Add Security Questions

[Hype]

do it these are op if u get hacked u can easily get ur account back where as if u get hacked rn its super hard to get ur acc back

correct me if im wrong

 

[Grace.]

I agree. But - I think they should be optional, where you can continue as you are rn , but if you want to; you should be able to enable them for added security.

 

[Hype]

I agree. But - I think they should be optional, where you can continue as you are rn , but if you want to; you should be able to enable them for added security.

100% bro thanks for adding

 

[Jerry]

https://www.mc-market.org/account/two-step
Don't get hacked at all

 

[Hype]

https://www.mc-market.org/account/two-step
Don't get hacked at all

some people dont have phones and security questions will make it so if yohr account is hacked for whatever reason you can retreive it instantly withour contacying any staff

 

[Hype]

use google voice then....

well one of the main points is convenience for the player and the staff

 

[Jerry]

well one of the main points is convenience for the player and the staff

This happens so rarely that it isn't something that should be changed

 

[Hype]

This happens so rarely that it isn't something that should be changed

even so, one persons account hacked can cause a gallon of tears and account security should be highly valued on ANY website

 

[Kram]

I'd agree if it was something that could be added easily and was optional, but I don't believe that it can be easily added (Correct me if I'm wrong).

 

[Ivain]

Security questions do very little. Way better to have something like 2FA.
Security questions are usually limited to a specific set of answers of which the sample size is MUCH smaller than that of passwords.

Common security questions:
-Mother's maiden name
-First pet's name
-favorite book/Tv series
-date of birth of family member
etc.
Each of those usually has a few thousand possibilities. Adding spelling and outliers, you've got maybe a hundred thousand possibilities per question.
Hell, let's stretch it and say there's a good security question that has a million possibilities.

In comparison to that, a fully randomized 8-digit password using ONLY lowercase letters has about 208 billion different permutations. that's a factor of more than 200K times as many possibilities, aka 200.000 times longer duration to brute-force it.

I'd like to note that a hacker with a properly written attack can probably crack an 8-digit password like this in 6 hours (360 mins) of bruteforcing, according to estimates:
http://www.lockdown.co.uk/?pg=combi&s=articles
This assumes a class D attack, which can easily be achieved by quality modern PCs'. My PC would probably be capable of this.

If you can use all 96 symbols available on standard keyboards for an 8-digit, you're a lot safer, as the highest-end system on that list would take more than 80 days to crack a pass, and nobody's gonna waste that on a mineman.

The highest-end system in this list dates from 2009 though, and is simply a distributed-computing attack. I can't speak for what's possible today.
Aka if you've got a high-end hacker with access to a decent-sized botnet, they could probably reach a class F attack by that list.

Note that this entire estimate ignores password re-use and leaked password databases, which contain BILLIONS of logins in total.

TLDR: Security questions don't help for shit against hackers, and only exist so people don't lock themselves out of their PC with their terrible memories. 2FA is a far better defense, for even if your password is cracked, without access to your phone, they'd need to brute-force the code sent to your phone/email as well.

 

[Orochimaru]

Security questions do very little. Way better to have something like 2FA.
Security questions are usually limited to a specific set of answers of which the sample size is MUCH smaller than that of passwords.

Common security questions:
-Mother's maiden name
-First pet's name
-favorite book/Tv series
-date of birth of family member
etc.
Each of those usually has a few thousand possibilities. Adding spelling and outliers, you've got maybe a hundred thousand possibilities per question.
Hell, let's stretch it and say there's a good security question that has a million possibilities.

In comparison to that, a fully randomized 8-digit password using ONLY lowercase letters has about 208 billion different permutations. that's a factor of more than 200K times as many possibilities, aka 200.000 times longer duration to brute-force it.

I'd like to note that a hacker with a properly written attack can probably crack an 8-digit password like this in 6 hours (360 mins) of bruteforcing, according to estimates:
http://www.lockdown.co.uk/?pg=combi&s=articles
This assumes a class D attack, which can easily be achieved by quality modern PCs'. My PC would probably be capable of this.

If you can use all 96 symbols available on standard keyboards for an 8-digit, you're a lot safer, as the highest-end system on that list would take more than 80 days to crack a pass, and nobody's gonna waste that on a mineman.

The highest-end system in this list dates from 2009 though, and is simply a distributed-computing attack. I can't speak for what's possible today.
Aka if you've got a high-end hacker with access to a decent-sized botnet, they could probably reach a class F attack by that list.

Note that this entire estimate ignores password re-use and leaked password databases, which contain BILLIONS of logins in total.

TLDR: Security questions don't help for shit against hackers, and only exist so people don't lock themselves out of their PC with their terrible memories. 2FA is a far better defense, for even if your password is cracked, without access to your phone, they'd need to brute-force the code sent to your phone/email as well.

When I have those questions I go generate a 32-64 random string of letters, numbers, etc and yeah


Anyway, I don't think this should be added, its so rare that it's pointless.

 

[Hype]

Security questions do very little. Way better to have something like 2FA.
Security questions are usually limited to a specific set of answers of which the sample size is MUCH smaller than that of passwords.

Common security questions:
-Mother's maiden name
-First pet's name
-favorite book/Tv series
-date of birth of family member
etc.
Each of those usually has a few thousand possibilities. Adding spelling and outliers, you've got maybe a hundred thousand possibilities per question.
Hell, let's stretch it and say there's a good security question that has a million possibilities.

In comparison to that, a fully randomized 8-digit password using ONLY lowercase letters has about 208 billion different permutations. that's a factor of more than 200K times as many possibilities, aka 200.000 times longer duration to brute-force it.

I'd like to note that a hacker with a properly written attack can probably crack an 8-digit password like this in 6 hours (360 mins) of bruteforcing, according to estimates:
http://www.lockdown.co.uk/?pg=combi&s=articles
This assumes a class D attack, which can easily be achieved by quality modern PCs'. My PC would probably be capable of this.

If you can use all 96 symbols available on standard keyboards for an 8-digit, you're a lot safer, as the highest-end system on that list would take more than 80 days to crack a pass, and nobody's gonna waste that on a mineman.

The highest-end system in this list dates from 2009 though, and is simply a distributed-computing attack. I can't speak for what's possible today.
Aka if you've got a high-end hacker with access to a decent-sized botnet, they could probably reach a class F attack by that list.

Note that this entire estimate ignores password re-use and leaked password databases, which contain BILLIONS of logins in total.

TLDR: Security questions don't help for shit against hackers, and only exist so people don't lock themselves out of their PC with their terrible memories. 2FA is a far better defense, for even if your password is cracked, without access to your phone, they'd need to brute-force the code sent to your phone/email as well.

first of all you can have MULTIPLE security questions, and second of a

Security questions do very little. Way better to have something like 2FA.
Security questions are usually limited to a specific set of answers of which the sample size is MUCH smaller than that of passwords.

Common security questions:
-Mother's maiden name
-First pet's name
-favorite book/Tv series
-date of birth of family member
etc.
Each of those usually has a few thousand possibilities. Adding spelling and outliers, you've got maybe a hundred thousand possibilities per question.
Hell, let's stretch it and say there's a good security question that has a million possibilities.

In comparison to that, a fully randomized 8-digit password using ONLY lowercase letters has about 208 billion different permutations. that's a factor of more than 200K times as many possibilities, aka 200.000 times longer duration to brute-force it.

I'd like to note that a hacker with a properly written attack can probably crack an 8-digit password like this in 6 hours (360 mins) of bruteforcing, according to estimates:
http://www.lockdown.co.uk/?pg=combi&s=articles
This assumes a class D attack, which can easily be achieved by quality modern PCs'. My PC would probably be capable of this.

If you can use all 96 symbols available on standard keyboards for an 8-digit, you're a lot safer, as the highest-end system on that list would take more than 80 days to crack a pass, and nobody's gonna waste that on a mineman.

The highest-end system in this list dates from 2009 though, and is simply a distributed-computing attack. I can't speak for what's possible today.
Aka if you've got a high-end hacker with access to a decent-sized botnet, they could probably reach a class F attack by that list.

Note that this entire estimate ignores password re-use and leaked password databases, which contain BILLIONS of logins in total.

TLDR: Security questions don't help for shit against hackers, and only exist so people don't lock themselves out of their PC with their terrible memories. 2FA is a far better defense, for even if your password is cracked, without access to your phone, they'd need to brute-force the code sent to your phone/email as well.

srsly... if someones that good at hacking they can hack anything also your acting as if there is only one security question. you write that attack and tell me when your done.

 

[Verringer]

Security questions aren't secure, two factor is /thread

 

[fawny]

Great idea, but definitely make them optional like said above. Even if it could range between one to three depending on preference of the user. Would make hacking a lot less of an issue.

 

[Jerry]

Great idea, but definitely make them optional like said above. Even if it could range between one to three depending on preference of the user. Would make hacking a lot less of an issue.

It's already such a minimal issue though, I've seen very few members of this site get compromised over my time in comparison to the number of active users.

When I have those questions I go generate a 32-64 random string of letters, numbers, etc and yeah

inb4 rat

first of all you can have MULTIPLE security questions, and second of a


srsly... if someones that good at hacking they can hack anything also your acting as if there is only one security question. you write that attack and tell me when your done.

So you want someone to use questions that can easily be guessed? If someone's going to waste their time trying to get into your MCM account, they'll find enough information to make an educated guess on your mother's maiden name or your first school. If anything, it aids a hacker in getting full access to your account.

 

[Hype]

It's already such a minimal issue though, I've seen very few members of this site get compromised over my time in comparison to the number of active users.

inb4 rat

So you want someone to use questions that can easily be guessed? If someone's going to waste their time trying to get into your MCM account, they'll find enough information to make an educated guess on your mother's maiden name or your first school. If anything, it aids a hacker in getting full access to your account.

i disagree, its the users choice to decide the security questions also im getting lazy to reply to this thread imma just leave it to staff

 

[Jerry]

i disagree, its the users choice to decide the security questions also im getting lazy to reply to this thread imma just leave it to staff

Regardless of which security question, they're much easier to guess because there's a clear hint. With a password, there's not much to work off of.

 

[Ever]

do it these are op if u get hacked u can easily get ur account back where as if u get hacked rn its super hard to get ur acc back

correct me if im wrong

agreed, i know someone whos mcm got hacked yesterday after he bought premium @Gibbay (name changed, idk what it is now)