Mobile Goldcard App

Stave said:

idk since these devices either have internet connection or connect to a device with intenret connection couldnt it get compramised?

Click to expand...

there should not be a possiblity of the app getting compromised. The current gold card does not use the internet to come up with the security numbers so the app would not need the internet either. And if you download it from an application store that shows that Mindark made it there would not be a possiblity of a security issue at all.

5assedonkey said:

....

Click to expand...

Just to let you know and anyone else who would like to know I will answer these things in a PM later instead of yet another looooong post that just upsets people.
seem to evolve into a "i'm right, you're wrong" discussion between us two so better take it private I guess

I'm expecting a PM from you then.

And why would it upset people?
Are you planning to be hostile to the general puplic?
This is something I doubt.. And therefor I don't see any problems with you posting it here.

Oh look, I decided to post in this thread again... Surprise!

jenny ferr said:

Just to let you know and anyone else who would like to know I will answer these things in a PM later instead of yet another looooong post that just upsets people.
seem to evolve into a "i'm right, you're wrong" discussion between us two so better take it private I guess

Click to expand...

It's interesting to see that donkey jumps on everybody not agreeing to his opinion while he complains that we do this to him. Kind of interesting...

5assedonkey said:

You make things very very easy for you just to put all the risks on all the others.

Elaborate, please.

Click to expand...

Answer this very simple question to yourself:
-----------------
Why do we have helmets, safety belts, handrails, traffic lights, airbags, fuses, condoms, warning signs, safety glasses, warning beeps, access control, ...?
-----------------
Hint: it's got something to do with protection.

Besides that you have proven that you know close to nothing about security in electronic devices. And guess what, the vast majority of people these days know nothing about this, too, many because they don't care. They, just like you, simply assume that everything is secure and protected at the second they buy the equipment. And they are, just like you, 100% wrong. Information technology has added a lot of complexity to the everyday life and many simply aren't up to it. You cannot put everybody in charge of these things.

Just check the Technical-section of EF what kind of questions are asked from people who obviously have a PC and play EU. Do you really believe that all of us are 100% capable of dealing with whatever we will be facing in the time to come (not just with the focus on EU)?

BTW, in your next post you will call me the expert for everything. Let me tell you that I know that I am not! I have also asked my (sometimes simple) questions and got help from people who I could help in return.

There are many out there who claim they are experts, but in the end it's just like asking if they are good motorists.

Again, you're not helping with this discussion if you spread your false assumptions and use a rather harsh way to accuse everybody who is not your opinion of being totally out of his/her mind.

And this really was my last post on this subject. Again: I say "No" to this idea and I'm 100% certain about this.

arkon409 said:

my bank system uses text messages with a code each time no need even for an app, but this will make GC's obsolete and MA cant get 200 ped out of someone with this idea haha

Click to expand...

Some months ago, there was a story about Nokia 1000 (old and very simple) mobile phones became very valued, since "internet thieves" had found out a way to use them in autication schemes that was built on SMS (probably found out a way to make them clone the telephone number of someone else, thus receiving the SMS ment for the original subscriber).

Seen it that way, using one-time authentication through SMS doesn't seem sound so safe anymore.

As for applications like java applications that emulate a smart card, they better be as safe as a smart card (ie store main key in a protected storage like a smartcard), or else it's probably just a matter of time unless someone with plenty of time have cracked it.

Lazy as I am, the main thing I'd like would be a USB reader for the gold card, possibly with an "approve" button on it, so you don't have to type all those numbers in at every relog (due to "crashes"/"getting bugged"). As for convenience, maybe MA should allow two gold cards - one normal, and one "backup" (stored in a safe place).

endermigne said:

It's interesting to see that donkey jumps on everybody not agreeing to his opinion while he complains that we do this to him. Kind of interesting...

Click to expand...

Have I ever complained?
Doubt it, I have however tried to make you reach enlightment, nirvana if you wish, about this subject.

endermigne said:

Answer this very simple question to yourself:
-----------------
Why do we have helmets, safety belts, handrails, traffic lights, airbags, fuses, condoms, warning signs, safety glasses, warning beeps, access control, ...?
-----------------
Hint: it's got something to do with protection.

Click to expand...

You know what grinds my gears?
People who answer a question, with another question.
It's retarded and it doesn't add anything to the discussion, no really.
It doesn't

Especially when the said question that has just been used as an answer is a rather missplaced one.

Why we wear helmets, safety belts and such. For protecting and securing our lives.
Why do you use a goldcard (assuming you do.) For protecting and securing your account.

Since the whole helmet and safetybelt language seems to go through with you I'll just have to adapt and talk to you in a way you understand.

If a person buys a car that doesn't come with a seatbelt and no airbag.
If someone comes forward and offers to install an airbag for him, for free, should he deny this because "An airbag isn't a solution for the lack of seatbelt" or should he say yes because afterall, an airbag is better than no airbag, wouldn't you agree?

Same logic is applied to our accounts.
You drive an account with a gold card.
Someone else doesn't this someone does however have the possibility to download an application that protects his account more than what just his password would do.
Should he deny this application because it is in a device that can potentially send his one-time code to someone else (keep in mind, neither account name or password would be sent.) ?

I say denying it would be rather stupid, and I thought that was crystal clear logic for everyone.
More security is more than no security.




This is why I think your "answer-question" is rather missplaced, because I have been nothing but pro-helmets, seatbelts.
As in, gold-cards, mobile apps.

endermigne said:

Besides that you have proven that you know close to nothing about security in electronic devices. And guess what, the vast majority of people these days know nothing about this, too, many because they don't care. They, just like you, simply assume that everything is secure and protected at the second they buy the equipment. And they are, just like you, 100% wrong.

Click to expand...

Who are you to tell me what I know and what I don't?
You have previously made bad assumptions about me
You do for starters know nothing about me, you don't know my education, my age, my background, how familliar I am with electronic devices.
And still you make the assumptions that I know nothing about electronic devices?
I'm sorry, but I am gonna have to assume that you know your way around these things, how else could you possibly justify these assumptions?

endermigne said:

BTW, in your next post you will call me the expert for everything. Let me tell you that I know that I am not!

Click to expand...

I'm sorry.
You can't just go around making assumptions and not having anything to back them up.

And for that matter let me give you SOME of my technical background.
I'm a tinkerer, I often find myself buying electronics just to tinker with them, change the functions, remove hardware protections etc etc. (Childrens toys are a goldmine by the way, no security and you can do TONS of stuff with them.)
I code ROMS for my android cellphone and considder myself an android developer eventhough I don't make applications.
But this is really beside the point.



Unless you straighten your act out aunt Alice is coming to get you.

Well lets think about this. Yes your mobile phone is connected to the internet, but the app is not. However your computer is, and so is EU (obviously). So... I would say there's a lot more chances that you're computer would get hacked and your account info stolen like that. Youre phone would rally ony be at risk in a public place and so would your laptop if your playing at a Coffee shop or something. Plus think about this. The mobile app displays a one time code for 10 seconds and does not have your username or password anywheres in it no matter how much you would break it down. You could hack the app all you want and you wont get anywheres. Hell I could buy a goldcard and start swiping it and posting every code I get on EF and nobody could do anything because you don't know my username and password. Something like this would just add an other level of security for people who dont have goldcards. And the people who do have goldcards would stay the same. Whats safer a username and password, or a username, passord, and a one time code that changes every 10 seconds that was given to you by your phone?

P.S. lets try to teep this about the topic at hand and leave personal attacks/flaming out of this... It's no what it's about.

N. Radioactive said:

So... I would say there's a lot more chances that you're computer would get hacked and your account info stolen like that.

Click to expand...

Wasn't there a (proof of concept) web page that, when visited by an iphone, managed to take a full "backup" of contents in the iphone like contacts?

In a way, phones are more secure than a computer, and default settings usually require programs with special privileges to be "signed".

Though here is when we come into the second half of "cracking" - the social engineering part. In the past, I got the feeling that a lot of "hacking" has been prepared by someone managing to install a program on the computer (to sniff the password), wasn't this the case with the famous "Heidii's salon"? Also we know that some year ago, someone posted links to "sweat bot" here, which was nothing but a keylogger. So, the security by using software on a mobile phone will probably fall as soon as someone manage to get the victim to install a rougue app on the phone. Also consider what this might do - on a mobile phone such an app could be written so it on receipt of an SMS will respond with the next valid login code - without the owner of the phone noticing it (the outgoing message could be disguised so that it looks like something completely else).

aia said:

Wasn't there a (proof of concept) web page that, when visited by an iphone, managed to take a full "backup" of contents in the iphone like contacts?

In a way, phones are more secure than a computer, and default settings usually require programs with special privileges to be "signed".

Though here is when we come into the second half of "cracking" - the social engineering part. In the past, I got the feeling that a lot of "hacking" has been prepared by someone managing to install a program on the computer (to sniff the password), wasn't this the case with the famous "Heidii's salon"? Also we know that some year ago, someone posted links to "sweat bot" here, which was nothing but a keylogger. So, the security by using software on a mobile phone will probably fall as soon as someone manage to get the victim to install a rougue app on the phone. Also consider what this might do - on a mobile phone such an app could be written so it on receipt of an SMS will respond with the next valid login code - without the owner of the phone noticing it (the outgoing message could be disguised so that it looks like something completely else).

Click to expand...

Actually the sms code thingie is like how my bank works. And sms is universal on every phone thus making it secure and safe. Not such a bad idea afterall. Only thing is .... euh can a phone be hacked and a sim card get copied ?

Would MA have to be told about your particular iPhone to make your version of the app only available on that particular phone? And then when you upgrade phones you need to get MA to change info at their end too? Or does it not work like this?

Could you install the app and use it on multiple devices (ie your ipad and your android and your ipod and your laptop) - whichever is the most convenient at the time?

Could you install it on say your wife's iPhone as well, so you can get her to log in as you without having to SMS her a code?

If you look at how blizzard have done it they have made it so that many accounts can be connected to one and the same mobile app, or code-token. (similar to gc.)

But not both at the same time.


This however could be changed, just because blizzard has implemented it in this fashion doesn't mean MA have, they can change it so you can have 5 different phones all connected to the same account if you wish.


And to explain how the blizz-app works It's like this.

You download it and install it into your mobile.
You get an app-code, this unique app-code is then written into your account on battle.net, the app-codes are different for each mobile.

When you have done this your mobile and account are connected to eachother, and now you can start getting 1 time codes.


I had this on my android, and I reinstalled my ROM (Let's say It's similar to switching linux-distribution.) but left my blizzard-app untouched.
(The apps had been moved to my sd-card so they were not removed while chaning ROM.)

When I started the app again I got a new app-code and had to re-sync my account.
But I had allready synced my account once so I had to call support, mail them a picture of my ID and they removed it in under 2 minutes. (The instructions on the webpage told me to mail a picture of my ID so it was allready done.)

The complete support conversation took 2 minutes and I could re-sync my account afterwards.


What I should have done was to go into my account on the webpage, write in one code, wait for a new one to show, write the new one (as well.)
And then I could remove the sync, but I forgot this and had to do it the support way.

Things were so streamlined it was amazing really.