It's 2026 - We need 2-Factor-Authentication SSG

[Owlbear]

but according to the "temu troll"/"hack denier," there is no problem

Let's hope there is none... and I am not against 2FA. But even 2FA protection doesn't make your account fully safe. If they want to do something about account protection they have to figure out how these issues happen first. You can all yell at them to add 2FA all you want but that might not even solve these issues.

 

[Owlbear]

It sounds like the major issue is paypal. I no longer have an active paypal account so I have no idea what type of security paypal has in place, but it seems like people should be able to set up verification through paypal as well. If not - they probably shouldn't be using paypal.

You can actually. Paypal payment goes to their page and you need to login on Paypal and confirm with 2FA before you can make a payment. But of course people auto save all their information everywhere because it's "easy" to make a payment with the press of one button.

 

[Randomdude1223]

MyAccount @ SSG: Account Management

myaccount.standingstonegames.com

Can't you just change the email address there?

Thank you that worked

 

[Kimbere]

Let's hope there is none... and I am not against 2FA. But even 2FA protection doesn't make your account fully safe. If they want to do something about account protection they have to figure out how these issues happen first. You can all yell at them to add 2FA all you want but that might not even solve these issues.

What kind of point are you trying to make here - just because 2FA doesn't make an account 100%, impossible-to-ever-be-hacked safe why bother with it? Of course 2FA doesn't make an account completely hack proof. Nobody here advocating for 2FA/MFA thinks that (I hope).

What 2FA does do is make an account MORE safe, which is the whole point. To put it simply, more safe good, less safe bad. This shouldn't really need to be spelled out.

Why would anyone not want to be more safe even if "more safe" isn't 100% guaranteed safe? More importantly, why doesn't SSG want our accounts to be more safe?

Given SSG's virtual radio silence on this issue and 2FA, I'm starting to think they know something they don't want to admit.

If SSG gave us 2FA and someone had it enabled but still got their account hacked and never received a 2FA prompt, that would automatically narrow down the possible sources of compromise to a few options that would look very bad on SSG's part.

If the bad actor were able to bypass 2FA while compromising accounts, the most obvious explanations would be 1) an insider at SSG with access to the backend systems, 2) SSG's internal systems have been compromised by an external bad actor, or 3) the bad actor has figured out how to abuse the known bug where you log in but end up in someone else's account.

#1 would be a really bad look for SSG for obvious reasons. #2 and #3 would likely be even worse for SSG since they don't have grounds for plausible deniability at this point. That means that they'd be on the wrong side of the legal breach reporting and customer notification requirements.

 

[Chacka]

You can actually. Paypal payment goes to their page and you need to login on Paypal and confirm with 2FA before you can make a payment. But of course people auto save all their information everywhere because it's "easy" to make a payment with the press of one button.

The point is basically that a chain is only as strong as its weakest link. The moment you link your PayPal to SSG, SSG becomes part of that chain – and if that link is weak, no security mechanism in the world can protect your wallet once it breaks.

And yes, what we can currently do is simply not link PayPal to SSG in the first place. Since we can do something about it, we're also responsible for making sure no attacker gets to our PayPal accounts.

But that doesn't mean SSG is free of responsibility, for the simple reason that SSG is the one who can actually reinforce that link.

And let's not forget: even with PayPal unlinked, our DDO accounts are still relatively easy to hack, which means an attacker can plunder them – and that alone causes a lot of harm. I've heard of attackers doing damage without any profit for themselves, like deleting characters. A stolen payment can be reversed. Twenty years of playtime can't.

That's why I think SSG has a duty to make our accounts as safe as possible, and in a way players will actually use – because the process is barely less convenient, or even more so. From what I know, that would be a hardware passkey with fingerprint authentication, so you don't have to memorize or type any PIN or password anymore. Fix the weak link, and the whole chain holds.

 

[TedSandyman]

I can't believe someone can still just log on with account name and password, change the email and password and poof your account is gone. There is nothing you can do about it. This is 2026 how are we still not having 2FA???

@Cordovan ?????

Or how about you log in and the company says you are not you and wont let you log in because they don't believe you because their two factor authentication messed up.

If you lost your phone or forgot an email password you might be in trouble. You have your password and username, but they just wont believe you and wont give you your account back. It has happened to me twice. A google account and a yahoo account that I had forever. Luckily I didn't really care too much about either.

I don't trust ssg not to mess it up. Add 2-factor if they want. But don't force it on me. I will take my chances on getting hacked (never happened to me) over losing an account because of 2-factor (happened twice).

Can you even change your email without a verification email? I don't think you can. If that is possible, they should change that for sure. If your computer is compromised to the point that someone has multiple account details, they have your email account and your ddo account, 2-factor isn't going to help anyway. Go ahead and put it all on your phone. A single point of failure. Phones get hacked too. And stolen, and lost, and dropped in toilets.

People STILL get hacked, even with 2-factor authentication. Because PEOPLE are the weak link.

As for people getting charged for items, if you still have your credit card linked to your ddo account after all you have heard, you deserve it.

 

[nicholas]

The biggest problem is shared computers. My details are stored and so it's easy just log on. I remember years ago going into an internet cafe. The person before me (1 or 2 mins) didn't log out . I did it for her.
what makes it so easy is the socila media scams. What's your mothers maiden name etc.
shocking really. I have fingerprint log on . Except when i switch off my smartphone or it updates. Enter your passwor. It feels like companies actually except fraud.

Are you saying people play ddo out in public areas In real life??

 

[nicholas]

Nah, you don't. Without it we (The Secret Society of Russian Hackers) can hack all of you much easier. And remember - we have connections with your 3rd party payment metod owners. We're watching you, so don't make any sudden moves with that 2FA nonsense.

What do you mean 2FA nonsense? Are you afraid your not gonna be able to steal otger accounts? Is it you doing this?

 

[mastarhax0r]

What do you mean 2FA nonsense? Are you afraid your not gonna be able to steal otger accounts? Is it you doing this?

Look at my nickname - its obvious that it was me all the way. Furthermore - I'm even managed to hack my own account and steal all the good stuff. True Mastar, excuse me for my immodesty.

 

[f1b041b3]

but according to the "temu troll"/"hack denier," there is no problem

Oh, there's definitely a problem with scumbags lying about getting hacked. There have been fewer hackusations in the last year than there are fingers on your hands but each one works the usual cabal of technological illiterates into a frenzy.

I wasn't even going to comment since the thread necro seemed a bit suspicious but you had to drag me in.

What do you mean 2FA nonsense? Are you afraid your not gonna be able to steal otger accounts? Is it you doing this?

You don't even understand sarcasm yet you think you can accurately judge the credibility of these complaints? Just stop already.

 

[Smokewolf]

Oh, there's definitely a problem with scumbags lying about getting hacked. There have been fewer hackusations in the last year than there are fingers on your hands but each one works the usual cabal of technological illiterates into a frenzy.

I wasn't even going to comment since the thread necro seemed a bit suspicious but you had to drag me in.

You don't even understand sarcasm yet you think you can accurately judge the credibility of these complaints? Just stop already.

But why do you care?

It's pretty clear that you don't like it, and theres nothing preventing you from not using MFA. That being said, why shouldn't players use MFA if it's made available in the near future?

Of all your rants... You've not made a case explaining why DDO should not have MFA, other than to whine about it becoming an inconvenience for you.

 

[Ahser]

Didn't they already mention at GenCon that 2FA is coming?

 

[Smokewolf]

Didn't they already mention at GenCon that 2FA is coming?

MFA has been "mentioned" for over a decade now... You should pay less attention to what the Dev's say, and more attention to what they do.

 

[Kimbere]

You've not made a case explaining why DDO should not have MFA, other than to whine about it becoming an inconvenience for you.

The people arguing against MFA only demonstrate that they do not understand how modern MFA works. In fact, if SSG implemented MFA for DDO and made it optional, pretty much every argument the naysayers have against it are nothing but boogeymans based on FUD rather than logic and understanding.

A) In non-critical use cases (i.e. online games), it's generally OPTIONAL. For the "I'm not gonna click two extra times!!!11" crowd, that means, don't enable it if you don't want it.

B) If implemented properly, MFA lets you flag a device/PC as "trusted" when you authenticate. Going forward, it doesn't give you the MFA prompt when logging in from that device because it knows it is trusted. Easy, peasy.

C) Proper MFA systems offer multiple authentication methods in case you lose access to one method (i.e. you lost your phone). You can use email, SMS/txt msg, authenticator apps, etc. The setup wizards also typically recommend and walk you through generating a set of one-time-use, "break glass in case of emergency" codes during the initial setup that you can write down and store somewhere safe in case you need to do a full MFA reset.

So the excuse/anxiety about getting "permanently locked out" is pretty much just a boogeyman rooted in a lack of education/understanding how MFA works. That or someone failed to read and follow the instructions for setting up backup methods provided during the setup wizard.

My day job is a senior network engineer / systems admin at a multi-million dollar company with 500+ employees. We use MFA for pretty much everything we can. I constantly log into firewalls, servers, admin consoles, camera systems, etc., during the normal course of my job. I also help administer MFA for our end users.

If MFA were inconvenient, I'd never get any work done because I'd waste all my time logging in or helping our end users with their MFA. It’s not a problem though because modern MFA is mostly transparent.

 

[songswrath]

Seeing often i have remove people log in info from a few different discords. Just maybe its not all ssg. People got to watch what box they are typing in before hitting enter key.
I had to remove at least a dozen players log from chats at least a dozen times this year alone. Than send them a dm telling to change their password right this second

 

[Ahser]

The people arguing against MFA only demonstrate that they do not understand how modern MFA works. In fact, if SSG implemented MFA for DDO and made it optional, pretty much every argument the naysayers have against it are nothing but boogeymans based on FUD rather than logic and understanding.

I think most games have it optional, and usually they give some incentive for players to set it up. For example, SWTOR gives 100 free CC (their store points) monthly if you have 2FA enabled (even if unsubbed). WoW gives a pet. BDO has +5% Item Drop Rate Buff (Old Moon Treaty). So you don't have to use it, but if you do, you'll get a shiny.

 

[Falroth]

The people arguing against MFA only demonstrate that they do not understand how modern MFA works. In fact, if SSG implemented MFA for DDO and made it optional, pretty much every argument the naysayers have against it are nothing but boogeymans based on FUD rather than logic and understanding.

A) In non-critical use cases (i.e. online games), it's generally OPTIONAL. For the "I'm not gonna click two extra times!!!11" crowd, that means, don't enable it if you don't want it.

B) If implemented properly, MFA lets you flag a device/PC as "trusted" when you authenticate. Going forward, it doesn't give you the MFA prompt when logging in from that device because it knows it is trusted. Easy, peasy.

C) Proper MFA systems have multiple authentication method in case you lose access to one method (i.e. you lost your phone). You can use email, SMS/txt msg, authenticator apps, etc. The setup wizards also typically recommend and walk you through generating a set of one-time-use, "break glass in case of emergency" codes during the initial setup that you can write down and store somewhere safe in case you need to do a full MFA reset.

So the excuse/anxiety about getting "permanently locked out" is pretty much just a boogeyman rooted in a lack of education/understanding how MFA works. That or someone failed to read and follow the instructions for setting up backup methods provided during the setup wizard.

My day job is a senior network engineer / systems admin at a multi-million dollar company with 500+ employees. We use MFA for pretty much everything we can. I constantly log in and out of firewalls, servers, admin consoles, camera systems, etc., etc. during the normal course of my job. I also help administer MFA for our end users.

If MFA were inconvenient, I'd never get any work done because I'd waste all my time logging in or helping our end users with their MFA. I don't though because MFA is mostly transparent.

Quite well said. Thank you for this. Exactly the type of MFA setup DDO should have when they get it done.

 

[Kimbere]

I think most games have it optional, and usually they give some incentive for players to set it up. For example, SWTOR gives 100 free CC (their store points) monthly if you have 2FA enabled (even if unsubbed). WoW gives a pet. BDO has +5% Item Drop Rate Buff (Old Moon Treaty). So you don't have to use it, but if you do, you'll get a shiny.

Soulframe does the same.

It’s optional, but if you do enable it, you get a free, unique cosmetic.

 

[Chacka]

The people arguing against MFA only demonstrate that they do not understand how modern MFA works. In fact, if SSG implemented MFA for DDO and made it optional, pretty much every argument the naysayers have against it are nothing but boogeymans based on FUD rather than logic and understanding.

A) In non-critical use cases (i.e. online games), it's generally OPTIONAL. For the "I'm not gonna click two extra times!!!11" crowd, that means, don't enable it if you don't want it.

B) If implemented properly, MFA lets you flag a device/PC as "trusted" when you authenticate. Going forward, it doesn't give you the MFA prompt when logging in from that device because it knows it is trusted. Easy, peasy.

C) Proper MFA systems offer multiple authentication methods in case you lose access to one method (i.e. you lost your phone). You can use email, SMS/txt msg, authenticator apps, etc. The setup wizards also typically recommend and walk you through generating a set of one-time-use, "break glass in case of emergency" codes during the initial setup that you can write down and store somewhere safe in case you need to do a full MFA reset.

So the excuse/anxiety about getting "permanently locked out" is pretty much just a boogeyman rooted in a lack of education/understanding how MFA works. That or someone failed to read and follow the instructions for setting up backup methods provided during the setup wizard.

My day job is a senior network engineer / systems admin at a multi-million dollar company with 500+ employees. We use MFA for pretty much everything we can. I constantly log into firewalls, servers, admin consoles, camera systems, etc., during the normal course of my job. I also help administer MFA for our end users.

If MFA were inconvenient, I'd never get any work done because I'd waste all my time logging in or helping our end users with their MFA. It’s not a problem though because modern MFA is mostly transparent.

In general I think you're right – I don't see how anyone could seriously object to 2FA, especially if it's optional. And every 2FA implementation I know has the exact same kind of backup as a password: if you lose it, there's a recovery option via your email account.

But I also think 2FA has one big downside, and that's the login process. You still have to memorize a password, and on top of that you need the second factor – or even more, if we're talking about full multi-factor authentication.

That's why I prefer a passkey. It's often called single-factor, but technically it isn't: possession of the key plus your fingerprint or PIN are two factors, just combined into one step. So you get proper MFA without the hassle.

This method is at least as secure as usual MFA, and because of the phishing resistance arguably more so. It's also far more convenient, so people actually use it once they get used to it. And to avoid losing access if you lose your key, you can still fall back on your email account – which remains the weak link in the chain, but since you'd normally only ever use the passkey, it becomes very unlikely that anyone gets into your DDO account.

Better still, you can register a second passkey as a backup and keep it somewhere safe. Then you don't need the email fallback at all, and the weakest link is gone entirely.

 

[Solarpower]

In fact, if SSG implemented MFA for DDO and made it optional

If "it's optional" is the main question here.

Also, all of the "hacked" threads always come with those stories about people suddenly found that the game loads up someone else accounts. And that hackers use exactly this method.
Which means, no 2FA/MFA can help in this case, since the hacking occurs AFTER authorisation.