Fort Knox level account protection here

[Beaner]

this is a pretty good idea and i will do it from today on. it might be all for nothing is mistic is right, but it will make me feel better.

i know a way to check your email. when you logged in go to the getting cash part of the page and choose pay by cash. here you get sent to a diff page, a all brown and white one. just put in false stuff and press next a couple times it will take you to a confirm page where your email is automatically entered. i found this by accident, sadly it was after i got locked off my old MM and i couldnt check what the email was for it. i did however recover a mule email like this once that i forgot.

it should still work, i havent tried this in a few months though.

[RoxStarzzz]

Someone wrote this in another thread yesterday and it worked for me. I went and got a random email to set up my account and then made up my name, but I did use a birth date that I remember (lucky me). I went to the MapleStory site last night and at the bottom of most announcements it says "email to a friend". I emailed it to myself and it had the email I set the account up with and the name that I used to set it up. Great way to find an email and name if you forgot or made up the info. I can't help with made up BD's though.

[ImagineAll]

this is a pretty good idea and i will do it from today on. it might be all for nothing is mistic is right, but it will make me feel better.

i know a way to check your email. when you logged in go to the getting cash part of the page and choose pay by cash. here you get sent to a diff page, a all brown and white one. just put in false stuff and press next a couple times it will take you to a confirm page where your email is automatically entered. i found this by accident, sadly it was after i got locked off my old MM and i couldnt check what the email was for it. i did however recover a mule email like this once that i forgot.

it should still work, i havent tried this in a few months though.

Ahh, beat me to it. I wrote up something similar last night, right up until my net died.

Like Carlos said, it's not a huge ordeal to find out the email. In fact it takes little to no effort, and certainly less than what they're already doing. Though without the password for the email, knowing the email itself means nothing. Unless of course they're using the forgot password exploit through certain email providers. That said, if they're in a hurry and recognize that they may only have a small time window of opportunity they may just skip over accounts like these. Who knows.

It's also worth mentioning that the people -claiming- to be behind this are well known players in Bera (mostly due to their illegitimately scrolled perfect weapons; something else they had a hand in), and could very well be reading all of this =/

[SpikeAi]

Interesting solution. I was going to say your plan could be backfired, but I forgot that the hacker does not know your dob, which technically means you're safe, because without knowing that, they cannot alter the current password on the site even if they have your current info. Nice going, Spidey ...for a man.

If the database was compromised its pretty safe to assume they were capable of viewing all of it. Meaning your Birthday, your email address and your last name. If you assume they can still access the database this would make accessing your account an inconvenience and nothing more.

If the database was truly compromised I find it hard to believe that the security hole hasn't been patched.

[Kawasari Mimoto]

If the database was compromised its pretty safe to assume they were capable of viewing all of it. Meaning your Birthday, your email address and your last name. If you assume they can still access the database this would make accessing your account an inconvenience and nothing more.

If the database was truly compromised I find it hard to believe that the security hole hasn't been patched.

You're right. I too would assume it has been patched, but no one knows for sure how many accounts they have access to. They never specified xx,xxx amount, did they? If they did, feel free to correct me on whether those hackers has stated that they have access to those amounts. Also, what if it was patched, but they found another hole to get in? There is no known fact that claims "Hey, we patched it, now hackers won't be able to get in, at all!". These are all opinions, unless Nexon states so themselves. All we can do, as users, is assume.

Secondly, this is Nexon we're talking about here, this isn't Blizzard. Blizzard or any bigger gaming-corporation would surely patch it in an instant as soon as words spreads out. Assuming they have access to every account made before and up to, let's say June 2009... then every account that was created up until that point, they have the information to. Do we know how many accounts they have until they state the #? No. Because to me, it seems illogical that they would only have a small handful of account information. Think about this for a second, if they had access to it, they might have well up to 60-70% of the current accounts made in gMS not including accounts made after June 2009. I'm using this only as an example though.

[LittlePrincess]

You're right. I too would assume it has been patched, but no one knows for sure how many accounts they have access to. They never specified xx,xxx amount, did they? If they did, feel free to correct me on whether those hackers has stated that they have access to those amounts. Also, what if it was patched, but they found another hole to get in? There is no known fact that claims "Hey, we patched it, now hackers won't be able to get in, at all!". These are all opinions, unless Nexon states so themselves. All we can do, as users, is assume.

Secondly, this is Nexon we're talking about here, this isn't Blizzard. Blizzard or any bigger gaming-corporation would surely patch it in an instant as soon as words spreads out. Assuming they have access to every account made before and up to, let's say June 2009... then every account that was created up until that point, they have the information to. Do we know how many accounts they have until they state the #? No. Because to me, it seems illogical that they would only have a small handful of account information. Think about this for a second, if they had access to it, they might have well up to 60-70% of the current accounts made in gMS not including accounts made after June 2009. I'm using this only as an example though.

The number I heard was the hackers had info for 25,000 accounts in GMS. If I recall correctly Nexon reacently announced that it had 5 million users (this probably means accounts) and surely that was spread accross GMS, CMS, SEA, KMS, Europe, Bazril, etc... Does anyone know how many accounts (users) GMS claims to have?

[Takebacker]

The number I heard was the hackers had info for 25,000 accounts in GMS. If I recall correctly Nexon reacently announced that it had 5 million users (this probably means accounts) and surely that was spread accross GMS, CMS, SEA, KMS, Europe, Bazril, etc... Does anyone know how many accounts (users) GMS claims to have?

I would imagine that GMS' population is much larger than KMS', so in that case on a new patch day (a new class) we probably have 270k+ concurrent users at least.

25,000 accounts is 10.8% of the GMS' user base.

[Jellyflower]

If you're an active player, I actually don't recommend it. Sometimes a reset counts as a password change (or the password changes as a reset limit, it's worded ambiguously on the throw error message). So after you call for a reset, you're stuck with the Nexon generated password for 'a day'. I'm not sure what constitutes a day, 24 hours time frame or daily midnight reset. But the random password you get is 11-characters with lower cases and numbers. But if you'll be leaving for some time, you can use this method.

By the way, you can bypass the ctrl, alt exceptions. Just hold down the key and close the warning message and proceed to pressing +V very fast for paste.

[Kirov]

Someone wrote this in another thread yesterday and it worked for me. I went and got a random email to set up my account and then made up my name, but I did use a birth date that I remember (lucky me). I went to the MapleStory site last night and at the bottom of most announcements it says "email to a friend". I emailed it to myself and it had the email I set the account up with and the name that I used to set it up. Great way to find an email and name if you forgot or made up the info. I can't help with made up BD's though.

Cool now I know the name I used with my almost 5 year old account. (lol I would have never guessed it. I must have been on crack when I typed that in.)

Now all I need to do is get lucky with the birthday.

Edit: Lady luck is on my side for once. I now have full access to my account again.

[SpikeAi]

Also assuming they have access to the whole database they could use some more advanced queries to guess accounts that may potentually have more to gain from hacking vs the thousands of accounts abandoned at lvl 20. What they would use would be dependent on what kind of information is stored in the database. But we do know based on the events requiring you to be logged in every day or rewarding people who return to maple that the database does keep a records of account activity. So if they query the database to return only accounts active within the last week then they would greatly reduce the amount of bogus accounts.

If I recall the list they posted included account IDs, if they used a query like this then they probably didn't do it for the list they posted (or they wouldn't be sequential).

By the way, you can bypass the ctrl, alt exceptions. Just hold down the key and close the warning message and proceed to pressing +V very fast for paste.

Right click -> Paste

[Scaeva]

Ok, I changed my password to contain a special character yesterday, but today, when I wanted to play after patching, once I asked for a new password to be e-mailed to me, I didn't recieve any e-mail. It's been about 4 hours now and I'm starting to get worried, or at least annoyed by the fact that most people just recieve their new password right away, but that I have to wait more than a 6th of a day(which is a lot compared to a few seconds). This really seems like a good idea, but if it's going to take this long every single time (and now I may have the risk of getting hacked if my password is changed too). I guess I'll just have to take the risk I had before and stick with a password I can use so I can log on whenever I want.

[Shidoshi]

Ok, I changed my password to contain a special character yesterday, but today, when I wanted to play after patching, once I asked for a new password to be e-mailed to me, I didn't recieve any e-mail. It's been about 4 hours now and I'm starting to get worried, or at least annoyed by the fact that most people just recieve their new password right away, but that I have to wait more than a 6th of a day(which is a lot compared to a few seconds). This really seems like a good idea, but if it's going to take this long every single time (and now I may have the risk of getting hacked if my password is changed too). I guess I'll just have to take the risk I had before and stick with a password I can use so I can log on whenever I want.

Are you sure you are checking the right email? The one you used for your account when signing up.

[Scaeva]

Everytime I charged NX I got the confirmation e-mails on that account and I've never changed my e-mail (I still have the registration e-mail too), so either Nexon hates me or something else is wrong.

[Shidoshi]

Check the spam box? Mine arrive a few seconds after requesting

[Scaeva]

Nothing in there. Guess I'll just request again in like 10.5 hours. I should go to bed anyway (22:30 here)

Something really strange is that even though my e-mail was shown at Nexon.net yesterday(while changing my password), I don't seem to have obtained confirmation e-mails from my last NX purchase, but I do have the ones from the one before that. I did disable newletters.

[moore4me]

I was curious lets say if you just used a CUSS WORD as your password... On nexon's database would the language filter catch it and just display ***** for example? I'm not really sure how it works when being displayed on the database but this seems like it would be a good choice if you strung together several.

[Blaine]

You can only manually change your password once a day, btw.

Or you can do what I've been contemplating and edit your packet and intentionally get yourself temp banned, though that won't protect you on the website like this does.

You could do this without editing packets and just type in your password wrong five or six times and get the account temp. banned for 12 hours.

Edit:

The number I heard was the hackers had info for 25,000 accounts in GMS. If I recall correctly Nexon reacently announced that it had 5 million users (this probably means accounts) and surely that was spread accross GMS, CMS, SEA, KMS, Europe, Bazril, etc... Does anyone know how many accounts (users) GMS claims to have?

I remember Nexon celebrating 3 million characters...but I'm not sure how that'd equate to characters, since there's more than one page for people. lol

[Kaasoljoyyx]

You could do this without editing packets and just type in your password wrong five or six times and get the account temp. banned for 12 hours.

Unless you gotta do it multiple times, it's only like a 5 or 10min ban.

And 1 person told me it just DCs you now like before. Not sure if that's true or not.

[Hazzy]

25k accounts is a lot. There's only 35k different users online at 6 PM PST....

[Phoenix]

If you're an active player, I actually don't recommend it. Sometimes a reset counts as a password change (or the password changes as a reset limit, it's worded ambiguously on the throw error message). So after you call for a reset, you're stuck with the Nexon generated password for 'a day'. I'm not sure what constitutes a day, 24 hours time frame or daily midnight reset. But the random password you get is 11-characters with lower cases and numbers. But if you'll be leaving for some time, you can use this method.

You can have either 2 password requests OR 2 password changes OR 1 of each. And the limit resets at 12 AM PST. It doesn't differentiate between a password request and a password change.