• Dear Guest,

    You're browsing our forum as a Guest meaning you can only see a portion of the forum in read-only mode.
    To view all forum nodes and be able to create threads/posts please register or log-in with your existing account.

    TwinStar team

Remove wrong-password ban

nimeralos

nimeralos

Authorized
Joined
Aug 26, 2014
Location
Moscow
You don't get blocked if you type a wrong password on www.twinstar.cz, i.e. I suggest it's still possible to brute-force people. Then, this 10-minutes-autoban we all know serves nothing but to cause frustration.

Inb4 "makes no sense to change it now when Kronos is so old" :D
 
The server response might be too slow to make any brute force attack effective, also I bet it detects when it's receiving too many passwords attemps in a relatively short time.
 
Hi all,

I think that this also serves as some kind of protection in case someone has your account name and is trying to guess your password. This will either discourage him or give you some time to take an action.

Maybe IP-lock (chosen as an option by user) used in other games would do the trick after that.

Just my opinion.
 
Blueblack said:
nimeralos said:
I suggest it's still possible to brute-force people.
Click to expand...
Yes, if you publish your account name, or if you have similar account name as forum or ingame nickname.
If you do, you are stupid.
Click to expand...
It confirms that the autoban we're talking about is absolutely useless, doesn't it?

Offtop:
On "stupid": I wouldn't agree that the account name should even be a secret tbh, we already have a password to protect the account... I mean, for example, our mailbox name is public, but it doesn't make it easy to hack if you have a unique strong password. Right now, the only thing a bad guy can do with an account name is to block it by typing the wrong password. But this is exactly the presumably useless Twinstar-specific feature we're discussing.

Safiyani said:
I think that this also serves as some kind of protection in case someone has your account name and is trying to guess your password. This will either discourage him or give you some time to take an action.
Click to expand...
See the above: it's still possible to do this kind of attack, a hacker just needs to guess on twinstar.cz but not in the client.
 
Last edited:
Yes, you are right. I did not realize, that account manager is not affected by ban as I am no longer playing here.
 
Blueblack said:
Yes, if you publish your account name, or if you have similar account name as forum or ingame nickname.
If you do, you are stupid.
Click to expand...

Half the people are stupid. The security measures are there to protect us from ourselves just as much as from others. And I would bet that many have same account name on forum and in game.
 
Blueblack said:
Yes, if you publish your account name, or if you have similar account name as forum or ingame nickname.
If you do, you are stupid.
Click to expand...
You misunderstood everything he said, secondly your whole point is moot.
If its impossible to bruteforce when you don't share your information or don't use repeating names then why keep the bruteforce protection?

The only thing that really annoys me is that if I get 3 failed login attempts (on different accounts...) I get banned for 10 minutes, but am still able to login on the page.
Now, obviously I had the password as I was able to login successfully on the webpage. Why not allow me to remove the tempary ban from my account?
 
yo im really pissed cause of this temp ban, i was in a dungeon random dcd and used wrong password 3 times didnt even know there is this **** tempban. Now the party members are waiting and mb dungeon is getting called cause of this
 
You must log in or register to reply here.
Top Bottom