Poor Security System By PlayerAuctions

I have been had account security problem with PlayerAuctions for a long time (over 1 year).

I tried contacting them via various methods including calling their office in China, contacting their support QQ, and of course livechat, support email and even PM'ed http://www.sythe.org/members/326450-playerauctions.html several times.
They dont give a fuck.
User @PlayerAuctions on this sythe never even bothered to reply a word.

So here I am.

The problems I had/found with PA is that my password was getting stolen every 1-3 months. I do have very strong passwords, 16 digits long generated by sites like https://identitysafe.norton.com/password-generator and no I do not have a keylogger/trojan because none of my other passwords were getting hacked including my 20+ runescape accounts, emails etc etc. To make sure of that, I also formatted my PC a few times.

I think what have caused this is that PlayerAuctions have very poor security system.

1. You have unlimited attempts to enter someone's password without any captcha or waiting time.

2. You get no notifications when someone tries to log in your account.

3. Your account remains logged in after you change your password until your IP changes or after 12:00 or 8:00 I can't remember. This means if a hacker is on my account I have no means to kick him off.

4. This is not really a security problem but a feature they should have. Currently you don't have an option to choose all private message and delete them, instead you need to delete one by one. For sellers that's very inconvenient. I'm not a big seller atm but still gets hundreds if not thousands of private messages monthly.

That's what I can think of right now, and all the above problems I have reported to PlayerAuctions before multiple times and they didn't do anything.



Please post your thoughts, or any other account security problems if you ever had any. Hope this can bring PlayerAuction's attention and they will do something.

 

There's a reason playerauctions is getting less and less popular and more and more hate

 

That's absurd. Most sites would be different lol. Uusually I'm unbiased about many of these things, but this is starting to get a bit ridiculous.

 

In all fairness, Jacob hasn't been online in about a month (that's the guy behind the sythe account). He's been very respectful the times I have seen him reply so HOPEFULLY he responds to this because I agree this is absolute bullshit Tijn and I know they charge sellers an arm and a leg for their "services". I would be very upset too if this happened to me

 

I have been very active on PA for the last 1.5 years and I didint face any security problems yet though I support that deleting private messages one by one is a total BS

 

That's pretty unfortunate TBH. If PA had a strong system for customer support the site overall would be much better, you'd think with their high ass fees they could provide a bit more assistance

 

I pm'ed him several months back and last time I pm'ed him was in July

 

I'm not sure if anyone else had the same problem. Generally speaking, there isn't really a point to hack currency sellers, you can't scam, you can't change your disbursement information, because you would need to confirm via email.

For me it's a bit different because I sell services, account information are given out via private message. Especially for quests, you also give out bank pin. There are some lazy buyers (or they trust me enough) who don't change password for a long time.

I get maybe ~50 orders a month and most of them do change password. Those who don't may have little wealth. It's not a very profitable thing to crack my password unless it's very easy.

 

I feel your pain trying to contact PA about issues but you would probably have more success by telling a brick wall your problems. I simply stopped using PA altogether around 2 years ago due how poorly its ran, cant ever say i ever had account security issues though, however if they truly allow you unlimited password attempts then that's just down right ridiculous but at the same time does not surprise me with PA.

 

Yeah that's pretty absurd. I wouldn't stand for that. Cyber security is a very important thing, if a company like that is not willing to conform and fix their issues, fuck them.

 

that's pretty sad. probably won't fix it since it will cost nice money to get a good company/freelancer to secure their website

 

So you think someone was trying to guess the password?

But yeah PA is pretty shit

 

This would be EASILY fixed by a simple WAF(web application firewall), merely CloudFlare would suffice.

Edit: Just noticed they are on Incapsula, they have WAF available https://www.incapsula.com/website-security/web-application-firewall.html
But the incapsula should filter it regardless, they clearly don't have it set up right.

 

I change my password every 2 weeks or so now and still nervous, very scared of getting hacked again

 

I've had similar reports from a few contacts of mine.

At some point I was unsure whether I should set up my shop on PA or not but news like this made me decide not to join. I remember having extremely bad experience with the support also. Nobody spoke proper English and getting a response took ridiculously long.

Classic 0-fucks-given policy on their behalf it seems. They will consider changes only if their business is in danger of going bust.

 

PA is on a steep decline, that's all I'll say about it.

I cut my losses and got the hell out.

 

I'll never use PlayerAuctions in my life, it's just not reliable.

 

Bump it up.

 

Yeah their customer service is utter shit. Hopefully they get back to you man and solve your problems, they definitely need to invest in better security measures by the sound of it. I didn't know about the password stuff.

 

Hello everyone.

As video explained, I have been away for about a month.

I am back as of late yesterday evening and will be catching up with everyone.

Other managers at PA are aware of this thread and have already prepared some preliminary analysis for me to review, which I will go over with you guys in a more substantive response in a bit.

Jacob