forums.rs

Forums

Auth on wrong password

Quick find code: 278-279-658-66188702

of 3
Ownage Omg

Ownage Omg

Posts: 14,364 Opal Posts by user Forum Profile RuneMetrics Profile
I just wanna clarify that the reason I even made this post is due to the numerous complaints of players being locked out of their accounts due to incorrect login spam. Yes, I understand Jagex need to hurry up and just create a better system to prevent against these kinds of attacks but for now it would help being able to keep usernames private so that they can't be used in this manner.

This has nothing to do with people being hijacked. It has everything to do with people getting locked out of their accounts by malicious people.
Hardstyle
|
@OwnageRS
|
OSRS
|
U
K

15-Nov-2020 22:43:15

Pepsi River

Pepsi River

Posts: 216 Silver Posts by user Forum Profile RuneMetrics Profile
Ownage Omg said :


This has nothing to do with people being hijacked. It has everything to do with people getting locked out of their accounts by malicious people.

That's what I've been trying to say also. Just because it's only a small group of people that are getting locked out of their account doesn't mean it's ok to keep the system as is. Yes Jagex has ways of stopping the culprits from locking people out, but the system could be better to prevent the malicious activity to begin with. Convenient links
Forum Help V2 : Support Centre : Too many logins?

15-Nov-2020 23:57:39 - Last edited on 16-Nov-2020 00:13:47 by Pepsi River

Hmm
Jan Member 2016

Hmm

Posts: 13,000 Opal Posts by user Forum Profile RuneMetrics Profile
Tl;Dr

Prove how you would find my username using the login form. You can't, targetted attacks aren't happening and untargetted attacks won't be happening either.

Calling this user enumeration isn't even accurate. You're implying that there is a sustained amount of bots going round spending significant resources into brute force searching an incredibly vast search space that is rate limited and unbounded, all to target random users with DOS attacks on a game where there's 275 million accounts and only 1 million unique active players per month. And they spend this vast amount of time and money, rather than on something such as cryptomining or running bot networks, simply ruining random peoples days, with no way of knowing if it is even successful because the chances are that any single account you might happen to find is inactive to begin with.

It doesn't make technical sense. It would take too long to brute force. It doesn't make financial sense, nobody is spending this much money to troll some radom kid they've never met. It doesn't make sense. There's literally no good reason to believe that OSRS showing 2FA without a password is an actual problem.

16-Nov-2020 02:18:37 - Last edited on 16-Nov-2020 03:19:55 by Hmm

Pepsi River

Pepsi River

Posts: 216 Silver Posts by user Forum Profile RuneMetrics Profile
Hmm said :
Tl;Dr

Prove how you would find my username using the login form. You can't.

You're using confusing wording.
Using the word "enumeration" is not an automatic contribution and you're actually just confusing people.
I actually have some experience with enumerations; they're considered ordered lists with the value of each each item added to the set being incremented by 1.
If you just mean in a literal sense that each credential is verified one at a time, I can understand, but it seems unnecessarily confusing to explain it like that when enumeration depends on context, and we're talking about a game. Convenient links
Forum Help V2 : Support Centre : Too many logins?

16-Nov-2020 05:09:04 - Last edited on 16-Nov-2020 15:50:08 by Pepsi River

2_Tron

2_Tron

Posts: 22,959 Opal Posts by user Forum Profile RuneMetrics Profile
Ownage Omg said :
Why does the game/site ask for an authentication even when the password typed is incorrect? This is literally just an easy way for people to discover people's login names as it won't throw an authentication request if the username doesn't exist or if the account has it disabled.

It should only throw this window upon successful authentication via username and password.... There's nothing wrong, it works perfectly. :)

16-Nov-2020 11:45:05

Pepsi River

Pepsi River

Posts: 216 Silver Posts by user Forum Profile RuneMetrics Profile
2_Tron said :
There's nothing wrong, it works perfectly. :)
How does it work perfectly when there are people getting locked out from using their account? It might not always be contributed to this, but it can't be helpful, especially if someone does find a person's associated email and tries to phish them. Convenient links
Forum Help V2 : Support Centre : Too many logins?

16-Nov-2020 15:51:54 - Last edited on 16-Nov-2020 15:55:31 by Pepsi River

CM Nick

CM Nick

Local Moderator Posts: 9,140 Rune Posts by user Forum Profile RuneMetrics Profile
Ownage Omg said :
I just wanna clarify that the reason I even made this post is due to the numerous complaints of players being locked out of their accounts due to incorrect login spam. Yes, I understand Jagex need to hurry up and just create a better system to prevent against these kinds of attacks but for now it would help being able to keep usernames private so that they can't be used in this manner.

This has nothing to do with people being hijacked. It has everything to do with people getting locked out of their accounts by malicious people.

It's not much, but I highlighted this thread and this issue to Jagex yesterday, and said they were noting it down and investigating further. Community Manager for Jagex

| Forum Help | Account Security |

16-Nov-2020 18:06:09

Mrs Ana

Mrs Ana

Posts: 8,998 Rune Posts by user Forum Profile RuneMetrics Profile
I see where the problem is or may be .

Once your thirty (30) days are over after you hit the "Trust This Computer for 30 Days Button", it will ask you to enter the Authenticator code once again -- no matter if you enter the correct or incorrect password. Right now, I tried to enter an incorrect password and this is what I am shown:





So, I think it has to do with the fact that once your 30 days are up, they ask for the Authenticator once again and if you choose the "Trust" button, then it will not appear for 30 days -- no matter if you enter the correct or incorrect password. Now, imagine if you do not hit the "Trust" button -- you will be shown the Authenticator code screen EVERY SINGLE TIME you try to log into the game with a correct or incorrect password.

Obviously, after I entered the new Authenticator code and trusted the computer for 30 days, it is not showing up again -- with or without the correct password.

17-Nov-2020 16:37:00

Quick find code: 278-279-658-66188702 Back to Top