Battle.net Authenticator

Account security in massively multi-player games is a big concern. If you play World of Warcraft, you know how often accounts are compromised. In the last 6 months we’ve had our guild bank emptied twice when high-ranking members had their accounts compromised, and a handful of our lesser ranking members have had their hacked characters’ inventory and gear liquidated and traded to, presumably, gold resellers. Blizzard isn’t alone in this problem, of course. Even NCSoft’s Aion, a very recent MMO release, is having major issues with this. Simple truth of the matter is no MMO account is safe from being hacked, phished or brute forced and compromised when all we use is traditional username/password schemes.

However, there is a solution to this; authenticators. Blizzard and Square Enix both sell a hardware key fob solution to secure accounts (in the case of Blizzard, there is a free iPhone app that does the same thing.) Essentially, it adds a second, randomly generated password to your account that changes every ~30 seconds. So, you login with your traditional username/email and password, press the button on your key fob, and enter the code to login to the game or access your account management settings.

If you’re familiar with Paypal’s Security Key program, it’s essentially the same thing.

Obviously, there are great benefits towards using security tokens like these to secure online accounts. Someone could lift your username and password from a phishing scam, but they still couldn’t access any important element of your account without the random token. No two key fobs will generate the same code at the same time, so it’s nearly impossible to brute force. Even a keylogger installed on a player’s computer is rendered useless, unless the hacker is somehow watching your input in real time and enters your token as you do within that 30 second window (not likely.)

Blizzard and Square have tried to push players towards getting their accounts secured with authenticators by offering perks like vanity pets and increased storage space for your characters, but I’m still surprised at how many players are completely clueless that these devices exist. That might be changing in the case of Warcraft, where word on the street is Blizzard will be requiring the use of these security tokens with or perhaps even before the Cataclysm expansion is released. This means Blizzard will either be shipping these devices out for free, or will be bundling them in with the Cataclysm retail box.

Bizarrely, the community seems divided on the issues of whether this is a good thing or not. I don’t see the negative, outside of the minor inconvenience of having to remember where your device is, and the pain of getting your account reset if your device is lost (or, as was the case of a few friends of mine, when they upgraded their iPhone firmware and rendered their security tokens broken. [This issue should be fixed now, though.]) I love the idea of the security token mechanism, and I expect virtually every MMO going forward to begin supporting this kind of authentication, perhaps even mandatorily.

Until we get there, though, there are a few stop-gap solutions companies like Blizzard could put into place to help secure accounts without investing in new hardware.

Password Case Sensitivity — The most obvious flaw in Blizzard’s security system is the fact that their passwords are case-insensitive. So, if you’re a clever player, and you used a variety of capitalization in your password to help protect it from brute force attacks, those efforts are for not. Seriously, who thought this was a good idea? You dramatically cripple the effectiveness of your security system by not including this.

Login Strikes — It’s an obnoxious feature when you forget your password, but it’s a great way of combating brute force attacks. Banks use it all the time for online account access. Essentially, you have X attempts to login before logins are disabled for Y minutes. So, if someone is brute forcing your password, they only have a very narrow window of attempts before they’re locked out from trying for awhile. Hackers use automated scripts full of combinations of commonly used passwords, dictionary words, and frequent number combinations to throw at a authentication system like an MMO’s to try and guess what your password is.

My only guess as to why Blizzard in particular hasn’t included this particular function is that our accounts are getting slammed with brute force attempts far more often than we may realize. If this is the case, we could potentially be frequently locked out of our own accounts because of these anonymous attacks, causing an increased number of calls to these companies support centers. In this case, the only way these companies could combat this problem is by offering a means of changing your username, which can be difficult from a technical standpoint, introduces a level of complexity to the system, increases the odds of players forgetting their usernames (and thus, potentially increases support center calls.) In the case of Blizzard, username changing isn’t an option, as you now login with your email address instead of a username with the Battle.net system.

Still, this would be an option for many MMO developers, and an option worth serious consideration.

OpenID — Here’s an interesting thought that crossed my mind; why not allow players to use OpenID to identify themselves? Decentralize security from your database and put it in the hands of the more tech savvy players. Obviously, it wouldn’t be an option for most of the market’s player base, but it could be an interesting experiment and lead to some fascinating innovation by the community. Allow players to build their own authentication mechanisms and secure their accounts through their own means, whether it’s usernames and passwords, or image-based schemes, or riddles, or whatever. Crowd-source your security.

Finally, there are two other avenues we could investigate to improve the current security token scheme we’re seeing. These are USB-Based Security Tokens and a Standardized Token System. One complaint I hear against security key fobs is that they require you to keep track of them, and require you to go out of your way to input the code. Granted, this only adds a few seconds to the login process, but it is an obnoxious element. Instead, why not use a USB key approach? The player plugs their security token into a free USB port. The game detects the hardware key, and inputs their randomized token for them during the login process. This still requires you to know where your key is, but assuming you only play from your home, you can just leave it in a USB slot and not have to worry about it. This might be a complicated for web-based account management though, but using browser plugins (*shudder*) it would be possible to still take advantage of the token system.

Also, considering that more and more MMO developers will begin introducing and perhaps requiring security tokens, wouldn’t it make sense to have a standardized token system for all MMOs? Our key chains could potentially be full of these things (if you’re an MMO addict like I am!) in a few years to come. If a third party stepped up and said, hey, we’ll sell your company branded security token hardware for your games, offer a simple API to integrate it into your authentication process, and allow players to use a single key to access all their MMO accounts, this company would make a fortune. Seriously. Somebody out there needs to get off their asses and do this.

So, there’s some random food for thought on MMO security. What would you suggest developers do to secure player’s accounts? Do you like the security token approach? Why or why not?

EA announced that they would be restructuring Mythic (Warhammer Online, Ultima Online, Dark Age of Camelot) and BioWare (Star Warks: The Old Republic, Mass Effect, Neverwinter Nights, …) into a single RPG/MMO development power house. The implications here are pretty huge, though the move isn’t all that surprising given BioWare’s entrance into the MMO arena with SWTOR. EA is also announced they are canning Mark Jacobs, which comes as no surprise given the flack he’s gotten for WAR’s problems. My buddy Ryan pointed out that this means Garriot (UO), McQuiad (EQ) and Jacobs (DAoC) are now all gone. “The MMO gaming Gods are all gone,” as he so eloquently put it. That said, I’m very excited for what this move could mean for Warhammer Online and The Old Republic. BioWare could use the experience on SWTOR, and Mythic could use a fresh perspective on WAR.

Mythic has got to stop the subscription churn they’re seeing right now, and in my opinion the only way to accomplish this is major rebalancing of classes, a complete revamp of the ORVR system and a retail box expansion sooner rather than later. It’s been a few years, but the MMO genre is finally starting to heat up again with some exciting titles on the horizon. It’s going to be survival of the fittest come next year.

Likewise, Bethesda parent company ZeniMax Media revealed that it has acquired legendary development studio id Software (Doom, Quake, Wolfenstein, …) I can’t say I’m surprised here; id Software hasn’t been a big player in the industry for awhile now. For a long time their franchises took second stage creatively to their engine technology, and Epic took that crown away from them many moons ago.

I am so happy right now. My all time favorite MMO is getting a true sequel with a modern game engine. I… I… talk amongst yourselves, I gotta lay down for a bit. Oh God YES.

PS3 console exclusive, also coming to Windows PCs. Target release of 2010.

GROG! GROG! GROG!

Monkey Island sort of embodies a lot of my childhood. It was the first game that made me ask, “how do you make stuff like this?” It was the first game that inspired me to get into game development, so to say I’m excited over this news would be an huge understatement. Of course, given the feedback I’ve been seeing on Twitter and across the web, I’m not at all alone in this.

Ron Gilbert, one of the great minds behind the original Monkey Island (and my digital Lord and savior), blogged about the news as well.

You can already preorder the first episode of the first season, and there’s a lot of awesome bonus perks if you do. I’ll take 3, please!

4 years of effort, a degree from a reputable college and a sizable student loan aught to be worth something, no? =)

My first choice would be to end up with a studio working on an MMO. MMOs always have and always will be my leading love with gaming. They’re what I’ve modeled my career around really, and while I would no doubt get a tremendous amount of satisfaction working on other types of games I’m hopeful I’ll land something in that particular area. At this point, though, beggars can’t be choosers. I’ve started pushing my resume out to all the studios I’m heavily familiar with, but I’d love to hear if anyone has any particular suggestions on who to go after next, or better yet hear from folks from the studios themselves looking for new recruits.

You can check out my resume here, and contact me at hello@evansims.com.

I’m a WAR player. I love the game. I don’t consider myself a fanboy, but I am an optimist and I try to find the brighter side of things. Therefor, in this case, I lean towards the view of the loyalist bloggers who see this move as a very good thing for the community. More players spread across fewer servers means more RVR action, and dropping the server count down to 17 is going to make for some epically fun struggles.

That said, this is awful press for a game that has already had it’s fair share of it lately. The firings, the frequent downtime, the dramatically lower subscriber numbers than Mythic was (foolishly publicly) hoping for, and now this. People who don’t have a first hand account of the game are going to see this latest move as another nail in the coffin. That, of course, isn’t the case; but it makes sense for the world to see it as such. WAR is doing fine on subscribers, even if those numbers are far lesser than they had wished for. Mythic grossly overestimated the amount of servers they needed, and this is the result we’re seeing for it today: the servers simply aren’t necessary, so it’s time to downsize. The writing for this has been on the wall for a long time, with one voluntary server move after another being announced. It was only a matter of time for them to start shutting down these “legacy” servers with so few players.

So, don’t panic. WAR isn’t going anywhere- they’re just scaling back to a more realistic server count. Take what you’re reading out there with a grain of salt.

Lots of recognizable faces, too. Angie and Justin Webb are gone, as is DJ Larkin. I’ve received unconfirmed reports that Adam Gershowitz (a producer), Carrie Gouskos (an associate producer) (Update: a source informs me Adam and Carrie may still be with the company) and Matt Fleming may be out too.

Jacobs posted a brief statement on the Warhammer Herald about the lay offs, stating that they were shifting from pre-launch to post-launch staffing, and it was to be expected. It’s plausible of course, but I doubt all the press about the decline in Warhammer’s subscriptions announced yesterday helped ease the pressure from EA to cut costs.

At any rate, my heart goes out to everyone caught up in this mess. It’s never an easy situation, but I have no doubt you’ll all land on your feet.

I understand publishers wanting to step up their game and be competitive. I understand their longing to be the next Warcraft. I get the need to tempt new players to visit long released games. Really though, is making your games easier the answer to this, even when it goes against your fundamental design?

One of the cornerstones of EverQuest, and many traditional online games, is the challenge. It’s about the big raids and epic struggles. Granted EQ2 adopted a much easier level of entry for players than it’s predecessor, but I would never consider the game itself easy. The big draw of EQ has been the challenges, so is SOE looking to change that?

I’ve got news to the publishers out there: making your games easier isn’t going to tempt players to buy your game. In the case of EQ2, you may actually hurt your player base. People looking for a more casual online experience are going to go with WoW, plain and simple. Why wouldn’t they, when their friends, family and half the workplace are rolling Horde? You tweaking the mob XP isn’t going to solve that. So how do you fix it?

Build a better game. It isn’t rocket science. Be innovative, be creative. We’ve got creative game designers coming out the ying yang with brilliant ideas. Know your player base, communicate with them, bounce ideas back and forth, and implement features people want, or features people don’t even know they wanted. Building a loyal player base is critical, especially for aging games like EQ2, and a happy player base inherently breeds a larger one. Friends tell friends, the blogosphere sings its praise, and you get richer for it.

You can’t expect to beat Blizzard at it’s own game. Don’t bother trying. Instead, try something different, something better. EVE Online, while radically different from any other MMO on the market, is a prime example of this. Are they competing with WoW? No. They aren’t even trying. They’re doing their own thing and they seem very happy with their numbers. How about Warhammer Online? It’s getting hyped as a WoW killer, but you’ll notice that they aren’t really marketing themselves as that; it’s the player base and the blogs pushing that idea. Because they really believe it is. I don’t, mind you (I think they excel at a wholly different type of game experience), but it’s proof that a happy player base is the best marketing department you can have.

NVIDIA’s newly embedded PhysX runs on any GeForce 8-series, 9-series, and 200-series desktop graphics card, and simply require the new drivers to work. I imagine all future ForceWare packages will contain PhysX support.

The original PhysX system saw little support from the game development community, with only a handful of studios actually implementing the system into their games. The reason for this was obvious: it required a relatively expensive specialized hardware component to work, and how much of the marketplace would drop $200 on top of their system just for fancier physics? NVIDIA’s integration of PhysX into the heart of their GPU means an instantaneous surge of user base with hardware physics rendering support, which in turn means more game developers will start looking at integrating advanced physics systems like PhysX into their games.

I shouldn’t forget to mention that ForceWare 177.83 also supports CUDA, or Compute Unified Device Architecture, which allows software developers to execute code on the NVIDIA GPU just like they would a standard CPU. The performance advantage of running code against a GPU is staggering, and we’re just beginning to see the real world advantages of this technology with tools like the Folding@Home client.

If you own a GeForce 8 or newer, you can grab the new ForceWare drivers and a whole slew of demo games that take advantage of PhysX at NVIDIA’s new “ForceWithin” site.

Alternatively, you can download the drivers directly from here:

• GeForce ForceWare 177.83 XP (32-bit)
• GeForce ForceWare 177.83 XP (64-bit)
• GeForce ForceWare 177.83 Vista (32-bit)
• GeForce ForceWare 177.83 Vista (64-bit)