Valid New security measures for the game

[deadmanrising 715]

As well as adults and mature people, there are also plenty of kids who play the game as well, and majority of the time glitches, bugs and other factors occur that can cause misunderstandings/problems between the helpers and the players

 

 

1. When a new player has registered and completed their first battle, trigger a message box encouraging them to add extra details to their account

 

When a player has registered, even if they have their email binded, they don't have a security question and they don't have any details about their account, so their account got lost or stolen, they have little ways of retrieving it

• Allow the user to set a security question (optional)
• Allow the user to give their personal details (optional)

Should their account be lost, it can be easily returned to them, and it is unlikely to be hacked/compromised

 

2. Allow the option for players to lock their crystals

 

Should players not follow the first option above and their account be lost, it's a problem because if their account has been taken over by someone else, they will either spend all their crystals and buy unwanted equipment; which is a nuisance because the attacker/intruder does not have any additional power over that account.

• Allow users to set a lock on their crystals; this can only be undone with another password external from their account's password
• Items cannot be bought unless the user disables the block by entering their secondary password (to prevent them from repetitively entering it)

This will save the moderators a lot of time, even if an account is hacked, it cannot be affected

 

3. Allow users to disable/enable the 'change' button in daily missions

 

 

 

 

Allow the option to disable/enable the 'change' button on daily missions, sometimes it can be easy to make the mistake of accidently clicking the change button, we lose that important mission that we were close to completing and it's ridiculous that nothing can be done about it

 

4. Set a buffer that allows the user to undo their action if they accidently buy an item they don't want

 

Many players have made this mistake and unfortunately end up keeping an item they don't want, my suggestion is simple, a user buys an item they don't want, they have 12 hours to undo this and can only do it for two items purchased (maximum for each item), the counter then resets once every year, to avoid exploitation. 

 

5. Allow the user to also use their secondary password in chat/forums

 

As mentioned earlier, the secondary password shouldn't just be limited to crystals but chat as well, a big reason why hacked accounts are blocked is because they are used deliberately to break the rules in chat. The user sets a lock on the chat, they can't chat until they enter their password again to unlock the chat. They don't have to continue to enter their password to do this as i said earlier, only to enable/disable chat.

 

 

 

[drazeruzumaki 5,021]

i agree with all except 4 since even if there is a limited usage, it still is a "refund" and i think if someone buys something, he/she has the responsibility since its bought by them only

[Maf 32,300]

Under review
[ascr]

[BSG-62 512]

^Same

[railguniz4noobz 2,394]

I like the ideas, but people still fall for the main password scam.

I see emails being given out every day, so why not secondary passwords?

 

Today:

-everyone i can hack u crystals

-ok how do you

-i need ur password

-*gives password*

 

With this update:

-everyone i can hack u crystals

-ok how do you

-i need ur password for the garage

-*gives password and secondary password*

[deadmanrising 715]

I like the ideas, but people still fall for the main password scam.

I see emails being given out every day, so why not secondary passwords?

 

Today:

-everyone i can hack u crystals

-ok how do you

-i need ur password

-*gives password*

 

With this update:

-everyone i can hack u crystals

-ok how do you

-i need ur password for the garage

-*gives password and secondary password*

There's no update that can prevent a user from giving out their password, you can only encourage users not to give out personal information, with two password's, its unlikely that anyone would want to hack anymore

[railguniz4noobz 2,394]

There's no update that can prevent a user from giving out their password, you can only encourage users not to give out personal information, with two password's, its unlikely that anyone would want to hack anymore

But people still give out their password.

Its just as easy to give out their second password.

 

 

-i can give you free crystals

-ok give them

-i need ur pass

*hacked*

 

 

-i can give you free crystals

-ok give them

-i need ur pass

-ok ill give you my first password only so you cant give me any crystals

 

The goal of a hacker is to tempt the other person to let them get on to do things.

Just say you need both passwords and it still works.

[deadmanrising 715]

 

 

 

But people still give out their password.

Its just as easy to give out their second password.

 

 

-i can give you free crystals

-ok give them

-i need ur pass

*hacked*

 

 

-i can give you free crystals

-ok give them

-i need ur pass

-ok ill give you my first password only so you cant give me any crystals

 

The goal of a hacker is to tempt the other person to let them get on to do things.

Just say you need both passwords and it still works.

 

 

Yes but it's still that person's choice, it's their own fault if they give out their passwords because they know if there was such thing as free crystals they wouldn't need to buy them or play battles, and why would someone be so generous enough to hand over crystals anyway? It can't be prevented, on any game but there can be measures in place, as suggested.

[Batmode_ON 60]

Good idea

[railguniz4noobz 2,394]

Yes but it's still that person's choice, it's their own fault if they give out their passwords because they know if there was such thing as free crystals they wouldn't need to buy them or play battles, and why would someone be so generous enough to hand over crystals anyway? It can't be prevented, on any game but there can be measures in place, as suggested.

I think tanki should track chat with words like (password, account, crystals, free) so they can always revert the account back to before the hack and email the right IP with the new password.

That would make accounts nearly impossible to hack.

[Spit_Fyre 334]

1. When a new player has registered and completed their first battle, trigger a message box encouraging them to add extra details to their account

 

2. Allow the option for players to lock their crystals

 

3. Allow users to disable/enable the 'change' button in daily missions

 

4. Set a buffer that allows the user to undo their action if they accidently buy an item they don't want

 

5. Allow the user to also use their secondary password in chat/forums

 

Some excellent suggestions!

 

Agree with @drazeruzumaki though that #4 may not be necessary if #2 is implemented. The redundancy of purpose (accidental spending) could be an additional hindrance to its viability. Which brings me to #2 - I couldn't agree more with the idea. But the password problem...

 

I'm not sure how uncomplex adding another layer of password protection is. For starters, how would you change it? Thinking aloud, do current settings prevent a hacker from changing the primary password or the registered email? A real time example pops into my head - the 'transaction' password some banks use. Really drives you up the wall when you've got multiple bank accounts and are in a hurry. It's interesting to note that the bank in question eventually abandoned the measure.

 

I could think of one alternative to problems posed by nested passwords - a confirmation link/form sent via email getting triggered when there is an attempted crystal debit or email/password change. While that would mandate email registration, there is the advantage of not having to remember or worry about another password. Dependency on the 'external' factor will then be the trade-off for the guarantee of a snag free transaction.

 

What I feel is if #1 (security question/personal details) and the grinding details needed to cut the red tape at the tanki helpdesk entrance is sufficient to prove your account was hacked (i.e. a primary password breach), it should follow logically that all activity (crystal transactions, bans, posts etc) on that account following the date (approximate maybe?) of hacking needs to be reversed - this being the ideal case. Feasibility of this depends on how much information (on what level) tanki actually retains about each account. Personally I think it wouldn't be easy for the company to maintain a database that vast - it may be a big part of their job, I really don't know. If I had to hazard a guess, I'd say devs couldn't care less about it. Add a possibility of gold ;) by means of commercializing a security feature and they may look at it.

 

So how about sending snapshots of the users account (including settings, purchases etc) to the registered email at the end of a day/week? Would it help track inconsistencies? Open to debate.

Edited December 10, 2015 by Spit_Fyre

[railguniz4noobz 2,394]

Ok, whenever someone logs in the locks are set.

If a lock is disabled (chat, forum, garage, friends list,) the data before the unlock and after the unlock can be reversed. The hacked could email to tech support to reverse it by saying the second password within 1 day of the change.

Edited December 9, 2015 by railguniz4noobz

[fordmustang12345 3,910]

Some excellent suggestions!

 

Agree with @drazeruzumaki though that #4 may not be necessary if #2 is implemented. The redundancy of purpose (accidental spending) could be an additional hindrance to its viability. Which brings me to #2 - I couldn't agree more with the idea. But the password problem...

 

I'm not sure how uncomplex adding another layer of password protection is. For starters, how would you change it? Thinking aloud, do current settings prevent a hacker from changing the primary password or the registered email? A real time example pops into my head - the 'transaction' password some banks use. Really drives you up the wall when you've got multiple bank accounts and are in a hurry. It's interesting to note that the bank in question eventually abandoned the measure.

 

I could think of one alternative to problems posed by nested passwords - a confirmation link/form sent via email getting triggered when there is an attempted crystal debit. While that would mandate email registration, there is the advantage of not having to remember or worry about another password. Dependency on the 'external' factor will then be the trade-off for the guarantee of a snag free transaction.

 

What I feel is if #1 (security question/personal details) and the grinding details needed to cut the red tape at the tanki helpdesk entrance is sufficient to prove your account was hacked (i.e. a primary password breach), it should follow logically that all activity (crystal transactions, bans, posts etc) on that account following the date (approximate maybe?) of hacking needs to be reversed - this being the ideal case. Feasibility of this depends on how much information (on what level) tanki actually retains about each account. Personally I think it wouldn't be easy for the company to maintain a database that vast - it may be a big part of their job, I really don't know. If I had to hazard a guess, I'd say devs couldn't care less about it. Add a possibility of gold ;) by means of commercializing a security feature and they may look at it.

 

So how about sending snapshots of the users account (including settings, purchases etc) to the registered email at the end of a day/week? Would it help track inconsistencies? Open to debate.

Whoa thats long but .I think what he means by adding another password is that you would have to have that second password to change the main password Edited December 9, 2015 by fordmustang12345

[Spit_Fyre 334]

Whoa thats long but .I think what he means by adding another password is that you would have to have that second password to change the main password

:D yeah, sorry about that. I read it like he meant keep a separate password for chat/forum and crystals alone - not a secondary password to override the primary. Still undecided about nested passwords though.

[fire.wraith 7]

Love the idea, but 12 hours for a refund should be changed to 1 hour, or just remove it completely due it being bad to suggest it on the forums! :D

Edited December 10, 2015 by fire.wraith

[Spit_Fyre 334]

 Thinking aloud, do current settings prevent a hacker from changing the primary password or the registered email?

 

I know this is old, but I wanted to correct this ^ 

My email wasn't confirmed at the time I wrote that (and I was unaware of it), so the settings reflected enabled change fields. Now I see that the password/email change mechanism already works the way I suggested i.e. through links and is externally dependent on your email.

[i200000 717]

Good idea + lazy devs = rejected idea.

[Jwimmer 2,835]

Very well thought out idea. +1

[deadmanrising 715]

bump

[Maf 32,300]

bump

:ph34r:

 

Added a status

[r_I_already_won0 2,339]

I like the option to lock the crystals, if this was implemented we could finally have an option to sell equipment and drugs!  :)

Edited November 15, 2016 by r_I_already_won0

[Maf 32,300]

I like the option to lock the crystals, if this was implemented we could finally have an option to sell equipment and drugs!  :)

Umm, no. That part definitely won't be happening.

[DieselPlatinum 5,121]

I like the idea, I cant think of one reason not to add it. and the only setback would be that it would take the devs a while to add this in the game :D

 

and yes I agree :D

[Seek_and_Destroy 38]

Awesome ideas. Once my account was hacked and 32k crystals were spent changing missions.

[KariWolves2 82]

Feature to verify Alternate accouts

 

Hello!

 

I wanted to suggest a feature to verify alternate accounts. What this would do is, for your main account, your main account would have to validate your alternate accounts. Something recently happened that I cannot speak of involving a wrong alternate account. Here are the steps I suggest

 

1. If you have an already existing alternate account, link it to your main account

1b. What this means is that you are linking an account to an account. Not to an email but to an account

2.  Once the account is linked to the user's main account, both accounts will be linked

3. If you lose or forget your alternate account, you can ask help@tankionline.com to get it back

4. Your alternate account is going to be secured if somebody hacks your account or steals it, or something happens to it, then the Tanki Online administration can know directly who's account is who's

 

This seems complicated and would take some time to solve, but I hope it is at-least considered, it would really help.

 

@KariWolves