I was disappointed after reading this news post, as it does not address the flaws of the JAG system that I spotted immediately upon its release. JAG is a good idea, but its implementation has problems, which I will address herein.
> Security question choice is too limited. As many players have already said, the inability to write your own questions drastically limits the security of the entire question system. Personalized security questions are much stronger and they are why my questions, in particular, are so good (I wrote my own questions). With JAG, instead of having to guess or socially engineer both question and answer from the victim, the attacker already has the small pool of possible questions.
> Security questions can never be changed. This is a decent feature that helps enhance your account security -- right up until your account is compromised. If an attacker gains your security questions, then, notwithstanding a PW change, he or she will always have access to your JAG settings. For this simple reason, login credentials that can't be changed are a security risk.
> Jagex won't release the method they use to identify a device; this is essentially security through obscurity. I don't think I'm the only player who wants to know what information Jagex is gathering with the JAG system, how it positively identifies a unique device, and what they do with that information.
11-Sep-2012 20:23:40
- Last edited on
11-Sep-2012 20:24:18
by
Egdod