(Jul 16, 2014 09:51 AM)~HF~ Wrote: Quite often if someone keylogged you or whatever and got your HF account they would have your email as well anyway haha :p
2FA is the only thing I think Omni will implement and is the only thing needed. Well, that's the catch, if your mail accounts are NOT safe then you are NOT safe at all.
Don't you agree proposed idea makes HF secure without any hassles like with 2FA ? I'm not against 2FA or anything, proposed system will be good for those who are not interested in 2FA or hassles associated with it.
Rain maker.
Some people, including me, have a dynamic IP. My IP address changes very often. Sometimes even everyday.
Thus, it would be very annoying if we had to confirm our access point everytime.
Not to mention the fact that a lot of people have also Two-Step Verification, so then we would have to double confirm.
My apologies if I seem a bit pessimistic.
(Jul 16, 2014 09:57 AM)Antigen Wrote: Well, that's the catch, if your mail accounts are NOT safe then you are NOT safe at all.
Don't you agree proposed idea makes HF secure without any hassles like with 2FA ? I'm not against 2FA or anything, proposed system will be good for those who are not interested in 2FA or hassles associated with it.
You just dug yourself a hole there haha? If your hackforums account is not safe then why would your email account be safe?
Its the same thing. Also as factor said the benifits of this don't way out the costs of this.
2FA is the only real way to secure your account, and will be the only thing implemented.
(Jul 16, 2014 09:56 AM)Factor8™ Wrote: This will not be implemented by Omni. I can confidently say this because the logistics/cost involved far exceed the benefits.
It's not really hard to secure your PC/AC is it? Just good old common sense protects but anyways.... I never been hacked and I'm not saying that protecting HF account is a tedious job ! but we can't ignore the fact that there are members in Market place claim to be hacked and we've seen many. I believe account safety is the responsibility of member himself. I just wanted to make protecting accounts easy and add a layer of security.
I don't think "Region lock" does involves a tedious coding job/server load.
Rain maker.
Sounds like something like Steam-Guard, but for HF. That'd actually be a nice addition, great idea, I support this. :)
(Jul 16, 2014 09:59 AM)Mons Wrote: Some people, including me, have a dynamic IP. My IP address changes very often. Sometimes even everyday.
Thus, it would be very annoying if we had to confirm our access point everytime.
Not to mention the fact that a lot of people have also Two-Step Verification, so then we would have to double confirm.
My apologies if I seem a bit pessimistic.
It makes me mad when people doesn't read OP fully, please read thread.
It's not a locking system based on IP but LOCATION.
Rain maker.
Jul 16, 2014 10:04 AM
(This post was last modified: Jul 16, 2014 10:05 AM by 1n9i9c7om.)
(Jul 16, 2014 09:59 AM)Mons Wrote: Some people, including me, have a dynamic IP. My IP address changes very often. Sometimes even everyday.
Thus, it would be very annoying if we had to confirm our access point everytime.
Not to mention the fact that a lot of people have also Two-Step Verification, so then we would have to double confirm.
My apologies if I seem a bit pessimistic.
My IP is dynamic as well, but only the second last blocks change for me. It's always XXX.XXX.YYY.YYY, where X is always the same and only Y is changing. We could simply check for the IP blocks, right?
This sounds like a very good idea. I think this would solve pretty much everything with account security. Very good idea. I hope this gets implemented.
DO NOT DEAL WITH THIS MEMBER
I would like this, but there are always problems with this.
1)cookies - aren't locked to a specific IP.
2)reverse socks4 on a rat would bypass this.
3)What if the attacker lives in the same country as you?
Another idea, could be maybe to force a user to enter a code sent via sms when logging in from an unfarmiliar location?
(Jul 16, 2014 10:00 AM)~HF~ Wrote: You just dug yourself a hole there haha? If your hackforums account is not safe then why would your email account be safe?
It's not the case, - Both accounts may have diffrent passwords
- Most of current email providers do protect users account with Region lock so it's not easy to hack a email account like Hackforum account.
- You can enable 2FA in mail account, but I don't want to protect everyone of my accounts with 2FA because it's not easy to do so.
You seems to be very skeptic about my idea, try thinking in a clear mind, what bad it can cause ? and as for cost I've already said it it above post.
Rain maker.
(Jul 16, 2014 10:05 AM)Yoshikage Kira Wrote: I would like this, but there are always problems with this.
1)cookies - aren't locked to a specific IP.
2)reverse socks4 on a rat would bypass this.
3)What if the attacker lives in the same country as you? All of those are valid arguments, but it would still strengthen security by a massive margin nonetheless.
(Jul 16, 2014 10:06 AM)BlueStar Wrote: Another idea, could be maybe to force a user to enter a code sent via sms when logging in from an unfarmiliar location?
Omni is already planning to add Google Authenticator to HF. ;)
Jul 16, 2014 10:08 AM
(This post was last modified: Jul 16, 2014 10:12 AM by Antigen.)
(Jul 16, 2014 10:02 AM)1n9i9c7om Wrote: Sounds like something like Steam-Guard, but for HF. That'd actually be a nice addition, great idea, I support this. :)
Thank you, I don't know why some members blindly against this.
It's a win-win situation, you get increased protection + hassles login.
(Jul 16, 2014 10:05 AM)Yoshikage Kira Wrote: I would like this, but there are always problems with this.
1)cookies - aren't locked to a specific IP.
2)reverse socks4 on a rat would bypass this.
3)What if the attacker lives in the same country as you?
As I said before proposed system is NOT 100% secure, but offers a good protection without sacrificing ease of use in site.
I accept 2FA is a much secure than this but for those user's who are not interested in it can make use of this additional security. There is absolutely 0% downsides with this.
About cost part,
Omni is already shelling out a good amount of money for the overall security of HF while this would be a one time and small cost that could increase security by marginal level, so why not ?
Rain maker.
(Jul 16, 2014 10:03 AM)Antigen Wrote: It makes me mad when people doesn't read OP fully, please read thread.
It's not a locking system based on IP but LOCATION.
Ow, in that case... I'm sorry.
But this could still be bypassed by using VPN's, proxies etc. Just saying.
Anyways, thank you for caring about our security.
|
