epic might charge the equivalent of $30. They do not want people shopping around for the cheapest country to purchase games from. A passport is somewhat ridiculous, as is the lack of initial email verification, of course.

RunningDroid 8y ago

Probably either Denial of Service or hoping a way to make money off it became available later.

callalex 8y ago

Epic can report huge user growth numbers in the hot and growing Asian market to their investors.

jrockway 8y ago
Ah, the Twitch model -- where half of its users are spambots and the other half are viewbots.

michaelmrose 8y ago

Edit: I am effected by this issue. I am of course not dumb enough to add a credit card to the account. If they allow you to log on in via a third party authentication like log in via google account or log in via facebook etc I foresee a flow like this. Create a bunch of fake accounts attached to various emails. For each account periodically check to see if a new method of payment is attached to the account. When one is immediately buy a bunch of gifts for other users that will be sold through some side channel like facebook/whatsapp/what have you. Example make a post on any sort of forum say message me to buy a copy of $40 game only $10 for the first 5 users to message me. For each user that pays buy a game and send the legit code for the game. This trust will keep you from being taken down immediately or perhaps even at all if the user doesn't notice the losses. This could work because a user could say log in via oauth via another service, link their account to the unknown preexisting account by setting the same email account. Virtually no services allow more than one account with the same email address its the unique key that defines the account. As soon as they create the account the first thing they do is buy a game because most new users installed so they could buy a game from epic. They check whatever box is required to save their method of payment. You now have an account that can be accessed via oauth via the users preferred provider and the hackers chosen password + victims email address with a saved payment method the hacker cannot access directly but can spend and monetize via side channel.

mr_toad 8y ago
> This could work because a user could say log in via oauth via another service, link their account to the unknown preexisting account by setting the same email account. For that to work the service would have to allow a login with email/password without verification, and then also allow oauth login to the same account.
- michaelmrose 8y ago
  They obviously allow account creation without verifying that user controls the email address in the first place so the second isn't much of a stretch. They are grossly incompetent.