It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
Community
General discussionMy account was stolen by a russian !(102 posts)(102 posts)
(102 posts)
Pages:
1
2
3
4
5
6
7
This is my favourite topic
Posted June 19, 2015
Yesterday morning I have received one of those emails you never want to receive:

no-reply@gog.com

"Hi XXX, your e-mail address was changed

This is a confirmation, that the email address associated with your GOG.com account XXX (rostilovka88@gmail.com) was successfully changed. Below you will find the details of this operation:
New email address: rostilovka88@gmail.com
Previous email address: xxxx@xxx.xxx
IP Address: 95.81.223.143
OS: Windows 8.1
Browser: Yandex Browser 15.4.2272
Estimated location: Novocheboksarsk, Russia"

Watch out guys there is a security breach somewhere.
Looking for my account back and for a two steps authentification method.
Post edited June 19, 2015 by Ciris
No posts in this topic were marked as the solution yet. If you can help, add your reply
Posted June 19, 2015
high rated
avatar
cavaler-2: Yesterday morning I have received one of those emails you never want to receive:

no-reply@gog.com

"Hi XXX, your e-mail address was changed

This is a confirmation, that the email address associated with your GOG.com account XXX (rostilovka88@gmail.com) was successfully changed. Below you will find the details of this operation:
New email address: rostilovka88@gmail.com
Previous email address: xxxx@xxx.xxx
IP Address: 95.81.223.143
OS: Windows 8.1
Browser: Yandex Browser 15.4.2272
Estimated location: Novocheboksarsk, Russia"

Watch out guys there is a security breach somewhere.
Looking for my account back and for a two steps authentification method.
Hi!

First off, I'd like to apologise to all who have experienced account hacking on our site over the past couple of days. We're hard at work to make this less of an issue and less likely to happen - but I understand how frustrating it must be to lose access to your games.

Having said that, there's a new measure that will help us pick up on hacked accounts more easily.

If your account e-mail changes, you will get an automated message.

It that looks like this and has the new e-mail address, the old one, the IP currently in use (together with estimated location), and the OS and browser of the current user.

If you get such a message and it wasn't you who changed the email address, contact us.

Use the link at the end of the message ("contact our support team") to let us know it happened. You'll be redirected to our contact form - here's an example of how to fill that in.

We do our best to get back to hacked account emails as soon as possible, and to change the e-mail addresses as quickly as we can and restore the fully functional accounts to their rightful users.

IMPORTANT:

1) When contacting us regarding a hacked account, you must replace the e-mail address with one you have access to - otherwise, our reply will end up at the hacker's e-mail address, which you have no control over or access to.

2) Please do not send multiple requests to support - if you do, your request is pushed to the back of the queue again. If you feel the need to add more details to your support request without getting bumped back, you can do so by replying to the automated support reply you will get with your Ticket ID.

3) As soon as you get access to your account back, please change your password. It may be a simple thing, but please don't forget. It will mean the hacker once more lost access to your account for sure.

[edit]: bumped this to be the 2nd reply in the topic so it's easier to find for others with a similar problem, re-bumped the original post to the top to remain above the reply.
Post edited June 19, 2015 by Ciris
Posted June 19, 2015
avatar
shmerl: Just stop thins nonsense. If you don't get it, then learn a bit about MITM, and then think twice about sending passwords in clear text anywhere. Anyone can harvest it this way by faking that site for instance using some DNS hijacking or what not.
lol At this point I'm convinced your prescription medication is low. Sometime leave your fortress of irony and learn about how "man in the middle attacks" are an non-issue in this case. But it's extremely clear you out-of-hand ignore germane info relevant to the point, so this comes as no surprise.
avatar
shmerl: I'll repeat - don't make others do them because of the ill advice.
Here. Maybe this will help.

You don't even seem to understand the difference between making and suggesting.
Post edited June 19, 2015 by Firebrand9
Posted June 19, 2015
avatar
Firebrand9: non-issue
Hah, I even described you a scenario when it's trivial to steal all you send and your audit is worthless. But obviously it's a "non issue".
avatar
Firebrand9: You don't even seem to understand the difference between making and suggesting.
Suggesting bad security practices makes your responsible for other people's problems.
Post edited June 19, 2015 by shmerl
Posted June 19, 2015
avatar
shmerl: Hah, I even described you a scenario when it's trivial to steal all you send and your audit is worthless. But obviously it's a "non issue".
That can only occur via malware. You don't even understand the basic tenets of software functionality. And you're attempting to give other people advice, attacking anything contrary to your point, passing yourself off as a security expert? Do you have NPD?
Posted June 19, 2015
While these two were having a flame war I went in and snagged all of their games.

Who wants in on this stuff? :P
Posted June 19, 2015
avatar
shmerl: Suggesting bad security practices makes your responsible for other people's problems.
Caveat emptor. And it applies equally to you.
Posted June 19, 2015
avatar
shmerl: Hah, I even described you a scenario when it's trivial to steal all you send and your audit is worthless. But obviously it's a "non issue".
avatar
Firebrand9: That can only occur via malware.
It doesn't matter how it can occur. DNS hijacking can happen. You can't make any assumptions. That's what best security practices are. And what you suggested above surely isn't one.

avatar
shmerl: Suggesting bad security practices makes your responsible for other people's problems.
avatar
Firebrand9: Caveat emptor. And it applies equally to you.
It applies to everyone.
avatar
Firebrand9: You don't even understand the basic tenets of software functionality.
For me it's apparent that you have no clue about security. It was obvious when you suggested to send passwords over clear text with no https. Nothing more to add.
Post edited June 19, 2015 by shmerl
Posted June 19, 2015
avatar
tinyE: While these two were having a flame war I went in and snagged all of their games.

Who wants in on this stuff? :P
They got anything good?
Posted June 19, 2015
avatar
shmerl: It doesn't matter how it can occur. DNS hijacking can happen. You can't make any assumptions. That's what best security practices are. And what you suggested above surely isn't one.
Apparently you don't understand statistics. The odds of that occurring on multiple site you're using is astronomical. But, remote equals likely to you.

avatar
shmerl: It applies to everyone.
Yet, you fail to see the irony of your stance. Amazing.

avatar
shmerl: For me it's apparent that you have no clue about security. It was obvious when you suggested to send passwords over clear text with no https. Nothing more to add.
I always think it's cute how people get Linux and then think they're a security expert, understanding little to nothing of how security violations actually occur. Maybe read some Mitnick books or learn something about software engineering and you'll see that your sentiments are misguided at a minimum. Stop spreading nonsense about your confirmation bias and paranoia.
Post edited June 19, 2015 by Firebrand9
Posted June 19, 2015
GoG.com I highly recommend you remove the change email address function/button all together from account settings until you put in security measures to protect against account break-ins. At this point everyone should be updating their GoG passwords weekly -
Posted June 19, 2015
avatar
shmerl: It doesn't matter how it can occur. DNS hijacking can happen. You can't make any assumptions. That's what best security practices are. And what you suggested above surely isn't one.
avatar
Firebrand9: Apparently you don't understand statistics.
Best security practices are based on difficulty of breaking those measures, not on statistics of how interested someone can be in that breaking. So you either follow them or you don't. Sending passwords in clear text is not a good security practice, and if you argue with that - you really have no clue about security.
Post edited June 19, 2015 by shmerl
Posted June 19, 2015
avatar
shmerl: Best security practices are based on difficulty of breaking those measures, not on statistics. So you either follow them or you don't. Sending passwords in clear text is not a good security practice, and if you argue with that - you really have no clue about security.
*facepalm of epic proportions* Is this all you have? This one trick pony that's easily logically disproven?

The statistics indicate the difficulty. Learn cause and effect.
Post edited June 19, 2015 by Firebrand9
Posted June 19, 2015
avatar
Firebrand9: *facepalm of epic proportions* Is this all you have? This one trick pony that's easily logically disproven?
Discussion closed. Someone with 20 years in IT teaches people to send passwords in clear text? It's not even a comedy, it's a farce.
Post edited June 20, 2015 by shmerl
Posted June 20, 2015
avatar
Maighstir: Agreed. Personally, I use Keepass.
avatar
shmerl: I just stumbled on this article: https://www.cs.ox.ac.uk/files/6487/pwvault.pdf

Which made me think about how good Keepass / KeepassX actually is.
Interesting read, thanks.
Posted June 20, 2015
avatar
shmerl: Discussion closed. Someone with 20 years in IT teaches people to send passwords in clear text? It's not even a comedy, it's a farce.
...
. . .

F A C E P A L M

Ok, that's enough internet for today.

Good luck with your future strawman attempts.
Post edited June 20, 2015 by Firebrand9
Posted June 20, 2015
just enter a similar password with different letters and numbers but the same structure to test the strength
Pages:
1
2
3
4
5
6
7
This is my favourite topic
Community
General discussionMy account was stolen by a russian !(102 posts)(102 posts)
(102 posts)