Because your email should be tied to your phone with 2 step.

It's free/included under most plans here. If you're living in poverty you get a free Obamaphone with unlimited calls, texting, and data as well so money isn't even a factor anymore.

There are email forwarding services that allow you to create unique email addresses without them being throw-away ones.



Except that I didn't express any sort of surprise.

No, that's not really true. Yes, people's plans generally include that, but that doesn't make it free to send them. What's more, they'd have to find a way of offering it in a rather large number of countries.

Thank you for adding HTTPS Everywhere.

Would it be difficult to add support for unicode characters in passwords?
Would that possibly be overkill for password strength?

Great Features! Thank you, GOG Team ^_^

My problem was with Alts, not paying for discounted games. I was just coming up with an (arbitrary) number for the paygate, beyond letting an Alt account buy a .99 game. I thought the base (in my region) price was a fair one. I still think it is pretty decent and we know GoG has the means to track how much an account spends to "unlock" something (see the last few sales) even if it isn't in a single transaction. So I think still think it's a decent solution.

The problem the paygate DOESN'T address is people who steal CCs, buy GoG codes and then sell them. But I look at GoGs existing solution to that problem as a fair one - revoke the stolen good from the receiving account. If you think buying games on a third party reseller site for half the price isn't shady, then learn the term "Caveat Emptor." I know if you do that in the "real world" you'd be learning the term "Receiving Stolen Goods."

I do think this current action is a good one for helping with the issue you bring up (hacking and reselling accounts). I know I always tried to be proactive with that myself by 1) not joining any more websites than I have to 2) not sharing account names and or passwords - because the second you do that, you essentially open yourself up to being hacked on multiple fronts, where the weakest link is always the weakest website's security. When your Steam Account, Sony Account, Microsoft Account, Retail Store X, Y, and Z account, MMO of the month account and 3 game website accounts share the same persona and password you're going to be in trouble.

I refuse to belief that the vast majority of these are brute force attacks on one account. And when they are, it's probably more a case where the individual is targeted (User Trollz pisses off User Le3tHaxZkillz and next thing, bang - account hijacked).

I'm guessing the rash of hacked accounts here from a year or so ago was due to a more widespread hack, where an intrepid group was able to pull a bunch of username / passwords and then attempt to apply them over a wide group of similar sites (hack an MMO or 3, hack a game company / site etc then try using those to grab steam / origin / gog / ubi etc accounts).

Steam allows both modes when logged in. I hope to see similar feature on GOG.

Thanks for enabling HTTPS properly :)

This must be a good day for you especially! I think you were one of the people who brought it to my (and many other users) attention initially! Keep up the good work (and you too GoG!).

Yeah, I've been waiting for a while for this, though HTTPSeverywhere rule worked pretty well for GOG. Hopefully there won't be a need for it anymore :)

Fantastic. It's about time, too. There's no reason not to enable it in this day and age, if you ask me.

This is a great update. Thank you GOG, security is very important in this day and age.

Really curious, why do you want to stay on http?

As pointed out by timppu and mrkgnao among others, it's a half-assed solution and unfortunately not very useful in its current incarnation. I'll wait for improvements...

I'm too lazy to read through the entire thread, so this has likely been mentioned. But I want to add in my support for 2 factor authentication each time you log in and not only "some" of the time. Because this still leaves you vulnerable to attacks. But, it's a step in the right direction. And it's good that you made it optional, in case some folks don't want it for their personal reasons.