3 ms·

We were very seriously considering if we should block China from our game servers recently. The reason is massive account compromises of our users. There are 3

We were very seriously considering if we should block China from our game servers recently. The reason is massive account compromises of our users. There are 300,000 IPs from China that are just trying public leaked email / password databases against our servers. With so many IPs, any kind of normal per IP limiting just doesn't work. Each IP is only trying 10 or so accounts per day. Blocking China was potentially a very real solution because I just don't think that they would have access to other bot nets of that sheer size outside of China. The trouble is that the users don't understand that they are pre-compromised before they even arrive. Anyway, we have now implemented a system whereby accounts get locked if someone attempts to log in from a different country than last time and they have to type in a verification code sent to their email. All the "My account got hacked" support requests have been replaced by an equivalent number of "Why does my account keep getting locked" support requests. But there you go.

mrb 14y ago
You should implement automatic unlocking of the account if the auth attempt is successful and comes from the "usual" country (or from the same "usual" IP).
- Negitivefrags 14y ago
  We talked about this for a while and decided that, at least at first, we want to lock out the original owner. The reasoning behind this was that their actual password is compromised. We want to make sure that the user understands this fact and changes their password. Not only on our service, but on all the others that they may be using the same password for as well. The email does say that someone else has your password, but if you can just ignore the email then most will not actually get it or assume it's some kind of phishing email.
boredguy8 14y ago
I was about to link this story back to Path of Exile folks given what's happened there. When I saw your post, I looked at your profile - nice that you're here! For what it's worth, you should consider locking not on attempt to log in, but on successful login from abroad. This was an old problem in some Windows networks: accounts would be locked with 5 failed logins. People discovered they could lock out friends' accounts (or ahem the president's) by failing a login 5 times. (P.S. If anyone's looking for a great way to waste more time than they should, Path of Exile is a pretty great game.)
rz2k 14y ago
I suppose it doesn't matter for your service, but that would tend to automatically block people who use the Tor network.
mergy 14y ago
It's tough. Security vs. ease of use for the end-user.

mrb 14y ago

You should implement automatic unlocking of the account if the auth attempt is successful and comes from the "usual" country (or from the same "usual" IP).

Negitivefrags 14y ago
We talked about this for a while and decided that, at least at first, we want to lock out the original owner. The reasoning behind this was that their actual password is compromised. We want to make sure that the user understands this fact and changes their password. Not only on our service, but on all the others that they may be using the same password for as well. The email does say that someone else has your password, but if you can just ignore the email then most will not actually get it or assume it's some kind of phishing email.

boredguy8 14y ago

I was about to link this story back to Path of Exile folks given what's happened there. When I saw your post, I looked at your profile - nice that you're here! For what it's worth, you should consider locking not on attempt to log in, but on successful login from abroad. This was an old problem in some Windows networks: accounts would be locked with 5 failed logins. People discovered they could lock out friends' accounts (or ahem the president's) by failing a login 5 times. (P.S. If anyone's looking for a great way to waste more time than they should, Path of Exile is a pretty great game.)

rz2k 14y ago

I suppose it doesn't matter for your service, but that would tend to automatically block people who use the Tor network.

mergy 14y ago

It's tough. Security vs. ease of use for the end-user.