• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

Diablo III |OT3| Turn On Elective Mode, Get an Authenticator

Status
Not open for further replies.

Mitama

Member
I know enough about internet culture to know that people typing rumors on message boards is completely and utterly meaningless. What Yanger said is correct, if public sessions could be lifted like that, someone would have posted actual incontrovertible proof by now, simply by doing it repeatedly and demonstrably. Hackers don't have some secret magic inaccessible to regular IT guys.

Oh I know it could've been proven. People can still get the information from the packets and not be able to actually use that to perform some sort of attack though. Also, these kind of exploits are mostly kept private since they can be very lucrative.. If someone does manage to exploit it, do you think they'll white knight it for one day of glory or keep it in the dark? Pretty extreme example of course but stuff like this does not surface very often.

Same with dupes. Sure people can do it but why prove it when there's so much money involved? Why would you go out of your way to create a Youtube video and show how it's done when you can easily make a load of cash?
 

mrbagdt

Member
True.



You're right, they couldn't have gotten his session id that way. He could have just been keylogged then which would explain a random password being guessed. I still think there's an attack that allows you to use something from the packets that are transmitted when you are in a game with other players though. Else people on clean installs would never have their accounts compromised.

i have been keylogged to steal... my password to diablo 3? i use this computer for everything, my banking, amazon, facebook, steam, everything. and when it came time for something to get stolen, they went after my password for diablo 3. after years and years of doing pretty much everything online i have NEVER had a problem with anything identify-theft related. and yet, without even being installed for a week on my pc, i have been 'hacked' because i used a 'stupid email password combo that had been used somewhere else'. im sorry, but it is simply not true.

obviously, i cannot prove any of this to any of you and everyone is free to say that 'blizzard is secure' and 'you must have done something stupid and that is why you got hacked'. i am just extremely disappointed that nothing has been said by blizzard admitting any sort of wrong has occurred.

i think talk about spoofing and sessions getting stolen or whatever is all conjecture at this point. all we can really do is speculate on the whole thing, and i dont really want to feed into that discussion. all i wanted to share was that i WAS hacked, my password was a random mess of numbers that i have written down on a notepad by my pc that is used nowhere else in my internet life. i just wish that blizzard would admit that something is going on.

my wife has a smartphone that can download apps, so i got the authenticator on that now. i havent logged on yet so i dont even know how it works, but i guess if it keeps this from ever happening again that is great. i just wish it had been made a requirement by now if this 'hacking' is obviously not just people being dumb with their email/password combos.
 
Oh I know it could've been proven. People can still get the information from the packets and not be able to actually use that to perform some sort of attack though. Also, these kind of exploits are mostly kept private since they can be very lucrative.. If someone does manage to exploit it, do you think they'll white knight it for one day of glory or keep it in the dark? Pretty extreme example of course but stuff like this does not surface very often.

Same with dupes. Sure people can do it but why prove it when there's so much money involved? Why would you go out of your way to create a Youtube video and show how it's done when you can easily make a load of cash?
People DID prove it with dupes. Some of my friends- who aren't hackers in the slightest- were able to show me personally how to dupe items in D2 with programs they got online.

Same thing with bots, hit up google, the info is public because it is real.
 

Mitama

Member
People DID prove it with dupes. Some of my friends- who aren't hackers in the slightest- were able to show me personally how to dupe items in D2 with programs they got online.

Same thing with bots, hit up google, the info is public because it is real.

Early dupes that were made public sure, but not after the bans and the private dupe methods. I strongly doubt that.

Also, bots are a far cry from dupes.
 

zlatko

Banned
Jesus Christ cant even post funny boss kill videos anymore without people taking it as some sort of personal attack or a statement or some shit and getting all defensive. GTFO for crying out loud. I suppose that means we are out of the 'New game' honeymoon phase and well into the tears and bitterness area already. Its been a few weeks so I guess I shouldnt be surprised.

untitled-2nyjrc.gif
 

balddemon

Banned
Jesus Christ cant even post funny boss kill videos anymore without people taking it as some sort of personal attack or a statement or some shit and getting all defensive. GTFO for crying out loud. I suppose that means we are out of the 'New game' honeymoon phase and well into the tears and bitterness area already. Its been a few weeks so I guess I shouldnt be surprised.
Huh?
 

Yoshichan

And they made him a Lord of Cinder. Not for virtue, but for might. Such is a lord, I suppose. But here I ask. Do we have a sodding chance?
Sorry guys I haven't been on Mumble. Been very busy today. Zero D3.
 
i have been keylogged to steal... my password to diablo 3? i use this computer for everything, my banking, amazon, facebook, steam, everything. and when it came time for something to get stolen, they went after my password for diablo 3. after years and years of doing pretty much everything online i have NEVER had a problem with anything identify-theft related. and yet, without even being installed for a week on my pc, i have been 'hacked' because i used a 'stupid email password combo that had been used somewhere else'. im sorry, but it is simply not true..

Well, have you used the same password anywhere else? If so, it is a far, far more likely scenario than i think you realize.

First of all, a string of random numbers is about as terrible as it gets password wise, and your password is trivially cracked by a rainbow table. Honestly if youve used this password anywhere else there is about 90% probability that some hacker somewhere has your email and password. Like it or not, this is reality
 

LordCanti

Member
Anyone in NA have the closest WP to Azmodan in Inferno that they'd be willing to share? I'm confident in my ability to solo kite him into oblivion, but going through the never ending towers of hell again is a non-starter (chest runs are better loot than what I'm seeing people pull off of act bosses anyway).

I just want the achievement for some reason.
 
If Blizzard's security and databases had truly been compromised they would be legally required to disclose it and go through all the stuff Sony did when they got hacked. They can't just cover it up or they would face enormous legal and commercial ramifications.

The reason people focus on video game accounts is because of how quick and easy it is to make money off it. It's very easy to send off the gold/items to another character in just a few minutes. And the risk involved in doing so is much smaller than hacking someone's bank account and trying to steal money that way. There are lots of protections in place to impede that kind of activity post hack, so companies very quickly notice, lock-down, and secure accounts after they are compromised.

It's all about the likelihood you can extract actual money from the hack. By the time Blizzard knows you're hacked, all the stuff is long gone. But your bank is actively monitoring all your transactions for suspicious activity, fraud, etc. Transactions don't go all the way through immediately either, they can be reversed and they're insured even if they do go through so both the bank and you can recoup your losses, etc.
 

pigeon

Banned
i have been keylogged to steal... my password to diablo 3? i use this computer for everything, my banking, amazon, facebook, steam, everything. and when it came time for something to get stolen, they went after my password for diablo 3.

People keep posting this. I know it's counterintuitive, but here's the deal from my perspective:

18 USC 1028 (b) said:
The punishment for [identity theft] is...a fine under this title or imprisonment for not more than 15 years, or both, if...as a result of the offense, any individual committing the offense obtains anything of value aggregating $1,000 or more during any 1-year period.

Robbing a bank account is bank fraud. The Secret Service's entire job is to investigate bank fraud (aside from that whole protecting the president's life thing). Outside of America, Interpol has similar tasking. Stealing items from a character in a video game isn't a crime at all. You might get less payoff per hack (although there are a lot more countermeasures to make bank fraud less profitable than there are countermeasures to make selling items in Diablo less profitable), but nobody is going to break your door down. Why would you do things the hard way?

The authenticator adds an extra step after the initial login process. I think this attack allows you to use sniffed session credentials to pass the first step but then you are stuck because you don't have the authenticator. This might be the reason why there's been no reports of people with an authenticator getting hacked so far (at least from what I can tell).

Blizzard's server architecture involves a login server that does all of the authentication, then hands you off to a shard to actually play the game. That's why the login server can go down (error 37) but people actually playing aren't affected at all. If there were a way to hopscotch the password authentication using a session ID, it would presumably do so by skipping the login server -- that means it would skip the authenticator as well.
 

Tom Penny

Member
Good job Blizzard. Melee is worthless starting act 2 inferno. I don't recall a game going from pretty easy to near impossible after one level. Absolutely ridiculous.
 

TheYanger

Member
I'm almost positive this isn't true; I can craft a 6 affix two-handed axe but haven't gotten to Act 4 Inferno yet. Do we have any real confirmation that Act 3 gear isn't as good?

But regardless, I'm talking about how things will be after the economy has had a long time to develop. This time next year, a much higher percentage of active accounts will be able to farm Act 3 Inferno, at least.

He's wrong. A3 and A4 have the same level mobs, and the exact same loot tables. (maybe different drop ratios but very much the same quality items)
 

mrbagdt

Member
If Blizzard's security and databases had truly been compromised they would be legally required to disclose it and go through all the stuff Sony did when they got hacked. They can't just cover it up or they would face enormous legal and commercial ramifications.

The reason people focus on video game accounts is because of how quick and easy it is to make money off it. It's very easy to send off the gold/items to another character in just a few minutes. And the risk involved in doing so is much smaller than hacking someone's bank account and trying to steal money that way. There are lots of protections in place to impede that kind of activity post hack, so companies very quickly notice, lock-down, and secure accounts after they are compromised.

It's all about the likelihood you can extract actual money from the hack. By the time Blizzard knows you're hacked, all the stuff is long gone. But your bank is actively monitoring all your transactions for suspicious activity, fraud, etc. Transactions don't go all the way through immediately either, they can be reversed and they're insured even if they do go through so both the bank and you can recoup your losses, etc.

i think that they are stealing items from your characters, but somehow they are not getting your login information. if it was login info, i believe that blizzard would HAVE to say something. if it just stealing items and gold from inside the game, maybe they dont think it is that big of a deal and they are struggling to figure out how to rectify it.

again, people can believe what they want, but im being completely honest when i say that my login info has not been used anywhere else and as far as i can tell nothing else in my online identity has been messed with.

like pigeon said, there is nothing really criminal being done here. it is just really really annoying. if the authenticator is the only true way to keep your account safe, it should be required, not an added layer of protection.
 

Zzoram

Member
Good job Blizzard. Melee is worthless starting act 2 inferno. I don't recall a game going from pretty easy to near impossible after one level. Absolutely ridiculous.

Are you geared up for defense? Melee characters need to gear for survivability in Inferno, not as much for DPS. Get a lot of + all resist gear and more + vitality gear.
 
I somehow made it to Belial as a DH with 20K raw damage. I'm not even thinking about taking him on because I'll get my ass waxed by those snake guys.

Anyone doing Siegebreaker runs? I'm in dire need of gold/gear
 

Tom Penny

Member
Are you geared up for defense? Melee characters need to gear for survivability in Inferno, not as much for DPS. Get a lot of + all resist gear and more + vitality gear.

I'd rather reroll. It's ridiculous. It's totally unbalanced in comparison to Wizard and Demon Hunter.
 

LegoDad

Member
Are you geared up for defense? Melee characters need to gear for survivability in Inferno, not as much for DPS. Get a lot of + all resist gear and more + vitality gear.

Check my stats above.... I'm a barb, and have geared up and still can't do anything.. Still die in 4-5 hits, if that..
 
Check my stats above.... I'm a barb, and have geared up and still can't do anything.. Still die in 4-5 hits, if that..

Another 100 resist all and 1k dps wouldnt hurt, but you shouldnt be dying on trash packs.

Is your follower geared? If you get your follower to ~4k dps it makes a huge difference.

What runes are you using?

Edit: those resist numbers, are they buffed or unbuffed?
 

LegoDad

Member
Another 100 resist all and 1k dps wouldnt hurt, but you shouldnt be dying on trash packs.

Is your follower geared? If you get your follower to ~4k dps it makes a huge difference.

What runes are you using?

Edit: those resist numbers, are they buffed or unbuffed?

Using Revenge?

Those resists are unbuffed... using: sidearm, provocation, impunity, Ignorance is Bliss, The Mountain's Call, Nerves of Steel, Superstition , Tough as Nails.

Revenge only helps so much, especially while getting attacked close and getting hit by those damn bee shots.. I just die to quick... I shouldn't die so quick with that much resistance... I just run through Act 1..

I was playing around with Leap (Iron Impact) for the extra 300% armor for 4 seconds.. and it revamps in 10-12 secs... Was also playing with Ground Stomp (Deafening Crash) for stunning enemies 3 secs after 4 sec stun...
 

Zzoram

Member
Those resists are unbuffed... using: sidearm, provocation, impunity, Ignorance is Bliss, The Mountain's Call, Nerves of Steel, Superstition , Tough as Nails.

Revenge only helps so much, especially while getting attacked close and getting hit by those damn bee shots.. I just die to quick... I shouldn't die so quick with that much resistance... I just run through Act 1..

I was playing around with Leap (Iron Impact) for the extra 300% armor for 4 seconds.. and it revamps in 10-12 secs... Was also playing with Ground Stomp (Deafening Crash) for stunning enemies 3 secs after 4 sec stun...

Keep experimenting with skill combos and different timings for usage. I think they want us to readjust our skills depending on the mob in Inferno.
 
i think that they are stealing items from your characters, but somehow they are not getting your login information. if it was login info, i believe that blizzard would HAVE to say something. if it just stealing items and gold from inside the game, maybe they dont think it is that big of a deal and they are struggling to figure out how to rectify it.

again, people can believe what they want, but im being completely honest when i say that my login info has not been used anywhere else and as far as i can tell nothing else in my online identity has been messed with.

like pigeon said, there is nothing really criminal being done here. it is just really really annoying. if the authenticator is the only true way to keep your account safe, it should be required, not an added layer of protection.

The point pigeon was actually making was that even if they had information to all of your different accounts, it would still be reasonable for them to only go after your video game accounts because the success rate and difficulty of doing so is so much better than going after your real money. And if they get caught, there's a much smaller punishment (if at all) compared to bank account stuff.

And how exactly are the hackers supposed to get into your account without the login information? The whole id session spoof thing was a fabricated rationalization that has been disproven. And as pigeon has stated, even if the session spoof was possible, it would mean they could skip the authentication step. And yet there are no accounts with authenticators being hacked, meaning that the spoof does not exist.

Is it more likely that Diablo 3 has some super magical exploit that gets around the login servers or that the people who get hacked just want some kind of external validation that the blame doesn't lie on themselves? To what degree Blizzard defends you against brute-force attacks though, I don't know. So there may be a gripe there if such a vulnerability exists, but I highly doubt it.
 
Those resists are unbuffed... using: sidearm, provocation, impunity, Ignorance is Bliss, The Mountain's Call, Nerves of Steel, Superstition , Tough as Nails.

Revenge only helps so much, especially while getting attacked close and getting hit by those damn bee shots.. I just die to quick... I shouldn't die so quick with that much resistance... I just run through Act 1..

I was playing around with Leap (Iron Impact) for the extra 300% armor for 4 seconds.. and it revamps in 10-12 secs... Was also playing with Ground Stomp (Deafening Crash) for stunning enemies 3 secs after 4 sec stun...

You want insanity with WotB.

Also try Wrenching Smash with Ground Stomp.

Leap iron armor is great

The bees will kill you fast no matter what. Try not to get hit. Also make sure warcry is always up
 

mrbagdt

Member
or that the people who get hacked just want some kind of external validation so that the blame doesn't lie on themselves?
thats what i thought all along until it happened to me. but whatever, im just another one of the masses, i cant prove anything to you or to blizzard. ill go back to lurking now.
 

TheYanger

Member
Those resists are unbuffed... using: sidearm, provocation, impunity, Ignorance is Bliss, The Mountain's Call, Nerves of Steel, Superstition , Tough as Nails.

Revenge only helps so much, especially while getting attacked close and getting hit by those damn bee shots.. I just die to quick... I shouldn't die so quick with that much resistance... I just run through Act 1..

I was playing around with Leap (Iron Impact) for the extra 300% armor for 4 seconds.. and it revamps in 10-12 secs... Was also playing with Ground Stomp (Deafening Crash) for stunning enemies 3 secs after 4 sec stun...

You can't get wrecked by those bees. That's your issue, they HURT but they're super slow.
 

TheExodu5

Banned
I can't believe these were on the AH for over an hour without selling. Snagged these for a measly 500K:

stalwarttraps.png


Not the highest stats, but altogether still worth a fair bit more than that. Should be a nice cheap set for my WD.
 

rCIZZLE

Member
So what's the secret for getting 70k+ DPS on a DH? I have 15IAS on both rings, 13 on quiver, 13 on bow with 863 dps, and 1300+ total dex from equipment for a grand total of 24k dps. Does everybody with 50k+ have a 1200 or 1300 bow with IAS?
 

Mitama

Member
So what's the secret for getting 70k+ DPS on a DH? I have 15IAS on both rings, 13 on quiver, 13 on bow with 863 dps, and 1300+ total dex from equipment for a grand total of 24k dps. Does everybody with 50k+ have a 1200 or 1300 bow with IAS?

You don't use sharpshooter?
 

DTKT

Member
So what's the secret for getting 70k+ DPS on a DH? I have 15IAS on both rings, 13 on quiver, 13 on bow with 863 dps, and 1300+ total dex from equipment for a grand total of 24k dps. Does everybody with 50k+ have a 1200 or 1300 bow with IAS?

The really high DPS numbers are from Sharpshooter with a +% Critical Damage.
 

Neki

Member
So what's the secret for getting 70k+ DPS on a DH? I have 15IAS on both rings, 13 on quiver, 13 on bow with 863 dps, and 1300+ total dex from equipment for a grand total of 24k dps. Does everybody with 50k+ have a 1200 or 1300 bow with IAS?

863 bow is your problem. I run 62k dps without sharpshooter on a 1260 dps crossbow. You need a good weapon if you want high dps.
 

Mitama

Member
Been using tact adv, steady aim, and archery. Didn't seem like, at least from the description, that sharpshooter was all that great.

Thing about sharpshooter is that most demon hunters show their DPS with sharpshooter on (and 100% crit chance). If you combine that with a 2H xbow, which gets +50% crit dmg from archery, and +crit dmg on your gear, you get hugely inflated numbers because the game calculates the damage for your next shot with the current 100% crit chance. You can go for a high crit chance and fast attack speed to more easily hit those huge crits though.
 

Shadow780

Member
What's the highest bow/xbow dps range I can get from farming Butcher/Warden before tacking on Act 2?

I feel like my all resist is as high as it can go but haven't gotten a decent weapon upgrade yet.
 
Status
Not open for further replies.
Top Bottom