Godspeed everyone! Follow

Depends on which one you're talking about whether it's the physical keyfob or a smartphone app.

Android: https://play.google.com/store/apps/details?id=com.square_enix_software_token
iPhone: https://itunes.apple.com/us/app/square-enix-software-token/id617970570?mt=8
Physical: http://www.square-enix.com/na/account/otp/

All also listed in a main article on FFXIV official site: http://na.finalfantasyxiv.com/lodestone/news/detail/7360774bfa00f42c1264a0d58b41eaefc2aeef7b

I began reading this thread, wanting to tell OP to try and stick it out on the phone someday. I've read a few different site's forums with people saying they had everything restored fairly quickly (for SE) by talking to them, not trading emails.
And then....I came upon this:



I saw no T&A! Where...?!

So, posting in a thread on it's way to epic status I think...
But I do think the A's in FFXIV are not as excellent as the A's in FFXI. Just my opinion...

You don't need to cheat or buy Gil to be hacked, and I am hoping you don't think your safe without a token if you don't.

On topic, though, it seems someone was able to get their compromised account back. http://www.reddit.com/r/ffxiv/comments/1n45h9/i_got_my_account_back_after_being_comprmised/

Would hate to see you leave...

Edited, Sep 25th 2013 2:36pm by Ryklin

http://arstechnica.com/security/2011/06/rsa-finally-comes-clean-securid-is-compromised/

Some time ago :) Assuming the SE token is from the SecureID product branch of RSA, which I believe they are but I've not got mine in front of me so cannot confirm.

Knowing the algorithm is only half the battle though, they need to capture the target token's seed too. You could forseably perform a sophisticated attack (or a much simpler insider job) to lift the RSA hardware asset register and get the list of seeds assigned to users, apply the known algorithm and know what the number on the target token is.

The chances are that the compromised algorithm is not used on SE's token system, and since it was broken RSA issued new generations that changed this. But then like everything, eventually those too will fall.

Knowing this though, I am quite happy with the level of security it provides my online gaming account!

Go back, play WoW for awhile (not sarcasm), but don't forget about Final Fantasy 14. Maybe when Squeenix gets everything settled down you'll get a better response to your account issues. And Maybe, just maybe, you can come back to us.

In either case, good luck.

There it is. Wint going to bat for the home team. Love it. :)

Thanks for the support guys, I really appreciate it. I've been a part of this community for a while, unlike Anthony who knows absolutely nothing about me, and you guys having my back means a lot to me. Wint, thanks for getting this issue some attention. I'm not the only person who is having this issue, and I won't be the last. If it even slightly improved SE's customer service, I'd be happy whether or not they gave me my account. If I get an email in the next couple weeks, I'll for sure be back, but I've done my part (hours of it) to get it back, and I'm not interested in chasing them down to prove my innocence in such an open/close case (one that favors me).

I seriously do appreciate it. It just goes to show how awesome the ZAM community is and it's the only one I've ever put any time in to and actually paid money to subscribe to. Keep at it guys, I hope you're all having an awesome time. Kick some dragon *** for me!

We all knew Lucia wouldn't and didn't buy gil. We all ran dungeons and instances with Lucia and observed normal progression. Buying gil isn't in Lucia's nature. I am in the belief that the account password was either too weak, or was used elsewhere and compromised there.

Or might be something else.

A common attack on web based accounts is using a technique called session hijacking, whereby the steal the so called "magic cookie" responsible for authentication between the server and the client and use it to gain access to the target system. Hackers aren't stealing your password as such, they're stealing the response your computer generates and sneaking in using it in a form of impersonation. If you've ever logged onto Facebook or GMail to a warning that someone in some remote location has logged onto your account etc, the likelyhood is they've used this method. This is what causes confusion when people have strong passwords/not used anywhere else etc. If you've ticked that box to say "keep me logged in" on whatever, you're far more open to this kind of compromise.

Which leads us down to the recent attacks on XIV accounts- something getting much worse as time goes on judging by the amount of selling tells I get from "legit" player instead of facerolls. XIV uses a form of web-based authentication from what I've seen (granted, I've not looked in detail yet. Maybe I should...) and potentially is susceptable to a session hijacking much like described above.

Could it be we're seeing accounts compromised via methods outside the old trojan horse keylogging methods?

Try again.

Oh, no, OJ did it, but the police rode around with his blood reference sample in their pockets for a few days before submitting it. Those police were later suspected of bias, and the chain of custody was violated.

Can't convict someone when the evidence used to convict could have been tampered with or compromised. It was the reason for the creation of the DNA Advisory Board (DAB) and the Scientific Working Group on DNA Analysis Methods (SWGDAM). These organizations created rules that all agancies have to follow to convince jurors that the results given are based on evidence that was not compromised.

Tying it back in, there is no evidence on Lucia for SE to carry around in its pockets. Apparantly it is a ban first ask questions later response as likely defined in their terms and conditions. Unfortunate, but that is the way it is.

I believe SE already stated that there was a problem with accounts being hacked relating to a third party being compromised. I don't think they ever let out who that third party was. Was always curious if it was Digital River. Would be interested to know if OP bought the game through them.