Another tracking bug report.
Details mailed directly to Ched for review.
Account exploit
Started by Mauk [1494436] on in Bugs & Issues.
About this thread
Posts archived: 7 / 7 posts (100%) · the total is Torn's reply count + the opening post at the last fetch
Counted by TornLife from the archived posts.
- Archived posts
- 7
- Discussion span
- →
- People posting
- 3
- Likes on archived posts
- 5
- Posts by staff, officers and moderators
- 3
- Authority score
- 60 / 100
- Historical score
- 33 / 100
- Story score
- 42 / 100
- Engagement score
- 56 / 100
Most-liked replies
- Chedburn [1] Admin
· 1 likes ·
This fix will be live today and prevents you from creating another session with a different account if a session for a different account already exists. It's not perfect, but it's the closest option available currently. Thanks for bringing this …
Another tracking bug report.
Details mailed directly to Ched for review.
I tested this with Mauk and can confirm!
The team is discussing how to fix, although I'm not sure how quickly a solution can be found (and how important a fix is). Both citywatch & the app have instant login functionality.
Well, would you dislike if I disclosed a working demo for the three login methods? It'd be a lot of fun for us during elimination hours.
I guess answering that question will help you figure out the importance of fixing it.
If you wish, but you'd be breaching the "Account sharing" rule. It'd be a nuisance (until the player doing it got banned), but I'm not sure I see any serious issue here - am I missing something?
Regardless a fix has been added earlier today which solves the majority of the issue and will be live tomorrow.
Sure, once staff are notified you can ban people and revert mugs, wars and elimination lives, so it'd only be a nuisance.
Be a bit creative and you could use it to get sensitive information, though. The demo was blatant, but nothing stopped an attacker from using a more polished (and subtle) implementation for successfully social engineering players (and developers...).
Thanks for issuing a fix either way!
This fix will be live today and prevents you from creating another session with a different account if a session for a different account already exists. It's not perfect, but it's the closest option available currently. Thanks for bringing this to light.