It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
Community
General discussionWARNING! MASSIVE SECURITY RISK ON GOG!(164 posts)(164 posts)
(164 posts)
Pages:
1
2
3
4
5
6
7
8
9
10
11
This is my favourite topic
Posted June 05, 2019
avatar
kbnrylaec: This forum have a codebase update recently.

GOG used to append a single space " " to each line of forum post.
This "feature" was removed about one week ago.

I did not find any other changes yet, just provide a proof that GOG have changed their forum recently.
avatar
eric5h5: All lines (except the last) still have an added space. So that appears not to be a true statement.
Oh, maybe it is the behavior change of Google Chrome (76.0.3806.1 dev channel).
Posted June 05, 2019
avatar
djoxyk: people should start thinking about their own security by themselves already. who forces you to store your card data? can't you copy-paste account # and enter other attributes? it takes 20 seconds and ensures no one will go on a shopping spree with your money.
gog definitely should fix this issue with auto-login and messed up cookies but users also should take care as well.
I agree on both points 100%

avatar
GameRager: Good to hear, but anyone who logs into such an account with info saved could buy games on that card tied to that account. So a fix for the bug would be welcomed.

Also: Please start keeping track of replies ton posts you/others have made and reply to them if possible. Many replies to staff after the first staff reply in a thread get no answer...even when staffers are still logged in and should notice them.
avatar
satoru: NOte this kinda depends though

On steam, while you are able to save your payment method, steam still requires the CCV code when you checkout. This means that even if your account is hijacked, unless the hijackers guesses the CCV they can't buy anything with the account

I havent bought anything on GOG in awhile so I don't know if GOG asks for the CCV on purchases, which would aleviate said concerns

Also why are you using bolded text. If you're concerened people are misinterpreting your intent, don't bold your posts which from a perception perspective looks one step down from all caps.

If I had to guess what the problem is, it's likely similar to the web caching issues Steam had during Christmas

https://store.steampowered.com/news/19852/
This is all good info


(Btw to everyone: This may sound whiney but why are all my posts ITT downrated? Do people doing so think i'm overly critical of GOG? That i'm trying to spread fear[i'm not, to clarify]? Also why are non others expressing any similar concerns downrated? See how just leaving low ratings causes confusion and doesn't solve anything?

This post by satoru was also not fearmongering/shilling and had truthful and good info yet it was low rated as well until a bit ago, btw.

If one posts truthful info for a good reason I ask people please don't downrate and possibly hide such info from others because you dislike it.

*end offtopic*)

avatar
GameRager: How do we know you didn't make another account long ago and log into it to enact a ruse?

I only ask as it'd seem far more easier to do than being logged into someone else's account.

Though if you are genuine(and I don't see why you wouldn't be) this is a problem.
avatar
fronzelneekburm: A fair question. But what would I have to gain from staging the whole thing?

I‘m not opposed to a little vice now and then. But to me the art of trolling involves getting a maximum amount of butthurt with a minimum amount of effort. Let‘s just say if I had opened an account several years ago, amassed 43 games on that account in order to make it seem legit only to strike at the right moment and then getting four pages of lukewarm dorama and people lulling themselves into a false sense of "2FA‘ll fix it!"-safety in return, I‘d be pretty depressed right now over the pretty poor yield of lulz.
To be fair I wrote that BEFORE reading the whole thread(I jumped the gun and for that/showing you in any bad light I apologize). I have since read it and seen this isn;t the case, and again say I am sorry for even alluding to it in the first place.

avatar
timppu: They don't, and they should.

So yeah, for the time being it is a good idea to remove any "saved" credit card in your GOG account.
avatar
DebbieL: I bought a game the other day and they did indeed ask for the CCV.
Was it after a period of not buying? I ask as it doesn't ask me every time for such info, and I feel that they should(as others said) each time.
Post edited June 05, 2019 by GameRager
Posted June 05, 2019
avatar
GameRager: Was it after a period of not buying? I ask as it doesn't ask me every time for such info, and I feel that they should(as others said) each time.
Yes, it was. I just tested it out again by buying a cheap game in my wishlist from the sale, and it didn't ask for the CVV or a confirmation. And you're right, it should.
Posted June 05, 2019
Wouldn't the credit card token be client side, on one's own computer or mobile device?
Thus, this is a non-issue for someone who accidentally is logged into one's account.

Nonetheless, this is a serious issue, not only for privacy concerns and potential mischief, but as I pointed out, if one has Wallet Funds on one's account.
Posted June 05, 2019
avatar
GameRager: Was it after a period of not buying? I ask as it doesn't ask me every time for such info, and I feel that they should(as others said) each time.
avatar
DebbieL: Yes, it was. I just tested it out again by buying a cheap game in my wishlist from the sale, and it didn't ask for the CVV or a confirmation. And you're right, it should.
If only they'd make it check every time you made a purchase that would solve a good portion of the problem.

avatar
RWarehall: Wouldn't the credit card token be client side, on one's own computer or mobile device?
Thus, this is a non-issue for someone who accidentally is logged into one's account.

Nonetheless, this is a serious issue, not only for privacy concerns and potential mischief, but as I pointed out, if one has Wallet Funds on one's account.
I have actually logged in on other computers and still had the payment info show up....so it;s likely GOG/etc side.

But yeah it is an issue irregardless.
Post edited June 05, 2019 by GameRager
Posted June 05, 2019
avatar
timppu: They don't, and they should.

So yeah, for the time being it is a good idea to remove any "saved" credit card in your GOG account.
avatar
DebbieL: I bought a game the other day and they did indeed ask for the CCV.
Well, I had saved my CC "for later use" in GOG, and I never had to enter the CCV. Now that I removed it, now I of course have to enter all information.

One clarification though: my current card is a debit card, not a credit card. But it has a CCV as well etc. I prefer using a debit card because then I see instantly if the payment went through and I like to know all the time how much I've spent for luxury items like DRM-free GOG games.

avatar
RWarehall: Wouldn't the credit card token be client side, on one's own computer or mobile device?
Do you mean a cookie? It doesn't seem to matter if you use a new browser on a new computer, or clear the cookies on your current browser, and you still don't have to enter CC details.
Post edited June 05, 2019 by timppu
Posted June 05, 2019
avatar
RWarehall: Wouldn't the credit card token be client side, on one's own computer or mobile device?
avatar
timppu: Do you mean a cookie? It doesn't seem to matter if you use a new browser on a new computer, or clear the cookies on your current browser, and you still don't have to enter CC details.
That is bad. Doesn't matter if GoG doesn't store one's credit card details if one can still make purchases using it even if logged in from a different computer...
Posted June 05, 2019
avatar
timppu: Do you mean a cookie? It doesn't seem to matter if you use a new browser on a new computer, or clear the cookies on your current browser, and you still don't have to enter CC details.
avatar
RWarehall: That is bad. Doesn't matter if GoG doesn't store one's credit card details if one can still make purchases using it even if logged in from a different computer...
I/others already brought this up, but yeah.
Posted June 05, 2019
Wow this is frightening. Is it fixed yet?
Posted June 05, 2019
So that's why from time to time I have different language settings? (Like today...)
Posted June 05, 2019
avatar
Trid: So that's why from time to time I have different language settings? (Like today...)
I'm not 100% sure but for me it was due to using a browser not 100% supported by the site.
Posted June 05, 2019
avatar
chandra: Thanks for reaching out about this. This situation is currently being investigated.
Will we hear back from you after the investigation?
I often use wallet funds, I want to know if it's not safe!
Posted June 05, 2019
avatar
fronzelneekburm: I didn't use it to artificially boost the number of votes for Grimoire on the community wishlist.
Your restraint is to be commended. This would have been my first order of business. :P
Posted June 06, 2019
This is GOG. That means we will dont hear back from then. And it means that there is no investigation. It basically means "We get nothing right and are not ashamed of it". They are programming a Client 2.0 while the other is and was never fully functional over years. That means "GOG".
Post edited June 06, 2019 by Prian
Posted June 06, 2019
Well, I removed the saved card details anyway. I don't buy games often enough that it's a hassle to have to type everything in.
Pages:
1
2
3
4
5
6
7
8
9
10
11
This is my favourite topic
Community
General discussionWARNING! MASSIVE SECURITY RISK ON GOG!(164 posts)(164 posts)
(164 posts)