Saphar violating ToS? [Archive]

sirg4wain

02-06-2009, 03:53 PM

Dear Community of OUTSPARK and especially Saphar,
Is this a violation of ToS?

http://fiesta.outspark.com/news/leaderboards

7) Account Security

You, as the registered user of an Outspark Account, are ultimately and completely responsible for maintaining confidentiality of your login information and the computer system used to access the Outspark Service. Further, you are solely responsible and liable for any and all uses of your Login Information, whether authorized by you or not. You may not directly or indirectly reveal your Password to anyone for any reason at any time or allow anyone else to access your Outspark Account. Sharing, trading, swapping, selling, buying, bartering, or otherwise distributing Outspark Accounts or Login Information is strictly prohibited and subject to disciplinary action up to and possibly including service termination at the sole and absolute discretion of Outspark. Outspark will NEVER ask for your Outspark Account Password in contacting you and you should NEVER reveal it, EVER; even when contacting us about an account issue.

Option in the user's profile

Characters

* Keepin' my character info private.

If it is ( and it is) could you please fix it as fast as possible?
Thank you very much!

p.s.
I don't think that spread ones log in ID is a good thing, especially with all the hacking problems that recently showed up..

Sir Gawain

Asheer

02-06-2009, 04:08 PM

Welcome in the world of double standards ruling in Fiesta.
We cannot post any names of scammers because of antiblacklisting policy but they can openly posted WITHOUT our knowlegde such thing as Spark ID what can practicly compromised security of our accounts.
But if your account will be hack dont expect any help from thier side, and furthermore they will accused you of sharing account information.
Fact that my ID (even after PvP KQ) might land at such board is one of the reasons why i stay away from such because i known that Fiesta security have more holes as original Swiss Cheese.

Orchids_Mantis

02-06-2009, 04:10 PM

So...what are you getting at, exactly? No one is sharing accounts in that shot (at least there's no proof to it). If you are talking about account info distribution; I believe that term in the ToS refers specifically to sales of an account or selling a user's account name.

Many people have their character's names in their signature (as do I), which we can guess is not a violation as no one has been punished for it. Also, the recent update to player profiles allows players to show their character's names. I think we can assume since OS allows these things that OS allows.

UzumakiW

02-06-2009, 04:13 PM

Yes, it's totally horrible that they post peoples' forum names on that list, isn't it? (sarcasm)

evieevie

02-06-2009, 04:19 PM

The spark ids should be removed, i wouldnt want mine on thereO.o
I choose who i let have my id (to view my profile), i dont want it plastered for all to see its an invasion of my privacy. I clicked the option to not show my chars!

BTW just checked out leader board in that link and someone i know is on there, turns out they lied about their age and where they are from O.o Bet they wont want everyone to know their spark id haha

Celtic_Princess

02-06-2009, 04:24 PM

For the record, your sparkID correlates with your forum name. So we see it anways. Its really not that big of a deal...as we still don't have each others passwords.

Ex. Celtic_Princess is my sparkID. I comprimised nothing with my account by telling you that as you can see its located to my left anyways.

evieevie

02-06-2009, 04:26 PM

no point is i keep my forum and profile seperate from my game chars. So yeah u may know me on the forum but you dont know me ingame and i like it that way.

123boys

02-06-2009, 04:26 PM

Because of hacking issuses I have been skeptical about the fact that spark ID's are shown when posting in the forum. It would be a lot safer if we had seperate forum/profile ID's that could be different from what our spark ID is.

But i get what the OP is saying not that it is a violation of TOS but if someone on the leaderboard has their profile set to not show thier characters but Outspark chooses to reveal the spark ID that belongs to that character it kinda defeats the purpose of being able to hide the characters on your profile.

Adrichiang

02-06-2009, 04:58 PM

Hmm... I do not believe Saphar broke TOS rules by listing a player's account information which should be:

1. Email address you used to originally register with Outspark, many of the users use a different forum ID than our actual email addresses.
2. Password.

Listing players forum IDs does not give so called hackers actual information on your email address or password, so it's legal. If you feel that your email address and account password have been compromised, you may just login to your forum account and change your email or password information.

Edit: Been told you can also login using your sparkID via PM, hmm never done that before, always used my emailaddress lol. I know there is always possibility someone may use an encryption breaking method to figure out my password although with such expensive methods outside of using keyloggers which occurs if I was greedy enough to purchase services from gold sellers, why would they be breaking into my penny ant game account if they have such expensive methods of encryption breaking. It can happen to me, although Outspark can update its password security so passwords needs to be entered via a popup key pad with the mouse which makes it very time consuming and nearly impossible to break, since the hacker needs to manually input a guessed password instead of a program inputting 1000s of passwords a minute until it eventually hit the correct combination.

Possible solutions
1. Outspark implements an option to change forum ID different to the SparkIDs.
2. Player creates an alternate ID just for posting on the forums.
3. Outspark blocks the use of SparkIDs as login information and use only emailaddresses for login only.
4. Player never ever post in the Fiesta forums hence ensuring their SparkIDs will not be revealed to anyone on forums.

YoshimaruOrona

02-06-2009, 05:12 PM

windrider07

02-06-2009, 05:23 PM

Hmm....for months people were wanting ranking feature and Outspark, as a team, made it happen using the best coding skills they had...and now complaining....

I honestly have no opinion about it...I'm not worried about getting hacked.

Orchids_Mantis

02-06-2009, 08:25 PM

simplest solution: if you're worried about getting hacked because your name shows on the PK leaderboards....don't go PKing

12markkram34

02-06-2009, 08:40 PM

They can't hack you without your password and email address. The forums give neither. Therefore, the forums can't get you hacked.

dreadsqueeze

02-06-2009, 09:45 PM

I'm not 100% sure on how a hacker gains access to someone's information (I'm not referring to info stealing, I'm referring to actually gaining illegal access to someone's account), but ...

As far as getting into a person's characters/invos/storage, all one needs is a SparkID and password. Leaderboards bring attention to a person's account (especially the major pkers). SparkID is right there with the char's name, all that's left is to figure out the password...

EDIT: I do know that it's possible to recover from having all of your in-game stuff stolen and/or characters deleted, but it's a process that nobody wants to go through, so why should OS put those on the leaderboards at risk?

Also, keep in mind they planned on adding alchemy skills and other things to the board. High alchemy points means someone probably has a lot of money. They also can become targets to being hacked and stolen from.
lol high skills not necessarilly mean high money I have waaaay over 800k alchemy and prolly close to t5, if not more, scrolls but I'm by no means rich (so Hackers stay off my accts, be a waste of your time)
But I didnt know they planned on that too, too cool ^.^
Speaking of LB's I wish they would post the event quest one D:
I'm not too concerned about hackers and SID if it were going to happen it would happen a whole lot more then it does I think ( maybe Im wrong tho)

sychosis

02-06-2009, 10:22 PM

Fre_ak

02-06-2009, 10:35 PM

You don't need an email address, you can substitute it with a SparkID.
if u are logging ingame..yeah u only need ur SparkID but the hacker need ur email to access in the forum and change ur password

edit : i know some games have the "Secret Question" thing...i think it would be great if we have this in fiesta...i mean if the hacker want to change ur password (or delete ur chars) he would need to answer the secret question correctly but only u know the right answer....more security for us and less time wasting for CSR and GM about hacking issues

the_hurtfull

02-06-2009, 11:55 PM

no point is i keep my forum and profile seperate from my game chars. So yeah u may know me on the forum but you dont know me ingame and i like it that way.

I know it, I know it xD xD XDXDXDXDXDXDXDXDXDXDXDXDXDXD!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!

Does that mean I win a cookie or summthin? O.o

YoshimaruOrona

02-07-2009, 12:01 AM

simplest solution: if you're worried about getting hacked because your name shows on the PK leaderboards....don't go PKing

It's not -just- the PK leaderboards that are a concern.

When OS first established the leaderboards, everybody got mad because we all figured it was an attempt to increase PKing in abyss so everyone would buy Blessing of Teva.

However, in one of the 'Leaderboard Hate' threads, an OS member (I wanna say Silky, but I'm not sure, so don't quote me on that) said that they would be adding more categories in the future, such as alchemy progress. Their reasoning behind KP being the first category was that it was "easiest to establish".

And for the record, it is within the realm of gameplay to be able to PK. So now you're going to tell me that it endangers one's chanced of getting hacked/stolen from because they do it often enough to get put on a "top ranked" chart?

That's idiotic, imo. There's no reason for the SparkID to be up there anyway. What is the point of it?

(No, I'm not a PK. I'm just covering all sides of the issue.)

asasora

02-07-2009, 12:39 AM

They can't hack you without your password and email address. The forums give neither. Therefore, the forums can't get you hacked.
You don't need an email address, you can substitute it with a SparkID.

the only way i've seen to log in is by email and password. and why not let ppl see ur chars? you should be proud of them. even if you all are that afraid of getting hacked, they still need a password. jesis you all worry way too much. its just a game. it would be different if you kept cc info on it...and if u do, thats ur stupidity

DangerousSharida

02-07-2009, 12:46 AM

what upset me more was that my name and location was showing...

they spread my personal info without my permission!

I dont care they know my forum name and ingame name... but is no ones bussiness who I am irl... i prefer to choose who I give my first and last namemyself..

yes i have edit it now but when i first found out i was like O.o ***!?

asasora

02-07-2009, 01:00 AM

its up to YOU to put ur name and where you live in. YOU fill that stuff out. its not even in there until YOU put it there. you can just as easily remove it

Kylock

02-07-2009, 01:12 AM

TheCentrix

02-07-2009, 01:48 AM

Yes, it's totally horrible that they post peoples' forum names on that list, isn't it? (sarcasm)
The spark ids should be removed, i wouldnt want mine on thereO.o

I know right... what are people being mad about? Their sparkid is also shown in every post they make on the forums... lol

on a side note, 99.99% of the people that claimed to have been hacked, just shared their password of their account OR their e-mail adress password. the so called "hacker" who never hacked it in the first place, just goes to the fiesta login and says "FORGOT PASSWORD" and changes it. VOILA, "hacked" (which isnt hacking at all)
the other 0.01% just have an easy password and got "hacked" by someone who guessed their password.

123boys

02-07-2009, 02:05 AM

the only way i've seen to log in is by email and password. and why not let ppl see ur chars? you should be proud of them. even if you all are that afraid of getting hacked, they still need a password. jesis you all worry way too much. its just a game. it would be different if you kept cc info on it...and if u do, thats ur stupidity

It says to enter your email but you can use just the spark id and i dont know if you have ever heard of it but in a game i used to play there was a hacker that created a password and pin( that games used pins as well) bypass so all they need was your account name. Luckily most people were not at risk because the forum ID was different from the account name unlike here
In that game items were lost but due to the requirement of the account holders birthdate to delete a character most were not deleted. If something like that was ever made for this game it could cause real havok.

ahtai

02-07-2009, 04:38 AM

Well the security have a lot of loophole. The spark ID/forum name for older players can log in, the newer player only use e-mail address. That is part of the reason I never keep anything worthy (+9s) in this account as it got the highest risk. Also I train up my other account just-in-case my first account got hacked.

The log in screen allow multiple wrong log in so all you need is write a programm to try every possible combination. Well if I compare this log in program and the Taiwan verson:
The log in in game is not account/spark ID information, it is separate. To log in the account/spark ID there is also visual typing of character to avoid computer auto hacking.

This is somehting Outspark should learn form others, also there is no spammer over there too so the security is much much stronger. You need both phone and e-mail confirmation to create an account. But you can have 2 game account on same cash account which is nice feature also no need to decide which class to choose.

evieevie

02-07-2009, 04:09 PM

I know it, I know it xD xD XDXDXDXDXDXDXDXDXDXDXDXDXDXD!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!

Does that mean I win a cookie or summthin? O.o

only cos i told you :P

Orchids_Mantis

02-07-2009, 10:36 PM

The log in screen allow multiple wrong log in so all you need is write a programm to try every possible combination.

Isn't there a limit to the number of times you can get the password wrong before the account is locked or something? I know most of my other accounts have something along those lines but I never thought to ask here.

DangerousSharida

02-10-2009, 12:32 AM

its up to YOU to put ur name and where you live in. YOU fill that stuff out. its not even in there until YOU put it there. you can just as easily remove it

actualy my signup info was there when i signed up... and guess what we did not have any outspark pages at that time..

so when the outspark pages came i had no freaking clue that my personal information was there. They should NOT have done that.. and put everyones information right out there for eveyrone to grab.

palmfruits

02-10-2009, 08:31 AM

actualy my signup info was there when i signed up... and guess what we did not have any outspark pages at that time..

so when the outspark pages came i had no freaking clue that my personal information was there. They should NOT have done that.. and put everyones information right out there for eveyrone to grab.

I believe sometimes when you fill out things for new accounts on different web sites, your computer will save the information if you allow it to (I think there's a message that comes up and you're prompted to allow or not allow it). It'll ask if you want to save this information for the future so it basically fills out the stuff for you. Maybe this is what happened with you?

I could be wrong and making this up, though; But I think the automatic filling thing DID happen on my comp :/

bigj3234

02-10-2009, 11:46 AM

I just tried to login with just my SparkID and it didn't work. Needed email address.

And palmfruits, that's the Autocomplete feature I believe, there are also various form tools with different toolbars. In all cases they can be turned off/cleared.

If you are worried about people stealing your account then create a strong password (best bet is to use a random generator) and don't give it out.

kidwithcrayonz

02-10-2009, 11:52 AM

How long has it been since some of you people logged in to the site? Your forum name/Spark ID is not what you use to log into the Outspark service. That picture shows nothing that can be used to "hack" into your account. The only way is if your ID and password are the same, I wouldn't put it past some of the people here, judging by the displayed knowledge level about account security.

Stop trying to hamstring Outspark. they announced the use of the leaderboard, if you are a person who likes to PvP and get massive kill points, you aren't going to be able to keep your character name a secret.

omoidake

02-10-2009, 12:39 PM

Stop trying to hamstring Outspark. they announced the use of the leaderboard, if you are a person who likes to PvP and get massive kill points, you aren't going to be able to keep your character name a secret.
I'm glad I'm not the only person who thinks that. lolz.

DangerousSharida

02-11-2009, 09:04 AM

I believe sometimes when you fill out things for new accounts on different web sites, your computer will save the information if you allow it to (I think there's a message that comes up and you're prompted to allow or not allow it). It'll ask if you want to save this information for the future so it basically fills out the stuff for you. Maybe this is what happened with you?

I could be wrong and making this up, though; But I think the automatic filling thing DID happen on my comp :/

let me quote...

http://www.outspark.com/forums/showthread.php?t=129508

"We are listening to your feedback and are aware of your concerns regarding profiles displaying private information. We will be addressing this issue first thing next week when we return to the office. In the meantime, please login to your account and change your preferences if you wish to hide your profile information."

yes its fixed now but this never should of happened

helgaismymom

02-11-2009, 09:37 AM

some people get haked by there key logers

Serric

02-11-2009, 10:30 AM

The answer to the original question is no.

Now, in order for someone to genuinely hack your account, it will take a considerable amount of work on their part… most of it is getting you to provide them with the needed information: username and password.

In actuality, 99.9% of “hacked account” issues here are related to shared account information. The leaderboard data gives them nothing they require to hack you. You have the most power to protect your account by merely not giving your details to friends, strangers or, worst of all, goldspammers.

f4ntome

02-11-2009, 11:10 AM

let me quote...

http://www.outspark.com/forums/showthread.php?t=129508

"please login to your account and change your preferences if you wish to hide your profile information."

In actuality, 99.9% of “hacked account” issues here are related to shared account information.

You don't need an email address, you can substitute it with a SparkID.

If you are worried about people stealing your account then create a strong password (best bet is to use a random generator) and don't give it out.

Been told you can also login using your sparkID via PM, hmm never done that before, always used my emailaddress lol. I know there is always possibility someone may use an encryption breaking method to figure out my password although with such expensive methods outside of using keyloggers which occurs if I was greedy enough to purchase services from gold sellers, why would they be breaking into my penny ant game account if they have such expensive methods of encryption breaking. It can happen to me, although Outspark can update its password security so passwords needs to be entered via a popup key pad with the mouse which makes it very time consuming and nearly impossible to break, since the hacker needs to manually input a guessed password instead of a program inputting 1000s of passwords a minute until it eventually hit the correct combination.

I agree with Gawain, I think that, if you give out the ID of any player you have spared to a hacker half of the work, the other half is to find out the password which may be possible especially with all the bugs that the security of this game has

http://outspark.com/forums/showthread.php?t=146378

http://outspark.com/forums/showthread.php?t=146945

http://outspark.com/forums/showthread.php?t=146739

And the other thing is that, if I want to keep my information and the characters that I have private, then the others are not allowed to reveal at the World that I have that character/s through a board, it makes me think that the options in your profile are lame and useless.

:D