I just hope Blizzard let’s us skip his soap opera speech with the next reset. /facepalm

I also finished the Glory of the Hero achievement and grabbed a snazzy Red Proto-Drake. Go me. :)

Battle.net Authenticator

Account security in massively multi-player games is a big concern. If you play World of Warcraft, you know how often accounts are compromised. In the last 6 months we’ve had our guild bank emptied twice when high-ranking members had their accounts compromised, and a handful of our lesser ranking members have had their hacked characters’ inventory and gear liquidated and traded to, presumably, gold resellers. Blizzard isn’t alone in this problem, of course. Even NCSoft’s Aion, a very recent MMO release, is having major issues with this. Simple truth of the matter is no MMO account is safe from being hacked, phished or brute forced and compromised when all we use is traditional username/password schemes.

However, there is a solution to this; authenticators. Blizzard and Square Enix both sell a hardware key fob solution to secure accounts (in the case of Blizzard, there is a free iPhone app that does the same thing.) Essentially, it adds a second, randomly generated password to your account that changes every ~30 seconds. So, you login with your traditional username/email and password, press the button on your key fob, and enter the code to login to the game or access your account management settings.

If you’re familiar with Paypal’s Security Key program, it’s essentially the same thing.

Obviously, there are great benefits towards using security tokens like these to secure online accounts. Someone could lift your username and password from a phishing scam, but they still couldn’t access any important element of your account without the random token. No two key fobs will generate the same code at the same time, so it’s nearly impossible to brute force. Even a keylogger installed on a player’s computer is rendered useless, unless the hacker is somehow watching your input in real time and enters your token as you do within that 30 second window (not likely.)

Blizzard and Square have tried to push players towards getting their accounts secured with authenticators by offering perks like vanity pets and increased storage space for your characters, but I’m still surprised at how many players are completely clueless that these devices exist. That might be changing in the case of Warcraft, where word on the street is Blizzard will be requiring the use of these security tokens with or perhaps even before the Cataclysm expansion is released. This means Blizzard will either be shipping these devices out for free, or will be bundling them in with the Cataclysm retail box.

Bizarrely, the community seems divided on the issues of whether this is a good thing or not. I don’t see the negative, outside of the minor inconvenience of having to remember where your device is, and the pain of getting your account reset if your device is lost (or, as was the case of a few friends of mine, when they upgraded their iPhone firmware and rendered their security tokens broken. [This issue should be fixed now, though.]) I love the idea of the security token mechanism, and I expect virtually every MMO going forward to begin supporting this kind of authentication, perhaps even mandatorily.

Until we get there, though, there are a few stop-gap solutions companies like Blizzard could put into place to help secure accounts without investing in new hardware.

Password Case Sensitivity — The most obvious flaw in Blizzard’s security system is the fact that their passwords are case-insensitive. So, if you’re a clever player, and you used a variety of capitalization in your password to help protect it from brute force attacks, those efforts are for not. Seriously, who thought this was a good idea? You dramatically cripple the effectiveness of your security system by not including this.

Login Strikes — It’s an obnoxious feature when you forget your password, but it’s a great way of combating brute force attacks. Banks use it all the time for online account access. Essentially, you have X attempts to login before logins are disabled for Y minutes. So, if someone is brute forcing your password, they only have a very narrow window of attempts before they’re locked out from trying for awhile. Hackers use automated scripts full of combinations of commonly used passwords, dictionary words, and frequent number combinations to throw at a authentication system like an MMO’s to try and guess what your password is.

My only guess as to why Blizzard in particular hasn’t included this particular function is that our accounts are getting slammed with brute force attempts far more often than we may realize. If this is the case, we could potentially be frequently locked out of our own accounts because of these anonymous attacks, causing an increased number of calls to these companies support centers. In this case, the only way these companies could combat this problem is by offering a means of changing your username, which can be difficult from a technical standpoint, introduces a level of complexity to the system, increases the odds of players forgetting their usernames (and thus, potentially increases support center calls.) In the case of Blizzard, username changing isn’t an option, as you now login with your email address instead of a username with the Battle.net system.

Still, this would be an option for many MMO developers, and an option worth serious consideration.

OpenID — Here’s an interesting thought that crossed my mind; why not allow players to use OpenID to identify themselves? Decentralize security from your database and put it in the hands of the more tech savvy players. Obviously, it wouldn’t be an option for most of the market’s player base, but it could be an interesting experiment and lead to some fascinating innovation by the community. Allow players to build their own authentication mechanisms and secure their accounts through their own means, whether it’s usernames and passwords, or image-based schemes, or riddles, or whatever. Crowd-source your security.

Finally, there are two other avenues we could investigate to improve the current security token scheme we’re seeing. These are USB-Based Security Tokens and a Standardized Token System. One complaint I hear against security key fobs is that they require you to keep track of them, and require you to go out of your way to input the code. Granted, this only adds a few seconds to the login process, but it is an obnoxious element. Instead, why not use a USB key approach? The player plugs their security token into a free USB port. The game detects the hardware key, and inputs their randomized token for them during the login process. This still requires you to know where your key is, but assuming you only play from your home, you can just leave it in a USB slot and not have to worry about it. This might be a complicated for web-based account management though, but using browser plugins (*shudder*) it would be possible to still take advantage of the token system.

Also, considering that more and more MMO developers will begin introducing and perhaps requiring security tokens, wouldn’t it make sense to have a standardized token system for all MMOs? Our key chains could potentially be full of these things (if you’re an MMO addict like I am!) in a few years to come. If a third party stepped up and said, hey, we’ll sell your company branded security token hardware for your games, offer a simple API to integrate it into your authentication process, and allow players to use a single key to access all their MMO accounts, this company would make a fortune. Seriously. Somebody out there needs to get off their asses and do this.

So, there’s some random food for thought on MMO security. What would you suggest developers do to secure player’s accounts? Do you like the security token approach? Why or why not?

2010 is upon us, and the air is full of excitement for a clean start and a fresh outlook on the opportunities ahead of us. This year, I plan to devote some time working towards revitalizing my blog. Like many, I’m notoriously bad at getting distracted and neglecting it for months at a time. It’s easy to lose track of time and fall behind on posts. That’s why this year I’m taking part in Project 52, the brainchild of Anton Peck (who was in turn inspired by a tweet from Chris Wallace.) It’s a project with a pretty simple objective: post stuff, and post it often.

Once a week, share something new. Whether it’s a review, or a technical walkthrough, or just what’s going in your life: blog it. Blog the ever loving sweet crap out of it.

I won’t call it a New Years resolution because, well, I never keep those. I’m just going to hope for the best and see where it takes me.

Happy 2010, everyone, and best wishes for a happy and successful new year.

Photo “happy new year 2010″ by mugley.

My variation of this Automator workflow will:

• Detect when a Kindle is mounted.
• Confirms if you want to sync your device with Instapaper.
• Deletes any old Instapaper files on the device.
• Downloads a fresh Instapaper archive and places it on your Kindle.
• Asks if you want to dismount the Kindle, and does so if chosen.

Once you have this workflow in place all you really need to do is plug your Kindle in and wait for it to do it’s thing. Couldn’t be easier.

One issue to be aware of: while you have your Kindle mounted, any insertion of USB drives (or anything that will show up in /Volumes for that matter) will start the script. I’m looking for a workaround on that one, but it’s a relatively minor issue. Plug it in, sync it, unplug it. That’s the point of it, anyway.

You must also be signed into your Instapaper account through Safari for the Instapaper archive to be downloaded successfully. Automator uses your Safari session to grab the file.

Finally, the script should work with any number of Kindle devices, but only one may be plugged in at a time for the sync to work properly.

Download

You can download my workflow and customize it for yourself. You’ll want to move the file to your ~/Library/Workflows/Applications/Folder Actions directory and work with it from there. Alternatively, you can build the workflow manually.

Install the Workflow

1. If you downloaded the pre-built workflow, ensure it’s been copied to the location I mentioned.
2. Open Finder and press Control+Shift+G. In the prompt, enter “/Volumes” and press Enter.
3. If you don’t have the path bar enabled in Finder, go to the View menu and select “Show Path Bar.”
4. Right click “Volumes” in the path bar and select “Folder Actions Setup…”
5. Attach the “Update Kindle with Instapaper.workflow”, ensure both checkmarks are checked.

Plug in your Kindle, and watch the magic. ;)

Build The Workflow Manually

1. Open Automator and create a new Folder Action. Set the “receives files and folders added to” drop down to “Volumes” (select Other, then press Control + Shift + G and enter “/Volumes”, press Go and then OK.)
    
2. Add a “Run AppleScript” action with the following code:

   on run {input, parameters}
   
     tell application "Finder"
       if exists disk "Kindle" then
         return input
       else
         error -128
       end if
     end tell
   
     return input
   end run

3. Add a “Ask for Confirmation” action. This will allow us to cancel our Instapaper update if we’re not ready for a fresh copy.
    
4. Add another “Run AppleScript” action to check for any existing Instapaper files on the Kindle, and move them to the trash for us.

   on run {input, parameters}
     
     tell application "Finder"
       set kindleFolder to "Kindle:documents:" as alias
       set instapaperFiles to every file in kindleFolder where
         name of it contains "Instapaper-ReadLater-"
       move every item of instapaperFiles to trash
   
       -- If you'd like to automatically empty your trash, uncomment:
       --empty the trash
     end tell
     
     return input
   end run

   Lines 5 and 6 should be on one line.
    

5. Add a “Get Specified URLs” action. Delete the default URL and add http://www.instapaper.com/mobi.
    
6. Add a “Download URLs” action. Point the Where value to your Kindle/documents folder..
    
7. Add another “Ask for Confirmation” action. This time we’ll be asking whether we want to dismount our Kindle or not.
    
8. Add one more “Run AppleScript” action to dismount our Kindle from the file system, allowing us to just unplug the device without any further steps.

   on run {input, parameters}
     
     tell application "Finder"
       if exists disk "Kindle" then
         try
           eject "Kindle"
         end try
       end if
     end tell
     
     return input
   end run

    

• Live Search – Check out that text box to your left. Try searching for something and behold it’s AJAXy goodness.
• Dynamic Archives – Also powered by AJAX. No pages to have to link through; the list grows as you scroll.
• Twitter Mentions – Each blog post (and a few of the pages) include a “Twitter” tab. The tab lists any mention of the page’s long or short permalink structure. It uses the excellent Backtype API to accomplish this. I developed it originally against the Twitter Search API, only to discover how awful they are at retaining data like this. Backtype works flawlessly and has a very respectable retention history.

Of course, the most obvious changes are the revised color scheme and layout. I got sick of the dark look, so I replaced it with a more eye-friendly, lighter appearance. There’s also a few new pages hidden around, if you take a look.

So, I hope you enjoy the new look. I’ll hopefully be releasing the theme in a month or two after I give it the old dog food treatment and work out the kinks.

I want my computer to work. All of the time. No exceptions. (Who doesn’t?)

I don’t care whether you use Windows, a Mac, or Linux; you’ll encounter show-stopping problems, and probably a lot more frequently than you care to admit. That isn’t to say the web isn’t without it’s problems. Datacenters go down, tables get corrupted, and worse of all things get hacked. The difference is, if a site goes down I can come back to it later. If my desktop OS goes down, I’m screwed… and potentially my data is screwed along with it. A reliable web service won’t suffer the same fate.

An all too common sight.

Now, Google unveiled quite a bit of new information on Chrome OS today, and officially opened the code for the first time to developers. I have a mostly positive impression coming away from the webcast, but I do see a couple of problems that Google hasn’t really addressed.

The Good

#1, The OS is self-repairing. That is, if a byte goes bad, or someone develops a piece of malware that circumvents the sandbox and eats your OS, the machine will revert to a good copy patch itself to a fresh state. No lasting harm done.

#2, Dead simple. I could see slapping this on an old laptop and giving it to a grandparent (see Bad #1.) No file system confusion, or worries about viruses, or needing to ensure they have the latest updates. It’s a set it and forget solution for the tech-clueless.

Chrome OS UI (Mockup)

#3, You can login to your Google account on any Chrome OS-based netbook and instantly have access to an identical looking “desktop” as you have on your own machines. Your bookmarks, browser history and even theme are synced and displayed. Fantastic. This also means, of course, if you drop your netbook and kill it, you can buy a new one and be right back where you left off in no time.

#4, It’s free. Netbooks running the OS won’t have to worry about Windows licenses, and thus keep the cost of their hardware cheap. Granted, Linux has always been an option for the same reason, but this is no standard Linux OS. I don’t care if it’s Ubuntu or Fedora or Gentoo; there is no such thing as a user friendly desktop Linux environment. It appears Chrome will be the answer to that problem.

The Bad

Solid State Drives. I understand why Google is going that route– the performance advantage is huge over traditional drives– but requiring them to use the OS is absurd. I get requiring a SSD on new devices that ship with Chrome OS. I think if someone walks into Walmart and buys a Chrome OS-loaded netbook, they would expect tip-top performance.

But let’s say I’m not going to walk into Walmart and buy one. Let’s say I have a perfectly fine laptop sitting next to me that I want to give to Grandpa. Chrome OS is an easy choice, because all he does it check email and browse the web, and I don’t want to have to worry about him getting viruses. Alas, unless Google changes it’s mind on this, that isn’t going to be an option- because that old laptop doesn’t have a Solid State Drive. Who cares if Grandpa’s OS takes 7 seconds or 7 minutes to load? It’s a free PC, and it’s running your OS, Google.

If I’m savvy enough to install Chrome OS my own hardware, then I should be free to do so. Don’t lock me into your ideas of what a netbook should be.

The Ugly, and questions left unanswered

Privacy. I’ve always been a proponent of the “privacy is dead” argument when it comes to the Internet… or in any context, really. There isn’t such a thing. Still, having every aspect of my OS… my bookmarks, my customizations, my browser history… housed on Google’s servers is a little concerning even to me. I’d like to see us able to define a different sync-point than Google’s servers. Like Mozilla Weave or Xmarks, let us use our own FTP server as a place to store this cloud data as an option. At the very least, give us an indication of what sort of encryption you’ll be using to secure OS data.

Is there room for gaming on a Chrome OS device? Of course we aren’t going to be playing World of Warcraft on these things, but Google hasn’t mentioned if they’re going to support hardware acceleration at all, or whether OpenGL support will be bundled. NVIDIA’s Ion netbook platform is growing in popularity; will there be support for that? They demoed a Flash game; considering the sandboxed environment, will they be open to partnering with companies like Unity and OnLive to deliver cloud-friendly plugins for gaming?

Likewise, considering Chrome is all about HTML5, and a major aspect of HTML5 is it’s local storage capabilities; how is Chrome OS going to handle this? Will there be a finite amount of local storage for these things, or is Google imagining a way of syncing this data to their cloud and somehow still maintaining offline capacity? Perhaps there will there be no such thing as offline capacity, considering Google’s buyout of the 700MHz frequency spectrum, or are these devices going to be sold by cell carriers with built-in modems?

Who would really need a Mac tablet? Well, the same people who have already adopted those dreadful PC tablets Gates has been pushing for the last 5 years. We’re talking doctors, educators, engineers and I suppose a small audience of digital artists. Ironically, these are also the fields that seem to have a disproportionally higher number of Mac users.¹ Why walk around with a bunch of patient history papers when you can carry one device with all that information, and everything else you could possibly want to know about them, their condition, etc. It only makes sense that these fields, and I suppose others, would want to move towards this.

Of course, this leads the obvious question: is there any practical use for these things in my home? For me, there isn’t. I do want one, because the idea of just picking up a device and taking it into the living room to browser the web without the hassle of trackpads or positioning the laptop display just right so it isn’t blocking my view but I can still see the TV.

Wait, I think we already have this. It’s called an iPhone.

Many people are pondering the same thing you are or have already on this topic. What about a larger form-factor iPhone/iPod Touch? Always on. Connectivity anywhere. Simple, elegant user experience. Proven development platform. Of course, this idea is not without its pitfalls. How would Apple support iPhone apps on a larger display? They couldn’t just stretch them out- that would look hideous. Besides, Apple would want to take advantage of the larger resolution. More room for developers to add widgets and functionality. But there goes your 1:1 app compatibility with their already huge App Store.

So what about just slapping the full version of OS X on it, with 3G support? Sure, that would work. You still loose out on iPhone apps, but at least you’d have the whole range of existing Mac software to work with. But what about the elegant simplicity of the iPhone? Is taking your index finger and carefully clicking a menu item as satisfying a experience as a carefully placed mouse cursor?

Apple has surprised me in the past, and no doubt they’ll do it again. Everyone agrees, a Mac tablet is coming; I just wonder if we’re talking a year from now, or more like 5. I think the perfect Mac tablet is already here, and it’s called an iPhone.

Google Chrome OS is an open source, lightweight operating system that will initially be targeted at netbooks. Later this year we will open-source its code, and netbooks running Google Chrome OS will be available for consumers in the second half of 2010. Because we’re already talking to partners about the project, and we’ll soon be working with the open source community, we wanted to share our vision now so everyone understands what we are trying to achieve.

People are going to pull this news in a lot of different directions. Some will call it a genius, overdue step; others will tweet dazed and confused, pondering what the point is. Here’s the low down: It’s a Linux OS. It’s lightweight and will likely run on dirt cheap hardware, and is directly targeting the netbook market. It’s designed with a focus on the web browser. They aren’t the first to do it, nor will they be the last.

Chrome OS’s target audience will in all likelihood be less tech savvy individuals who use their browser for everything (my parents would be a perfect fit here; they do everything out of the browser these days), developing countries with old hardware (but Internet access, obviously) and schools. I could see Libraries seeing this as a nice fit too, assuming there are content control capabilities in there somewhere.

I think it’s a step in the right direction in a lot of ways, and I really applaud Google for pushing things as they are right now. Chrome, Android and now Chrome OS. Keep on pushing those boundaries, 1.0 x 10¹⁰⁰.

4 years of effort, a degree from a reputable college and a sizable student loan aught to be worth something, no? =)

My first choice would be to end up with a studio working on an MMO. MMOs always have and always will be my leading love with gaming. They’re what I’ve modeled my career around really, and while I would no doubt get a tremendous amount of satisfaction working on other types of games I’m hopeful I’ll land something in that particular area. At this point, though, beggars can’t be choosers. I’ve started pushing my resume out to all the studios I’m heavily familiar with, but I’d love to hear if anyone has any particular suggestions on who to go after next, or better yet hear from folks from the studios themselves looking for new recruits.

You can check out my resume here, and contact me at hello@evansims.com.

See you all in a few weeks!

Update — I’m home! You can checkout the photos I took on my Flickr stream, or in the slideshow above. We had a great time, as always. =)