How secure do you feel regnum is?

[ArcticWolf]

Originally Posted by Nikor

What would be the use of that? As far as I can see, the client verifies the local installation every time you start. I guess it computes some kind of hash value for the every file and compares that to the values stored on the server. If there are differences, it downloads the files again, now problem here.

Uhm... Now that I read my reply I made a mistake... Packages were the Packets the client sends to the server to communicate. They're in plain text AFAIK. Ciphered packets would help to make the game more secure.

Sorry, I confused packages with packets (translation to Spanish would be: enpaquetados with paquetes ). My fault.

Originally Posted by Nikor

Going back to the original question, I think think the only real security issue Regum has is the same that all account-based application/games/web sites have: social engineering. That means getting other people to tell you your account data including the password. This is why there is a bold red text every time you start the game that tells you not to give your password to anyone.

Edit: added a few more thoughts

Nowadays, it's almost impossible to break security in most of the cases, but there's always a way and it's social engineering. I could get my school's wi-fi lan passkey which was secured with wpa-psk just asking some questions to my teachers. Of course it has nothing to do (and I used it to send some mails ), but you can do the exact same thing to retrive the user and pass from anyone in the game. Unfortunately, this will keep happening because there's a large number of innocent-minded players that trust everyone.

[Snoid]

Originally Posted by DemonMonger

I suggest that you use a new account for forums so people do not see your login name..... I said this when regnum was still in beta... but im saying it again, because someone I know got hacked... and lost their account..

I suggest that you make anonymous polls.

EDIT: my fault. my bad english...

SuraK: encrypt SOMETHING

[DemonMonger]

Originally Posted by Stefan1200

Yes, Regnum find changed files very good. But if you write protect the changed file, Regnum shows an error message and start with the changed file without problem. So you can hack files and use them!

right... or you can use old update in new version/new version for exp server in normal server

[Nikor]

Originally Posted by Xephandor

Uhm... Now that I read my reply I made a mistake... Packages were the Packets the client sends to the server to communicate. They're in plain text AFAIK. Ciphered packets would help to make the game more secure.

Ok, that makes a lot more sense and I agree with it. You can see a lot of information when running packet analyzers like wireshark while playing. It's not all plain text, but what is not would be easy to figure out if you have enough time to spare.

But what I ask myself here is: "Is this a security issue?" I do not think so. It possibly makes life easier for cheaters, but it does not compromise anyone's account data (username/password combination).

One more thought on security: It's not an on/off or black/white thing. You have to define what you want to secure and against what. This is always a compromise between cost of implementation and cost of not implementating.

This is why I do not vote here as there is not thing as "very secure" or "not secure at all". Security is always something in-between. Unless you define what you want to secure and against what, you can't really give a reasonable answer.

[tak]

God you guys sure are anal about security. Who cares, its a game.
Choose a good password, thats enough and totally up to you.
If you get hacked, who could use your account anyways? You'd lose your stuff, and be completely at fault yourself if you choose a lame password.

[NightTwix]

Originally Posted by tak

God you guys sure are anal about security. Who cares, its a game.
Choose a good password, thats enough and totally up to you.
If you get hacked, who could use your account anyways? You'd lose your stuff, and be completely at fault yourself if you choose a lame password.

uhm start the game and run a 'ps auxww' or similar (im sure windows is affected too)
the game is launched with the username and the hashed password as commandline switches.

So any other user on your system or any other running application can grab your login.

Then the unencrypted network traffic and packages could be a problem too but i havent looked into it.

For some reason i also doubt the coding quality when it comes to buffer overflows and similar methods of remote code execution.
I can imagine there arises a lot of trouble when someone does some security-auditing

[Rockwolf_]

This poll needs a third option, because your accountname is indeed visible, but this only means you can get "hacked" if your password is too easy. All the pressure is on the password. The stronger the password, the safer you are. But I see no reason a real hacker would steal someones account? Those people usually have more interesting things to do

[Miraculix]

well that's the issue here, 2 words come to mind: script kiddies

[meldarion]

The simplest way to stop password de-hashing using a db is to do something like MD5(username + password) or MD5(username + MD5(password)).

It will add a few magnitudes of difficulty to the process of getting at the password.

The network stuff is scarily scant....

[GIGO305]

hakers r every where these days this 1 in youtube tried to hack but he got a bunch of viruses illigal defence mailed him a virus 4 pay back the only sucureness we get from our user name is that we dont use it game but hackers will look 4 us a forums and u can gues passes 4 ever so i goood hacking program can hack anyone in 5mins at most i know this from playing runescape a game in wich hacking is everysingle god danm day and if ur not with them they are aginst u but im not like that p.s some idiot made a tread asking for a hack for regnum morons like him are just BS real hackers use sht like him so ppl ignore wahts coming becareful in youtube look in my favorites i think i got an anty hacker thing if they send u a keylogger they get constant spam and my password is the same for everything because its alt codes i sugjest more ppl use this