WoW, Casually: Tips for keeping your account safe
Robin Torres writes WoW, Casually for the player with limited playtime. Of course, you people with lots of playtime can read this too, but you may get annoyed by the fact that we are unashamed, even proud, of the fact that beating WoW isn't our highest priority. Take solace in the fact that your gear is better than ours, but if that doesn't work, remember that we outnumber you. Not that that's a threat, after all, we don't have time to do anything about it. But if WoW were a democracy, we'd win.
Amaxe suggested in the comments of a previous column that I cover addons for casuals, which I think is a great idea. But that will have to wait until next week, because I think that we should first make sure that you all practice safe internet use before sending you off to find addons. There are different security camps that always argue in the comments about what operating systems, browsers and browser addons are best for keeping your computer secure, but I'm going to keep this very simple and assume that you are not willing to run out and buy a new computer with an unfamiliar operating system. Here are some tips for making your account more secure.
Keep all of your software up to date
Browser, operating system, any other programs you use should all be the latest version because manufacturers are constantly filling security holes. No operating system or browser is safe, though some are safer than others. If you are on a PC, don't depend on Windows Update alone to keep you current, make sure that all of your non-windows software is recent, particularly if there is no auto-update function. Keep a set of bookmarks for sites to check for new versions and check them periodically. What I use: Firefox 3.x on a Windows XP PC.
Scan with an antivirus/antispyware program daily
It's not good enough to just have antivirus software running in the background. Many trojans can sneak by your regular detection but will be picked up in a scan. A lot of software will require you to change the settings to remove or quarantine the offending program, so even just scanning isn't enough. Make sure that the malware isn't just detected -- it must be deactivated. If the budget is tight, you don't have to worry about actually buying an excellent antivirus program. There are many free options available. Get one and set it up to scan when you're not using it. What I use: Clamwin Free Antivirus.
Don't buy gold or use powerleveling services
I can't stress this enough. I know that some of you rationalize doing this with the idea that you work hard and make good money and therefore don't have time to "catch up" to everyone, so you feel justified in using these services. But there is a whole lot of game on the way to max level that is fun -- it's not just about racing to the end. And these days, getting gold and leveling up is cake. But most importantly, you are putting yourself at risk when you give these people any of your information. It also keeps them in business, making account hacking profitable and more likely. Just don't do it.
Don't fall for phishing schemes
Phishing scares me because of how they prey on everyone from the naive and unsavvy to the competent but careless. The clever ones use logos from the actual sites and websites that are so close to the real ones that they can fool people who aren't really paying attention. Of course, phishing isn't just for WoW accounts -- no online account is safe, even banks. Just remember that no company is going to send you an email asking for every little detail of your life, particularly your account password. Carefully pay attention to where you are clicking and be suspicious of all unexpected emails asking for your personal information. Also, bookmark your favorite WoW addon and info sites rather than typing the names into your address or search bars. These crooks make websites that are just one letter off of the ones you are looking for and ask for info or load you up with keyloggers if you happen into their lair. If you find yourself in one of these places, immediately run a virus scan and don't login anywhere until your system is clean.
Get an Authenticator
There have been no confirmed account hackings if there is an Authenticator on the account., according to Blizzard. Even if that one store is true, one case out of so many sold is really good odds. If you live in the U.S., they are dirt cheap ($6.50) and are shipped for free. They are available in other countries, but the shipping is a bit steep. Still, it is an excellent investment if you plan to play regularly for a while. I just got one and it adds an extra step which is only a slight inconvenience. Also, if you play at internet cafes or on multiple machines, you can feel safer knowing that the extra step will keep you safe no matter how unsafe the system you are using.
Reports of accounts being hacked are on the rise. And don't think that only the hardcore raiders with the leet gear are the ones who have to worry. If these criminals get your info, even if you are a noob with a bunch of low level alts, they will scrape the copper from your pockets and use your characters for their own nefarious purposes. So take these simple precautions and next column, we'll talk about how to choose your addons.
For more information on account security, please read WoW Rookie: Account Security Basics and Account security mythbusting.
WoW, Casually is a column for those of us who are playtime-challenged. We had another good year last year and the new expansion has brought back a lot of players returning as casuals. If you have questions or tips about how to get the most out of your limited playtime, please send them to Robin.Torres AT weblogsinc DOT com for a possible future column.
Amaxe suggested in the comments of a previous column that I cover addons for casuals, which I think is a great idea. But that will have to wait until next week, because I think that we should first make sure that you all practice safe internet use before sending you off to find addons. There are different security camps that always argue in the comments about what operating systems, browsers and browser addons are best for keeping your computer secure, but I'm going to keep this very simple and assume that you are not willing to run out and buy a new computer with an unfamiliar operating system. Here are some tips for making your account more secure.
Keep all of your software up to date
Browser, operating system, any other programs you use should all be the latest version because manufacturers are constantly filling security holes. No operating system or browser is safe, though some are safer than others. If you are on a PC, don't depend on Windows Update alone to keep you current, make sure that all of your non-windows software is recent, particularly if there is no auto-update function. Keep a set of bookmarks for sites to check for new versions and check them periodically. What I use: Firefox 3.x on a Windows XP PC.
Scan with an antivirus/antispyware program daily
It's not good enough to just have antivirus software running in the background. Many trojans can sneak by your regular detection but will be picked up in a scan. A lot of software will require you to change the settings to remove or quarantine the offending program, so even just scanning isn't enough. Make sure that the malware isn't just detected -- it must be deactivated. If the budget is tight, you don't have to worry about actually buying an excellent antivirus program. There are many free options available. Get one and set it up to scan when you're not using it. What I use: Clamwin Free Antivirus.
Don't buy gold or use powerleveling services
I can't stress this enough. I know that some of you rationalize doing this with the idea that you work hard and make good money and therefore don't have time to "catch up" to everyone, so you feel justified in using these services. But there is a whole lot of game on the way to max level that is fun -- it's not just about racing to the end. And these days, getting gold and leveling up is cake. But most importantly, you are putting yourself at risk when you give these people any of your information. It also keeps them in business, making account hacking profitable and more likely. Just don't do it.
Don't fall for phishing schemes
Phishing scares me because of how they prey on everyone from the naive and unsavvy to the competent but careless. The clever ones use logos from the actual sites and websites that are so close to the real ones that they can fool people who aren't really paying attention. Of course, phishing isn't just for WoW accounts -- no online account is safe, even banks. Just remember that no company is going to send you an email asking for every little detail of your life, particularly your account password. Carefully pay attention to where you are clicking and be suspicious of all unexpected emails asking for your personal information. Also, bookmark your favorite WoW addon and info sites rather than typing the names into your address or search bars. These crooks make websites that are just one letter off of the ones you are looking for and ask for info or load you up with keyloggers if you happen into their lair. If you find yourself in one of these places, immediately run a virus scan and don't login anywhere until your system is clean.
Get an Authenticator
There have been no confirmed account hackings if there is an Authenticator on the account., according to Blizzard. Even if that one store is true, one case out of so many sold is really good odds. If you live in the U.S., they are dirt cheap ($6.50) and are shipped for free. They are available in other countries, but the shipping is a bit steep. Still, it is an excellent investment if you plan to play regularly for a while. I just got one and it adds an extra step which is only a slight inconvenience. Also, if you play at internet cafes or on multiple machines, you can feel safer knowing that the extra step will keep you safe no matter how unsafe the system you are using.
Reports of accounts being hacked are on the rise. And don't think that only the hardcore raiders with the leet gear are the ones who have to worry. If these criminals get your info, even if you are a noob with a bunch of low level alts, they will scrape the copper from your pockets and use your characters for their own nefarious purposes. So take these simple precautions and next column, we'll talk about how to choose your addons.
For more information on account security, please read WoW Rookie: Account Security Basics and Account security mythbusting.
Filed under: Analysis / Opinion, Tips, Guides, WoW, Casually, Account Security







Reader Comments (Page 1 of 3)
woca Feb 5th 2009 5:04PM
i feel like getting one is the opposite of casual
Clevins Feb 5th 2009 6:04PM
Why? Aside from the Authenticator, everything in that post is just good basic security. It's not hard, it's just stuff you should do. And $6.5o can't be considered a hardcore amount of money.
I mean, feel free not to do any of this, but if you get hacked, don't complain. It's like not locking the car doors, then saying "OMG they stole my car!!"
woca Feb 5th 2009 9:53PM
why would it be casual? of course i don't think people visiting this site play wow very casually so maybe the series of articles is titled wrong
Monstertroll Feb 5th 2009 5:04PM
I have to say O RLY at everything.
Cyanea Feb 5th 2009 5:14PM
I use an Authenticator. Bought one after a week where two guildmates got hacked. I love it.
Lephturn Feb 5th 2009 5:22PM
Authenticator is excellent account security.
Also note, use Firefox as your browser and be SURE to use NoScript!
monk Feb 5th 2009 5:28PM
i am [ ] this close to finishing up loremaster in northrend and i just recently heard that questhelper is a very very dangerous mod to be using. in the last month 3 of our guildies have been hacked and each suspect questhelper played a major part in it. what concerns me is i am a guild leader, and if someone in my guild was hacked, what are the chances that the hacker can see who is gm and target me next? and does blizzard have any fail safe for guild leaders who get hacked?
Tone Feb 5th 2009 5:54PM
Its not questhelper that is the issue, its the site they are obtaining it from.
WoWInterface and Curseforge seem to be doing a good job at keeping the "issues" out these days.
Just be prudent about scanning the file before unzipping it, and above all else, dont run any .exe included in any addons.
Quickshiv Feb 5th 2009 5:53PM
For the 10000000000000000000000000th time mods cant do that.
The lua engine starts AFTER you log in which is AFTER your password has been removed from memory. There is also no way for a mod to interact with any form of network communication so it can't send your password to anyone.
MODS use LUA script the only thing they can do is what wow lets them do and installing themselves as a system application or copying your password is not one of those things.
Any mod that has an installer application is subject to scrutiny because the installer not the mod could contain a virus. As long as you are getting your mods from a reputable place like curse, wowace, or wowinterface you will be fine.
Quickshiv Feb 5th 2009 6:04PM
Ok I had to post again just because the 2nd part of the post is ridiculous too.
How would a 'hacker' target you next based on your characters name? Is it your username? Do you share a computer with the guy that got hacked? Does the guy who got hacked know your username and password?
The chances of seeing who is GM is 100%. There is this little website called wowarmory.com that gives anyone that information.
/facepalm
sankto Feb 5th 2009 7:02PM
for god' sake, read this thread in his entirety :
http://www.wowhead.com/?forums&topic=54991
No, QH isn't the cause of the recent hacking of your unfortunate friends.
nate Feb 5th 2009 5:30PM
I'd love to buy an authenticator, but the bloody things are always sold out.
Every time there is fresh stock they sell out rather fast as well.
Clearly there is quite a demand for them; why are there not more of them available?
Hard8 Feb 5th 2009 5:33PM
Simple
Scan for Spyware/Virus...clean?
Great now make a txt doc on your desktop with a random name and type your password in there.
Now just copy & paste it into WOW everytime your login
sometime later....
oh no you got a virus/spyware....keylogger?
Well they wont get your password because you never type it in
just a long log of CTRL+C, CTRL+V
Lephturn Feb 5th 2009 5:44PM
Sigh, NO copy/paste will NOT prevent your password from being logged and stolen.
Although they might be called simply "key loggers" these malware programs are a lot more sophisticated than that.
Also re: quest helper... I switched to Carbonite Quest - MUCH lighter on resources than Quest Helper anyway.
shadowwolf007 Feb 5th 2009 5:44PM
Wrong.
Any application can read from the clipboard at any time. It's a global thing, not a per-application thing ( how else do you get your text from Word in to your favorite chat application ).
Clipboard text is stored in plain text, so it's easily readable by any application on the system. Thus explains this security policy implemented in IE7: http://msdn.microsoft.com/en-us/library/bb250473(VS.85).aspx
Clipboard text is grabbed through a standard API call that is the same on nearly every Windows OS. This means all you have to do is copy out clipboard contents whenever someone pastes something in and parse. Within a few seconds you can figure out if it's text and, if so, whether it's a password.
And hey, a sample application for how this can be done is available on MSDN:
http://msdn.microsoft.com/en-us/library/ms649016(VS.85).aspx
So not only can I do this, but I can do so writing not even 1 line of my own code.
*PLEASE* stop spreading this misinformation. It doesn't matter where you heard it: This advice is wrong.
Read more on the clipboard here:
http://msdn.microsoft.com/en-us/library/ms649012(VS.85).aspx
JohnC Feb 5th 2009 5:45PM
thats technically not true, viruses can do many things, one of which is take a screenshot of youre screen at a particular time, so having youre password written plainly in a text document will mean it can be easily taken.
Erthshade Feb 5th 2009 5:52PM
Congratulations, you have managed to fool the most literal interpretation of keylogger. Now, how about the ones that sniff your outgoing packets or examine your clipboard contents whenever they change or get pasted?
Sinogasan Feb 10th 2009 9:36AM
This is bad advice.
You should never write your password down, never mind putting it in a text file on your desktop - why not tape it to the monitor, or place it on a post-it under the keyboard?
There are malicious websites that can copy the contents of your clipboard. If you're truely paranoid, turn off javascript and don't use IE (ActiveX).
Memorize your password, run a virus scanner (that is up to date), use a spyware utility regularly - Malwarebytes is a good one, so is SpyBot. Change your password regularly. Passwords should be non trivial and not contain dictionary words and be at least 10 characters in length.
Kooshi Feb 5th 2009 5:38PM
i'm actually a pretty frequent player.. i usually play about 3-4 hours a day.
after 2.5 years of playing, i just had my account hacked on sunday. i know all about keeping my computer safe, since i used to work in the IT field.
after several AV/malware/spyware scans, my computer turned up clean. no one else plays on my account normally either.
so the only possible explanation is that my account got keylogged or hacked or something when i went to a gaming cafe to play. so use caution when going to one of those.
also, i had the authenticator on my account, but i took it off when wotlk came out cuz it was getting annoying. needless to say, its back on now, and its never coming back off.
steve Feb 5th 2009 5:41PM
It took me a couple of tries to successfully order one. It blows me away that Blizz offers these for $6.50. I work in a company that does IT operations and we provide this kind of service for some of our customers, so I'm a true believer in the approach. Some of the brokerage firms provide this kind of technology for their customers to access their accounts from web browsers -- e*Trade gives them to customers with over $50K in assets and charges $25 for their other customers that want them.