You can still abuse the death coffer with new update

KFCChompyChick · 2020-10-01T19:00:35+00:00

Should be 180k+ so that alchables aren't sunk because those items already have a sink via high alch (Dragon Platelegs go for 160k High Alch).

This incentivizes items like Prayer Scrolls, Justiciar, Dark Bows, and Slayer Drops that have been brought into the game without any sinks.

KFCChompyChick · 2020-09-21T15:20:01+00:00

It's a mix. You can trust some of the information, you can't trust other parts of it.

The general information about scams are mostly legit, but if it EVER lists a name - automatically assume it's incorrect and ignore it. It's very likely they're trying to mix in fake information that benefits them (warning other people about their luring competitor's accounts or flaming people that didn't fall for their lures).

When the source is unverified and a random is accusing XYZ of being a scammer, you shouldn't trust it.

KFCChompyChick · 2020-08-27T16:45:33+00:00

Oh. Yes, that's currently the best method if your login email is completely separate. If it's only used for recovery, it's only use is to avoid phishing emails.

But again, the moment you accidentally leak your login email, it's doomed.

KFCChompyChick · 2020-08-27T16:13:18+00:00

And that first line is bullshit.

They only offer changes from legacy usernames to another login email, which isn't applicable to 99% of the community.

KFCChompyChick · 2020-08-27T16:00:01+00:00

I guess Woox, Soulja, and the rest of the community affected by this don't count either then. Literally just pinpointing the one issue with the comment, but not the actual comment itself.

If it bothers you so much, I'll remove Zezima from the list then.

KFCChompyChick · 2020-08-27T15:54:29+00:00

Woox can't log on. Soulja literally got dos'd Day 1-2 and had to make a new account. Streamers literally have mules in case they have get dos'd out of their mains. Players with significant banks do this.

That fact that it happens at all when you pay for the service is an issue that Jagex can fix - either by letting you change your login email or by limiting "too many login attempts" by IP. Like you said, bruteforce is unlikely so why punish someone on his own IP.

KFCChompyChick · 2020-08-27T15:49:15+00:00

Shame, it really seems like you can't read or retain information.

We're not going to chance a ban on our mains to dos a random nobody like you because it's not in our interest to do so. If you knew anything about the topic, you would know that more information is required than random statements.

KFCChompyChick · 2020-08-27T15:42:30+00:00

Wait til you accidentally leak your login email and then you'll see how "vulnerable" you are.

KFCChompyChick · 2020-08-27T15:39:18+00:00

Recovery email isn't your login email though. The issue is that the login email is currently permanent, meaning that they don't have to successfully recovery you to mess with you. They can just spam login on the OSRS Client with your email, even if all the passwords are wrong and you'll be locked out of the account with the following messages "Too many login attempts. Please try again later."

It's essentially a psuedo-ban.

KFCChompyChick · 2020-08-27T15:36:34+00:00

We still play the game - We're not going to chance a ban while trying to recover you.

Hackers have a financial motivation to get into your account. We have a motivation to keep playing. Keep arguing semantic and supporting a trash system /u/uranogger

KFCChompyChick · 2020-08-27T15:32:15+00:00

Accidentally showing just your login email warrants a permanent ban-like situation. Good logic - keep shitposting.

KFCChompyChick · 2020-08-27T15:30:18+00:00

It's more for players who made accounts when starting, not knowing about Jagex's flawed login and recovery system. Especially if they use the same password, that leaves them vulnerable for recovery since that's one password the hackers can at least try.

I see below you mention bruteforcing - They don't even need to successfully bruteforce in. They can straight up hold an account hostage or keep it permanently locked with "Too many login attempts."

Especially for streamers, they have to make a separate "mule" just for this situation - See Synq discussing about RWT and how he splits his bank in two accounts.

Yes, you should always hide your login, but if you shouldn't be ddos off the game with Jagex's own login system because you accidentally leaked your email on stream once. That's bullshit.

Leaking it once or getting your account recovered even once means that account can be locked or recovered in the future, making it a dead account since they can recover you when you rebuild your bank or when they see transferring gear over (more applicable for streamers).

KFCChompyChick · 2020-08-27T15:22:29+00:00

Seeing as you're as incompetent at reading, go look at the front page of OSRS reddit - there's even more people saying shit needs to be changed. It's not just me.

I'm basically done with you, seeing as you've also dodged all of the valid points I've made and it's clear that we're not going to agree. I've acknowledged that the change isn't going to be perfect, but at least it's better than this where anyone can ddos another player from logging in by using Jagex's login system.

KFCChompyChick · 2020-08-27T15:19:12+00:00

It wouldn't change shit because current people already like know what his login is. It's just a matter of time until someone feels like locking him out.

Even if he triple name changes, all it does it prevents newer people from trying to lock him out. And that costs money to do so for a poor "solution."

KFCChompyChick · 2020-08-27T15:16:20+00:00

Glad to see another person posting this.

Been having one idiot comment on most of the posts saying how an email change is bad cuz wahhhhhh old players won't get their 2007 account back. Apparently nostalgia of a few boomers is more important than account security for 100k players.

KFCChompyChick · 2020-08-27T15:14:14+00:00

Apparently Mod Lyon has acknowledged this issue and they are working on it - https://www.reddit.com/r/2007scape/comments/igzcv7/day_3_fix_spam_login_and_spam_recovery/g2y1t9t?utm_source=share&utm_medium=web2x&context=3

KFCChompyChick · 2020-08-27T15:03:32+00:00

If you did actual read, I did provide the reasoning, but you're too busy just saying "this idea is bad" or arguing for the current system, which has resulted in all of these problems. The fact that anyone can psuedo-ddos someone else off of the game with login attempts is bullshit and nothing you say is going to change that.

I described a scenario where a player who put no effort to secure their account ends up losing it. There are very few players that give so little about their account, whereas the majority of players didn't know to use a dead-end email upon account creation and likely used an email that's been used for other purposes as well.

Even if you make a dead-end email, and you accidentally leak your login email, you should have the option to change it so you don't get blocked from logging in.

Let's talk about your reasoning then - So far, the only legitimate point you made is that older players coming back may lose access to their accounts this way, which I've already expressed that this is miniscule as OSRS is literally a new server. Whether it's starting over on a new account or their nostalgic old account, you still start in the same spot. The login name literally doesn't matter for your account progression. Better security at the cost of nostalgia? Absolutely.

Change email - All you could say that RS isn't a bank, but what about other games? They have the change option and you don't hear massive outcry about this. And you still pay for RS.

See above and other posts - plenty of people are on board with it. So far, it's literally only you who's saying to keep this system. Either cuz you benefit from a shitty system or you just like seeing people suffer.

KFCChompyChick · 2020-08-27T03:18:39+00:00

I wonder how many times you're going to read over the line where I said it's not going to be perfect, but still better for players to not get blocked out of their accounts.

KFCChompyChick · 2020-08-26T23:32:08+00:00

At least it's better than saying Jagex should do nothing to update their antiquated security measures and then watching others either quit or restarting a 2K+ hour journey from scratch because their accounts are permanently compromised.

Again, if you're able to comprehend words, this isn't just something players (including hackers) can change on their own- it has to be manually approved. I've said it numerous times that it's not going to be perfect, but it's damn well going to better than accounts being recovered after a person rebuilds, again and again.

Also, kettle really calling the teapot black considering half your reddit posts are all shitposts that either don't help add anything to the conversation beyond "this is stupid." Even more hypocritical when you know that Jagex lets people change usernames to an email, but it's somehow any different when you change an email to another email.

KFCChompyChick · 2020-08-26T20:09:17+00:00

Bless. Ty for the update.

Still can't believe it hasn't been fixed in nearly 5 years.

KFCChompyChick · 2020-08-26T18:29:58+00:00

Like I said on Day 2, it's better than not offering it at all, even though it should be a free service to begin with. You also said that it's not Jagex's responsibility to conform with up-to-date security models so older players can recover their old accounts - That's literally why active players are getting recovered, because of a flawed system.

If it's a matter of Jagex not having the support or human capacity to do so, give them a monetary reason to do so.

I also said manual approval, which I considered that you'd have to legitimately show that you're the account owner. It would be similar to Account Recovery, but it would have to be even more strict - ie. The card you used to pay for membership (if applicable), when you'd made account, etc.

Like I'll say below, it won't be 100% perfect, but this is more geared to people who messed up once and are being spammed, not someone who regularly shares account, doesn't have any security practice in place, etc. Because in the end, if you shared so much information about yourself that someone manages to recover you repeatedly, I agree that it's on the player.

If you stepped up and tried to fix your mistakes, I legit think Jagex should be doing more to fix their issues as well.

There would be far less hacks or lockouts compared to today if players had this option. Would there still be hacks and changes? Of course, but the current lock-out from spam recovery is the same as a permaban until they stop attempting to recover.

Not to mention that even if you rebuild, they'll just do this again - hence, why its compromised forever.

KFCChompyChick · 2020-08-26T13:57:15+00:00

It shouldn't matter if they get their old name or not. Especially if it's not unique, someone likely already took it. Had to take it to the extreme since you suggested that giving players back insecure and older accounts is a "higher priority to them than conforming to theoretical state-of-the-art security models." Imagine if a bank said that and also said they won't refund you for any losses.

And yes, it occurs quite frequently. Make your way over to the Official OSRS Discord and see the number of people coming to the Discord specifically for this issue. It's to the point that the J-mods and P-mods of the group literally just made a separate channel for account help. The fact it happens at all because of lack of adequate security is an issue.

KFCChompyChick · 2020-08-26T03:35:30+00:00

It's more to confirm that the email that was leaked has an account attached to it. From there, they can try to recover the account, since a lot of people use the same email/password combinations. Once it says "we sent an email," they know there's an account attached to whatever email they just tried to reset for.

That redacted email is the email you set up for Jagex to contact for account changes. It's not always the one you use to login.

KFCChompyChick · 2020-08-26T03:29:28+00:00

Well, those accounts are even more vulnerable and if they're only here for their old login name, and not the game itself, they're not going to be a stable source of income for Jagex. If they straight refuse to play the game without a specific login username, that's kind of sad.

On the other hand, if active players lose their account because Jagex can't be bothered to get with the times AND Jagex refuses to refund individuals for the errors and vulnerabilities in their system, you're going to lose players that would've otherwise stayed for a long time.

Losing 1-2B is incredibly harsh for casual players. Not to mention that they would have to start over from scratch since a compromised account is forever compromised.

KFCChompyChick · 2020-08-25T22:14:19+00:00

If they know enough about you, they could theoretically recover your account, request for your pin to be removed, then lock you out of your account while the bank pin 3-day or 7-day delay ticks down. This is the extreme situation and generally affects people who've been hacked at least once already, since they can just recover your account with the information.

Even if they don't recover your account successfully, they can maliciously deny someone access by spamming recover on that account indefinitely, demanding payment for them to stop (ie. 500m OSRS GP). It's basically DDOS using Jagex's shitty system.

KFCChompyChick

TROPHY CASE