People being hacked since the last Server Check.

[Five Second Pose]

I don't get how the ToS works at all. Aren't you not allowed to enter a contract until you're at the age of majority?

[CommanderJinn]

Eos are YOU a lawyer???

And there's a massive difference between slapping a sticker in a car and destroying PHYSICAL property as opposed to something that exists in a VIRTUAL world. Nexon owns the rights to the "property" that we the "players" consider ours. But we don't OWN any of it, as stated by Nexon in the terms of service. ""all content included therein (including without limitation graphics, artwork, music, choreography, characters, character IDs, Forum IDs, account IDs, Cash Items and/or other items acquired or created in the Service, including through the Cash Shop) are owned by Nexon America or its licensors," What we sign up for, by playing the game is the RIGHT to USE the PROPERTY of Nexon. This is why they have the right to revoke any rights we have to use their property in the form of banning players from the game, rollbacks, etc.

Lets bring that to the car analogy from previously. But lets say, instead of YOUR car, it's your friends car. "Hey man, here's a car for you to use a long as you want" Woo! Free car! So you take this car, and put a ton of money into it, put in new upholstery, tint the windows, and add amazing stereo. It's a super awesome car now!

Well, then someone comes along, and since the car is say, of older design, it's easy to break in to. But your friend didn't know that when he LOANED it to you. The jerk that breaks in, steals your crap, pisses all over the interior, and breaks your windows. It's completely un-usable now unless you start all over to repair it.

What are you going to do now? Sue your friend because he didn't know it was an easy target to break into? Demand that your friend pay you all the money you put into the car because it was HIS car to start with?? I think not. I'm not a massive fan of Nexon by any means, but I doubt they were very aware that they had made a huge hole in their security. Either way, it's their game, we don't own a single pixal of it.

By that same logic, how would tenants of apartment be able to file a suit against irresponsible land owners? If an apartment that you've rented out (not your property but that of a landlord) is in a liveable condition and, over a given amount of time, somehow becomes unlivable through, say, another tenant busting their pipes and flooding their apartment, consequently causing water damage to your own, the overall responsibility falls towards both the other tenant and the land lord. If the landlord decides to perform renovations and your apartment becomes damaged then it's still the land lord's responsibility. If the landlord leaves the apartment building unlocked during the night with no security at the door, and you somehow got robbed, it's the land lord's responsibility.

You see where I'm getting at here? We're allowed to use Nexon's property, but if something befalls Nexon which would compromise our use of their property, the responsibility still lies with Nexon, whether or not their terms of service says it does or does not.

The problem with your analogy is that Nexon is also responsible for the protection of our accounts on their servers, unlike your friend with the car. Of course Nexon isn't responsible for hackings that happen to an individual, whose particular situation was totally random and out of their control. The difference is that this was within their control. No one dare say anything along the lines of "Well all things can be hacked" because if they could have fixed this problem after the fact, they could have easily done it before.

The most similar real life situation to this would be when Sony got hacked (I'm not saying Sony is as bad as Nexon, I'm just comparing the similarities of the situations) and user information for thousands of customers were left in the open to be taken, the blame didn't go to the customers, the blame went towards Sony. I'm pretty sure that Sony's terms of use for PSN is similar in wording to Nexon's in which they're not responsible for so and so. That lack of responsibility can apply to stuff like selling accounts, trading stuff for real life money, hacking, but it can't apply to something that is, in every way you look at it, the company's fault.

[Raul]

I don't get how the ToS works at all. Aren't you not allowed to enter a contract until you're at the age of majority?

That's very true.
But the person signing the contract is (supposed to be) 18 years or older.
1.1 "By signing up for an Account and using the Service, you represent and warrant that you are 18 years of age or over and have the right, authority and capacity to enter into this Agreement, or you are the legal age required to form a binding contract in your jurisdiction if that age is greater than 18."
But then:
"Your Account may be used only by you, except that if you are a parent or guardian, you may permit one (1) of your minor children who is 13 years of age or older to use the Account instead of you."
Also contained in 1.1:
"We hereby disclaim any and all responsibility and liability for any unauthorized use of your Account."
And in 1.2:
"We are not responsible or liable if your Account is "hacked" or if your Account (or the information contained therein) is otherwise deleted."

Fun stuff (unrelated) in 1.3

"We reserve the right to be able to refuse to grant you or be able to terminate a username that: ...(vi) includes or is comprised of partial or complete sentences (e.g., "Youwillnotsurvive"), (vii) is comprised of or includes gibberish (e.g., "Akdnvprq"), (viii) is comprised of or includes "Leet" or "Dudespeak" (e.g., OMGnewb, xLOLx, AFKbotman), (ix) is comprised of or includes any rank and/or fantasy titles (e.g., "MajorMark" or "QueenQiana")"

This is great, 1.3:
"YOU ARE ENTIRELY RESPONSIBLE FOR MAINTAINING THE CONFIDENTIALITY OF YOUR USERNAME AND PASSWORD AND FOR ANY AND ALL ACTIVITIES (INCLUDING PURCHASES AND CHARGES, AS APPLICABLE) THAT ARE CONDUCTED THROUGH YOUR ACCOUNT."

Doesn't this make Fiel un-legit?

2.2 "Use any robot, spider, site search/retrieval application or other manual or automatic device or process to retrieve, index, "data mine" or in any way reproduce or circumvent the navigational structure or presentation of the Service or its contents, including, but not limited to, Cash Items;
Harvest or collect information about the Service, visitors to the Site or users of the Service without their express consent;
Download, copy, reproduce, republish, upload, post, transmit, modify, distribute or publicly display any of the content or information contained in the Service except as expressly authorized by this Agreement;"
I know this was big a while ago and Fiel won, but isn't this pretty clear?

lolwut

2.2 "Engage in using macros (i.e., "macroing"), auto-looting or robot play (i.e., "botting") or any other behavior that allows you (or any character you are controlling) to automatically function or effect any action in a game with or without your presence;"
...don't they give us macros that we can set up?

[ChaosH]

And there's a massive difference between slapping a sticker in a car and destroying PHYSICAL property as opposed to something that exists in a VIRTUAL world. Nexon owns the rights to the "property" that we the "players" consider ours. But we don't OWN any of it, as stated by Nexon in the terms of service. ""all content included therein (including without limitation graphics, artwork, music, choreography, characters, character IDs, Forum IDs, account IDs, Cash Items and/or other items acquired or created in the Service, including through the Cash Shop) are owned by Nexon America or its licensors," What we sign up for, by playing the game is the RIGHT to USE the PROPERTY of Nexon. This is why they have the right to revoke any rights we have to use their property in the form of banning players from the game, rollbacks, etc.

I really hate how Nexon owns something I worked on so hard. The only thing Nexon did was creating the world my characters exist. The economy, the characters, the meso, the items, every gaming experience... everything is player's work. Nexon can't even protect their servers/channels from being crashed

Legit or not, Nexon owning my all my hard work is complete BS.

Lets bring that to the car analogy from previously. But lets say, instead of YOUR car, it's your friends car. "Hey man, here's a car for you to use a long as you want" Woo! Free car! So you take this car, and put a ton of money into it, put in new upholstery, tint the windows, and add amazing stereo. It's a super awesome car now!

Well, then someone comes along, and since the car is say, of older design, it's easy to break in to. But your friend didn't know that when he LOANED it to you. The jerk that breaks in, steals your crap, pisses all over the interior, and breaks your windows. It's completely un-usable now unless you start all over to repair it.

What are you going to do now? Sue your friend because he didn't know it was an easy target to break into? Demand that your friend pay you all the money you put into the car because it was HIS car to start with?? I think not. I'm not a massive fan of Nexon by any means, but I doubt they were very aware that they had made a huge hole in their security. Either way, it's their game, we don't own a single pixal of it.

Our accounts are the cars, Nexon database is the garage. If someone's breaks into the garage, who's fault is it? We keep our car keys (login info) safe, but Nexon didn't take care of the garage (MTS exploit, database leaks...).

I really don't care if the car was mine or not, Nexon could at least admit it was THEIR fault.

[MysticHLE]

First you need to find evidence of a break in. Then there has to be a huge loss of money in the picture. Nexon's gonna win that battle.

Evidence of break in is already widely available. I don't need to paste the link of the list of 18k+ IDs leaked due to the MTS exploit.

Losses to be claimed by negligence needs only to be on the players' end, not Nexon's. We put in time and money into the accounts (doesn't matter what ToS says about our money - the fact that the site even says "Purchase NX" and NX pre-paid cards being a commercial item in stores is enough grounds to consider any transaction of NX to be a purchase bound by legal expectations of merchanting and services, and not a donation), got hacked, and if Nexon doesn't do anything about that given the context of the exploits and other players' testimonies (I'm fairly sure at least one other person here would be willing to testify in written declaration under oath), I would think that is grounds for a lawsuit and further (federal) investigation.

Who wins or loses in the end is another matter. But let's scale this up. Suppose 100+ players sued Nexon right now in this instant with the same charges, do you think Nexon would even remotely have the legal resources to handle all 100+ disputes? Hell, they can't even keep up with the same botters that are in the same map for 3 days+!

But suppose Nexon has all evidence to win and settle all 100+ cases, how much resources, time, and publicity would that cost them? You think they'd go through with that - or just revert your hacked account back to a previous state (we've seen that it's obviously possible)?

No - they would want to avoid all legal charges against them, and that's why there is that bull piece of pomegranate ToS that you so faithfully believe that we're bound by simply because we clicked "Agree."

[Stereo]

Our accounts are the cars, Nexon database is the garage. If someone's breaks into the garage, who's fault is it? We keep our car keys (login info) safe, but Nexon didn't take care of the garage (MTS exploit, database leaks...).

I really don't care if the car was mine or not, Nexon could at least admit it was THEIR fault.

In that analogy, the garage has a copy of your car keys hanging on the wall somewhere for the thieves to take once they get in. All they need to do is decide which car to take.

[Eos]

Eos are YOU a lawyer???

Three years of college level business law, including and specifically concerning e-commerce, contracts, intellectual property and copyright so in this issue I am more qualified than most of you unless you can pony up a 4.0 in similar subjects. Without citing specific examples of actual laws & established precedent to back you up you have nothing but your own feelings and Nexon's TOS.

The Nexon TOS is not a representation of how reality works; a TOS is a company's representation of how they would like reality to work in an ideal to them world. Consumer protection acts in each state and at a federal level exist to control how much they can really enforce in that contract, and make no mistake about it, you're a consumer even if you're consuming a free service and even more clearly so when you're paying for extra features, functionality and accessibility in that free service.

Your analogy was garbage, because it used a friend, not a company. A company that is directly leasing you something has an explicit obligation to warrant it's in working order, to make you aware of any known risks associated with using/operating it, to protect your private information that may be contained in the leased space, to protect any investment of yours being held in the leased space. A hotel is a perfect example; If you leave an expensive watch in a hotel room and it gets stolen they're still liable for it even when they disclaim they're not and even when they try the 'we have a secure safe downstairs you can store valuables in instead of your room' route, because your privacy and security were breached in a manner outside of your control that should not have been outside their control to prevent.

The virtual goods argument is also irrelevant. If a woman can be arrested for deleting her husbands/boyfriends account in a video game the assumption that virtual goods have no legal meaning/value goes right out the window. More to the point; Being a virtual good it's zero harm/effort on behalf of the company to reimburse the loss whereas to the consumer the loss is tangible, removing any claim that restitution causes unreasonable burden to the company or that damage was not incurred by the victim, both of which are important considerations in any suit of this nature.

[Lomelindel]

Hey everyone, an actual lawyer here, albeit not an American one. This is NOT legal advice, just some speculation for my own amusement.

What Eos and some other people have said is correct; just because you put disclaimers in your contract, it doesn't necessarily disclaim you from liability. In fact (at least in Australia) courts are very suspicious of contracts that have incredibly wide disclaimer clauses that try to negate the effects of existing laws. A prime example is the chunk of text that Owl posted from Nexon's TOS that begins with "NEITHER THE COMPANY NOR ANY OF OUR PARENTS, SUBSIDIARIES, AFFILIATES, LICENSORS, SUPPLIERS, ADVERTISERS, SPONSORS OR PARTNERS...". Over here, I'd imagine it would be laughed at then completely disregarded. It probably acts against the interests of Nexon because if they had made a less retardedly wide clause, and instead wrote a more practical disclaimer disclaiming some parties of liability (e.g. certain directors etc), then it would have a better standing. I don't think Nexon's TOS was written by a lawyer, or at least, not a good one.

In relation to whether Nexon should be held liable for hacked accounts, my initial gut feeling is that it’s a negligence matter rather than a contracts matter.

Let’s say that Nexon was hacked and people’s accounts, including the accounts of people who paid real money, were compromised. Was Nexon negligent? I don’t want to get into negligence law, but I imagine that Nexon would say that they already do what is reasonably required of them to secure accounts. They have password system, PIC system, email verification, reminders to players to change their passwords etc. Unless you can prove that what they do is sub-standard compared to other services of similar ilk, then I think they actually have a pretty strong argument that they did not breach their duty of care to players if hackers somehow hacked into their system to steal data. I don’t know what the industry standard is (if there even is a standard) but I think that’s where the crux of the arguments will be.

There are also a host of consumer laws that probably have relevance, though it's probably different in the States. But again, warranties about services etc, comes down to how reasonable any such expectations ought to be.

[Mibs]

I have learned so much reading the last three pages.

[Exidous]

If in fact a wrong password sent to the server returns to the client the right password but encrypted, they're unbelievably negligent regarding account security. I still don't understand why you would ever make a login server do that.

[Olsi]

I've never had such a high level of anxiety since the first time i was hacked.

[MysticHLE]

I've never had such a high level of anxiety since the first time i was hacked.

And this is why it's a "sensitive" topic.

[Raul]

Hey everyone, an actual lawyer here, albeit not an American one. This is NOT legal advice, just some speculation for my own amusement.

What Eos and some other people have said is correct; just because you put disclaimers in your contract, it doesn't necessarily disclaim you from liability. In fact (at least in Australia) courts are very suspicious of contracts that have incredibly wide disclaimer clauses that try to negate the effects of existing laws. A prime example is the chunk of text that Owl posted from Nexon's TOS that begins with "NEITHER THE COMPANY NOR ANY OF OUR PARENTS, SUBSIDIARIES, AFFILIATES, LICENSORS, SUPPLIERS, ADVERTISERS, SPONSORS OR PARTNERS...". Over here, I'd imagine it would be laughed at then completely disregarded. It probably acts against the interests of Nexon because if they had made a less retardedly wide clause, and instead wrote a more practical disclaimer disclaiming some parties of liability (e.g. certain directors etc), then it would have a better standing. I don't think Nexon's TOS was written by a lawyer, or at least, not a good one.

In relation to whether Nexon should be held liable for hacked accounts, my initial gut feeling is that it’s a negligence matter rather than a contracts matter.

Let’s say that Nexon was hacked and people’s accounts, including the accounts of people who paid real money, were compromised. Was Nexon negligent? I don’t want to get into negligence law, but I imagine that Nexon would say that they already do what is reasonably required of them to secure accounts. They have password system, PIC system, email verification, reminders to players to change their passwords etc. Unless you can prove that what they do is sub-standard compared to other services of similar ilk, then I think they actually have a pretty strong argument that they did not breach their duty of care to players if hackers somehow hacked into their system to steal data. I don’t know what the industry standard is (if there even is a standard) but I think that’s where the crux of the arguments will be.

There are also a host of consumer laws that probably have relevance, though it's probably different in the States. But again, warranties about services etc, comes down to how reasonable any such expectations ought to be.

See, the thing is, it's very possible that the login function on the site isn't secure and that it's possible to obtain the encrypted password, and then un-encrypt it.
I assume that is not industry standard.
I feel like that would be considered negligence, as they've created and ignored a gaping security breach that would be fixed very soon (or not allowed to happen in the first place) in other games.

Also, who wants to take Nexon to court for their Terms of Service? If anyone's Australian, melinda can help them (yeah i'm offering her w/out her consent, I'm sure she'll be fine with it).

[Lomelindel]

See, the thing is, it's very possible that the login function on the site isn't secure and that it's possible to obtain the encrypted password, and then un-encrypt it.
I assume that is not industry standard.
I feel like that would be considered negligence, as they've created and ignored a gaping security breach that would be fixed very soon (or not allowed to happen in the first place) in other games.

Also, who wants to take Nexon to court for their Terms of Service? If anyone's Australian, melinda can help them (yeah i'm offering her w/out her consent, I'm sure she'll be fine with it).

My name's Belinda, but you're close! Do we even know for sure what Nexon is doing with their security? If not, all we have are speculations and circumstantial evidence (e.g. relatively negligible number of people report they've been hacked, compared to the number of people who actively play the game).

Rather than going to court (which would cost a buttload and there's no guarantee you'd win or get compensated), the most sensible thing to do is just to complain to your nearest State or Federal regulatory body that oversees and regulates how businesses are run.

[Flonne]

Rather than going to court (which would cost a buttload and there's no guarantee you'd win or get compensated), the most sensible thing to do is just to complain to your nearest State or Federal regulatory body that oversees and regulates how businesses are run.

Sort of related, but, I'm pretty sure Nexon had an F with the BBB for a while, that didn't really change anything long term that I can recall.

The problem here is they won't LET us get proof legitimately, and if we do it by forcibly breaking into their internets, even without a law degree I'm pretty sure that they could use that against us if it was brought up as the evidence in court, LOL.

[Worthyness]

-sigh- This is the reason why I don't like Nexon as a company. They'll never admit there's something wrong. Their PR people either ignore it completely or they simply say: it's your damn fault that this happened. They'll never take the blame for anything. I think the server crashes at one point was just called "server instability" in which they immediately took action that didn't do squat. I mean, if they had at least 1 person in game at all times, they'd be able to see the following:

1. Hacking in basically every other map

2. Mesos sites spamming 24/7 in any channel of the free market or main town

3. Hell I'm sure there's more, but I can't really say anything cause I haven't been online that often.

If they ever appear to take their game seriously, it makes them look stupid because of their actions. This event for example: they recognized the user name availability, but instead of allowing you to change your ID, they thought "hey! Let's have them change their EMAILs instead! It doesn't matter if they can login using their ID OR their email! And then, we can have them keep their User ID, but only allow them to log in via email! That's so smart!" Yeah, too bad that eliminating the use of an ID makes it a pomegranateton easier to hack you if they get your email address. If they get that, your account is as good as gone because LOL you can't log in via your user ID anymore LOLOLOLOL.

I mean really, if you're a company supplying a service, you are obligated to make sure you have a working and safe system for your users. I don't care if it's in your terms of service, things like User IDs SHOULD NOT HAPPEN IN THE FIRST PLACE. You know what I just described? Customer Service. Nexon clearly has none and is basically betting that only 10 year olds play their game and have no brains to use on thinking.

[ShanghaiDizzy]

The Basil list containing hacked users is growing every day. And the majority of them appear to be long term players who know how to maintain account security. What's probably scarier is that there's probably more users out there who have been hacked and unlisted. What's Nexon going to do? Probably this:

[SaptaZapta]

If they ever appear to take their game seriously, it makes them look stupid because of their actions. This event for example: they recognized the user name availability, but instead of allowing you to change your ID, they thought "hey! Let's have them change their EMAILs instead! It doesn't matter if they can login using their ID OR their email! And then, we can have them keep their User ID, but only allow them to log in via email! That's so smart!" Yeah, too bad that eliminating the use of an ID makes it a pomegranateton easier to hack you if they get your email address. If they get that, your account is as good as gone because LOL you can't log in via your user ID anymore LOLOLOLOL.

The really stupid thing is, they know this.
If you log a ticket as they asked, regarding the MTS issue, they will respond with a form letter basically saying, "Disabling your user ID and switching to use only e-mail is a bad idea. But if you really want to do it, add a comment to your ticket."

I added a comment saying, "I know that. That's why I want my ID changed, not disabled." To which I got this lovely response:

Greetings <firstname>,

A GM has requested additional information about your issue, which you may provide by viewing the ticket on the Customer Support website. Please see below for more details.

Thank you for taking the time to submit this ticket. I understand that you would like to be able to modify your account ID entirely instead of disabling your account ID.

Unfortunately, I will be unable to fulfill your request. Please understand though that we are always working on alternate methods that we can offer our players, however the method presented to you in the ticket is the only option that is currently available. If you still wish to proceed with the method presented to you, I will keep this ticket open and request that you set up your security questions and verify that you have access to your email before we can proceed with your account request.

I apologize for any inconvenience. Thank you for understanding.

Sincerely,

GM Cheezpuff
Nexon America, Inc.

Security Tip: Please do not give your password, PIN, or PIC number to anyone for any reason. Nexon representatives will NEVER ask you for your password, PIN, or PIC.

Pineappling incompetents.

[Mibs]

The really stupid thing is, they know this.
If you log a ticket as they asked, regarding the MTS issue, they will respond with a form letter basically saying, "Disabling your user ID and switching to use only e-mail is a bad idea. But if you really want to do it, add a comment to your ticket."

I added a comment saying, "I know that. That's why I want my ID changed, not disabled." To which I got this lovely response:



Pineappling incompetents.

GM Cheezpuff? Seriously?

[jhkplaya888]

wtp??? i haven't even gotten a response yet...i said i want it disabled all i get is every day is a "mts alert" message....fffff maybe i gotta do ANOTHER ticket..