Some sort of hacking prevention system.

[I_DONT_BOT]

Don't be a smart ass, it could just say an unrecognized ip.

I was just stating that what you said was unrealistic. If it said an unrecognised i.p address, that would be a lot more suitable, and that would be possible to implement.

 

[invocation]

I was just stating that what you said was unrealistic. If it said an unrecognised i.p address, that would be a lot more suitable, and that would be possible to implement.

Alright, sorry if I came across as a little harsh then. I guess you were just trying to clarify.

 

[Buhj]

Found this an interesting discussion so I decided to bump this.

 

[PrayerKid]

No support to this. Hackings happen, and you can only stop it to a point and after that you still can't do anything about it.

Mills are lost, people get hacked. It happens. so no support from me on this.

People just have to be safe when trading

 

[I_DONT_BOT]

No support to this. Hackings happen, and you can only stop it to a point and after that you still can't do anything about it.

Mills are lost, people get hacked. It happens. so no support from me on this.

People just have to be safe when trading

So you support hacking? Looks a bit dodgy for a member of an anti-blackhat community. If we can protect our users from losing money and being that bit more secure, and can't see why we wouldn't want to do that, it's a complete no-brainer.

 

[Detroit]

So you support hacking? Looks a bit dodgy for a member of an anti-blackhat community. If we can protect our users from losing money and being that bit more secure, and can't see why we wouldn't want to do that, it's a complete no-brainer.

Exactly, it´s an easy way to stop hacking.

 

I would love a two-factor auth for OMM/Staff.

We've actually looked in to this in the past. 2-step verification is a difficult system to set up. We have it in place for staff right now, but with the current system we use the price goes up as you add more users. With 300,000+ users, this isn't really a viable option.

There's also the issue of whether or not people have access to/want to link their cell/mobile with Sythe.

An IP-based lockout system would be a pain in the ass for some people. Maybe having them answer a secret question and click a verification link via e-mail when a new IP is detected and then enabling users to create and monitor their own 'whitelist' could be the way to go? I don't know - you tell me!

We currently have 2 systems in place.

The first is called Sythe Verified. This lets users verify a phone number to add a small level of security to their account. The issue with this is that services like Google Voice make it possible for users to provide disposable phone numbers and get verified. This service is not available to users, although the system is implemented and does work. We were planning on charging a $5 verification fee for people to use this service. The idea behind the fee is that people tend not to want to throw away money (for the most part) and to cover our costs for the service. We basically decided not to open this to the public because we didn't think it really added much in terms of verifying accounts and it didn't add any additional security to accounts themselves.

The second system we have is Duo Security. Duo is what Verts mentioned; it's a two-factor system. All admins have to use Duo to log into Sythe.org. So when I try to log in, I have to either accept the login on my phone, enter a code from an SMS, or answer a phone call and confirm the login. The user chooses how they want to authenticate each time they log in. This system works really well and means you need a user's phone to get into their account. An important thing to note with Duo is that it works with BOTH landlines AND mobile phones. With landlines you can only do authentication by phone call though, no SMS or Mobile Push.

The code I wrote to integrate Duo could more than handle every user of the forum. The issue is the cost. Duo is free for up to 10 users which is why we only have admins using it. If you add more users, you pay a fee per user per month. The fee is generally around $3 per user. So, if we had even 1,000 people on it, it could turn into $3,000 per month... This is obviously not a cost we want to cover.

The option we have with Duo is to charge users the $3/month to have their account Duo-enabled. We can certainly do this, but the issue is that a lot of people won't want to pay for it. Although, any respectable market user with decent sales can surely afford the $3/month and would probably take part.

I can discuss opening Duo to others for a fee (maybe $3/mo, maybe a little more) with Sythe and see what he thinks. I would have to do some coding to automate the purchasing/activation/deactivation process but that shouldn't be an issue...

Post your thoughts if you like, I don't know how long it'll take for me to have a proper discussion with Sythe.

 

[Detroit]

We currently have 2 systems in place.

The first is called Sythe Verified. This lets users verify a phone number to add a small level of security to their account. The issue with this is that services like Google Voice make it possible for users to provide disposable phone numbers and get verified. This service is not available to users, although the system is implemented and does work. We were planning on charging a $5 verification fee for people to use this service. The idea behind the fee is that people tend not to want to throw away money (for the most part) and to cover our costs for the service. We basically decided not to open this to the public because we didn't think it really added much in terms of verifying accounts and it didn't add any additional security to accounts themselves.

The second system we have is Duo Security. Duo is what Verts mentioned; it's a two-factor system. All admins have to use Duo to log into Sythe.org. So when I try to log in, I have to either accept the login on my phone, enter a code from an SMS, or answer a phone call and confirm the login. The user chooses how they want to authenticate each time they log in. This system works really well and means you need a user's phone to get into their account. An important thing to note with Duo is that it works with BOTH landlines AND mobile phones. With landlines you can only do authentication by phone call though, no SMS or Mobile Push.

The code I wrote to integrate Duo could more than handle every user of the forum. The issue is the cost. Duo is free for up to 10 users which is why we only have admins using it. If you add more users, you pay a fee per user per month. The fee is generally around $3 per user. So, if we had even 1,000 people on it, it could turn into $3,000 per month... This is obviously not a cost we want to cover.

The option we have with Duo is to charge users the $3/month to have their account Duo-enabled. We can certainly do this, but the issue is that a lot of people won't want to pay for it. Although, any respectable market user with decent sales can surely afford the $3/month and would probably take part.

I can discuss opening Duo to others for a fee (maybe $3/mo, maybe a little more) with Sythe and see what he thinks. I would have to do some coding to automate the purchasing/activation/deactivation process but that shouldn't be an issue...

Post your thoughts if you like, I don't know how long it'll take for me to have a proper discussion with Sythe.

Alright, It doesn't have to be through phone though. It can also be e-mail. The Duo thing is nice and the protection you get from 3$/month is very nice for trusted members. Thank's for the response!

 

[Yenthe666]

@Matthew:

I think the fee is a fair price for people that want it.
If every member could choose it for hisself would be great. I can imagine big sellers that are under more risk to get hacked would be completely fine by paying 3$-10$ a month to prevent this.
Only one scam from a hacker would cost them more than the costs of the service for like two years.

I think this should be implemented, and used by your own choice, under a fair price.
Should prevent big buyers / sellers / high rankeds from a lot of hackers.

 

I'll forward this to Sythe in a PM. Thanks for such an extensive and informative reply, Matthew.