See you in Northrend!
Tuesday, July 22, 2008
Monday, July 21, 2008
Still Hoping For a Key..
Have three horses in the race:
- WoW Account
- Blizzard Store Account
- Blizzcon'07 Beta Key
Friday, July 18, 2008
It's not hard to be a competent hunter.
Your competency is not represented by your guild's progression.
Your competency is not represented by your epic collection.
Your competency is not represented by your arena rating.
Your competency is not represented by your pet.
Your competency is not represented by your DPS meter.
DPS meters and raid logging programs are only of use by two kinds of people, raid leaders and ePeen strokers. A DPS meter can help a hunter find problems in their playstyle and gearing but so can websites like be.imba.hu and mods like Ratings Buster. At that point is a meter really needed? As long as the trash is dying, the bosses are dying, and there are few (if any) wipes then the group is doing FINE.
Your competency is directly, DIRECTLY represented by two things. Your skill in playing the class, and your ability to consistently not be a stupid hunter. Why so many people are unable to be a competent hunter is beyond me. I'll even cut a break for the people that can't master the jumpshot:
Your competency is not represented by your epic collection.
Your competency is not represented by your arena rating.
Your competency is not represented by your pet.
Your competency is not represented by your DPS meter.
DPS meters and raid logging programs are only of use by two kinds of people, raid leaders and ePeen strokers. A DPS meter can help a hunter find problems in their playstyle and gearing but so can websites like be.imba.hu and mods like Ratings Buster. At that point is a meter really needed? As long as the trash is dying, the bosses are dying, and there are few (if any) wipes then the group is doing FINE.
Your competency is directly, DIRECTLY represented by two things. Your skill in playing the class, and your ability to consistently not be a stupid hunter. Why so many people are unable to be a competent hunter is beyond me. I'll even cut a break for the people that can't master the jumpshot:
- Unless your pet is tanking, offtanking, or the main tank requests you do so; DO NOT enable growl in an instance or with a party.
- Unless you have absolutely no choice, DO NOT melee. An instance is no place to be leveling your staff skill, do that on your own time.
- Unless you are trapping behind the party, DO NOT run away from a mob that's aggroing on you. Use "feign death", freezing trap, your pet's intimidate (if talented for it), or just drag the mob back to the main tank.
- Learn to jumpshot. If for whatever reason you can't, learn to use maximum range, traps, distracting and concussive shot to kite as much as you can.
- DO NOT forget to bring at least one stack of food for your pet at all times.
- DO NOT forget to bring at least one stack of health potions, mana potions, and your own drinks.
- For the love of pete, DO NOT FORGET TO BRING ENOUGH AMMO FOR THE ENTIRE RUN.
- +SPI and +STR is not a hunter's friend. I understand that while leveling you will end up being dressed like a clown but please stay away from Spirit and Strength. If you need mana regen that bad look into buying wizard oils to apply to your weapons.
WotLK Beta Up, Invites Going Out Soon.
I've got three horses in this race:
- Blizzcon Beta Key
- WoW Account Opt In
- Blizzard Store Account Opt In
Tuesday, July 15, 2008
Activating the Authenticator
On the 14th I finally got my token and as I sat down to do a nice big writeup with pictures, I nosed over to WoW Insider and found one of my friends there had already done such a post. Well heck there's really no sense in me doing what's already been done, so here are a few paragraphs from Amanda Dean's post "Activating The Authenticator" and a link you can follow to the full post:
The Blizzard Authenticator is currently sold out on the Blizzard Store. I'm sure there will be plenty more to come, when they're ready. I bought one as soon as I heard they were available. Although my experience with the Blizzard Store was not great, it was certainly better than some others. After my order was placed, every time I checked on in, I what appeared to be a rag doll murloc who informed me that an error occurred on the page.
My authenticator has arrived. Thanks to the free shipping from the Blizzard online store, I saved $0.59 in United States Postal Service postage. To be honest, I'm just glad to have my security token. The token come with a single piece of documentation, which directs the user to the security token FAQ page.
I expected the authenticator to be slightly larger. It's approximately the same size as the clicker for my Mustang. I have not yet devised a tether for it, but the device will soon be leashed to my computer.
Continue reading Activating the Authenticator
The Blizzard Authenticator is currently sold out on the Blizzard Store. I'm sure there will be plenty more to come, when they're ready. I bought one as soon as I heard they were available. Although my experience with the Blizzard Store was not great, it was certainly better than some others. After my order was placed, every time I checked on in, I what appeared to be a rag doll murloc who informed me that an error occurred on the page.
My authenticator has arrived. Thanks to the free shipping from the Blizzard online store, I saved $0.59 in United States Postal Service postage. To be honest, I'm just glad to have my security token. The token come with a single piece of documentation, which directs the user to the security token FAQ page.
I expected the authenticator to be slightly larger. It's approximately the same size as the clicker for my Mustang. I have not yet devised a tether for it, but the device will soon be leashed to my computer.
Continue reading Activating the Authenticator
Thursday, July 10, 2008
Blizzard Authenticator Unboxing
For giggles I broke down and ordered an authenticator when they were first released, and it should be arriving in the next day or two. I'll have pictures and usage writeups as soon as I can.
Monday, July 7, 2008
Final View On Token Compromise Attack
Now that we have our theories on how the attack will work and where it will occur, now we have to figure out what the attackers will do once they've got the compromised account. For the most part, attackers would do a few different things. They would shard and sell everything a 'toon has then transfer the gold to another character. They may also just flat out transfer the character off the server. Either way, the password would often be changed from the original so the player could not log in.
With an authenticator, the attacker will only get one shot at an account at a time, so they will have to make a decision as to what method to take. Based on my last entry, a website-based keylogger will still allow an attacker one-time entry into the legitimate "Account Management" page for a compromised account, allowing the attacker to change the password and transfer characters off the server. The problem with that method of attack is even if the character is moved entirely off server the attacker will not be able to gain access to it, a loss of $25 to the attacker. Ergo this method of attack still seems only to be really viable for players that do not use the authenticators.
A program front-end keylogger will allow the attacker to log into the game as that player's toons, but they won't be able to wheel around and get into the "Account Management" website. So this leaves the attacker one option, to shard & sell as many items as they can and then mail the gold to a gold mule. The mule itself will then be transferred off the server, where the gold can be picked up and used for sale on the market.
Now as I had said on my last entry, the open window for a successful attack will be a short period indeed, maybe a maximum of 60 seconds. As of this writing we still don't know anything regarding Blizzard's configuration of the authentication window. Either way with such a small amount of time this means someone will need to be at the machine all the time to take advantage of a compromised account and harvest gold. It's possible such a requirement could force smaller operations out of business due to the increased complications to keep their coffers full of plundered gold. This will probably not affect larger operations quite so much as they will be able to afford a workforce to keep running 24/7.
Of course a bot program to automatically log into compromised accounts and then sell items at the nearest vendor *might* be feasible, but that's beyond the scope of this document.
With an authenticator, the attacker will only get one shot at an account at a time, so they will have to make a decision as to what method to take. Based on my last entry, a website-based keylogger will still allow an attacker one-time entry into the legitimate "Account Management" page for a compromised account, allowing the attacker to change the password and transfer characters off the server. The problem with that method of attack is even if the character is moved entirely off server the attacker will not be able to gain access to it, a loss of $25 to the attacker. Ergo this method of attack still seems only to be really viable for players that do not use the authenticators.
A program front-end keylogger will allow the attacker to log into the game as that player's toons, but they won't be able to wheel around and get into the "Account Management" website. So this leaves the attacker one option, to shard & sell as many items as they can and then mail the gold to a gold mule. The mule itself will then be transferred off the server, where the gold can be picked up and used for sale on the market.
Now as I had said on my last entry, the open window for a successful attack will be a short period indeed, maybe a maximum of 60 seconds. As of this writing we still don't know anything regarding Blizzard's configuration of the authentication window. Either way with such a small amount of time this means someone will need to be at the machine all the time to take advantage of a compromised account and harvest gold. It's possible such a requirement could force smaller operations out of business due to the increased complications to keep their coffers full of plundered gold. This will probably not affect larger operations quite so much as they will be able to afford a workforce to keep running 24/7.
Of course a bot program to automatically log into compromised accounts and then sell items at the nearest vendor *might* be feasible, but that's beyond the scope of this document.
Subscribe to:
Posts (Atom)
Posts
