Thread: Preliminary Draft: Petition for change in POL policies    

pretty much what the title says. i wanted to write up a somewhat detailed argument and send it into POL through both a paper letter and an online e-mail. there's some sites that'll let you create a free petition, so once this is fully edited, i'll post it on the the petition site for people to sign up for. for those interested, hopefully we can get enough people to support the change, and hopefully POL will recognize their flaws.



i'd appreciate it if people could read this over and lend any insight or perhaps changes they'd like to see before i finalize it. i was planning on augmenting the first paragraph because what i wrote about the realplayer exploit needs more detail. i realize there's tons of suggestions already out there, but it'd be nice if we could centralize them into here, in case changes or amendments need to be made to this petition.



also, once this was edited i was also planning on trying to organize people, especially the ones who've had their accounts stolen, in trying to call up the POL offices and ask for changes over the phone in unison. i think we all would like to see better safety measures and for us to do that, we do need to band together. as a community, we should all be concerned because this affects us all directly.

it's quite long, but let me know what you think (other than it's long). and the formatting doesn't look like this, it's just copied and pasted from office. thanks.



On approximately December 11th, 2007 an exploit was found using Realplayer software which would submit users visiting certain popular sites to a virus that compromised account security. As a result, in the past several months there have been a number of stolen accounts reported, with a substantial increase in the amount stolen within the past month. Unfortunately, due to Playonline account policies, these players, who are the victims of a security exploit over which they had no control over, have almost zero recourse in taking back their rightful accounts. This petition is a proposal on some changes that we as the players, and in some cases victims, justly deserve.

Problems: The Lack of a Reasonable Process of Account Retrieval
Currently, players have close to zero options when they have their accounts stolen. The only chance these victims have to recover their accounts is to make an inquiry with Playonline Customer Service. However, due to the policies at Playonline, these victims have no plausible way in which to prove valid ownership over the telephone. Playonline policies require information regarding a player’s name, address, and most importantly, credit card information. However, the first actions taken with a compromised account are to change the Playonline password, the address and credit card number. The only information that players can possibly use in their defense are of complete unimportance, specifically the policy requiring current credit card information. Proof of names, past addresses, and financial transactions even dating back for years is made completely irrelevant. We, as players, have zero defense in this regard and are completely vulnerable to fraudulent activity.

Additionally, Playonline policies advise players to contact the local police and internet authorities for help, acknowledging that it is indeed a case of identity theft. However, having to rely on elaborate and sometimes drawn-out legal processes is simply not practical. Without a form of immediate recovery, compromised accounts can have their contents stripped entirely. Hard-earned work and characters, built up over years in many cases, can easily be destroyed within the time it takes to procure a court-ordered subpoena. Moreover, there is no guarantee that the authorities will take the case into decent consideration. While it is indeed a case of identity theft, authorities may (and have) question its validity because it is based on a game. Having to resort to legal processes that take significant time, subjects our accounts to devastation, and submits us as the players to being mocked, is both unreasonable and unfair.

It is also often-times the case that in a request for help, Playonline Customer Service representatives provide an inconsistent and sometimes arbitrary standard upon the players. It is also the case that these same representatives are both obstinate and insulting towards those trying to find help. Rather than being treated respectfully, players are instead accused of using illegal third party-programs and in some instances, accused of selling their accounts to Real Money Traders. The representatives often seem to operate under the notion that their policies insulate them from having to provide service to those who have lost their accounts, especially when they believe that the victims themselves were apart of fraudulent or suspicious activity. Furthermore, requests to speak with a supervising representative are typically met with the response that “they are too busy,” or that “they will provide the same answer as we do.” Follow-up calls from the supervisors, are also completely seemingly out of the question even when they have been arranged and guaranteed by the representatives.

Some players do, however, find help and are able to successfully retrieve their accounts. But this inconsistency with representatives, in that they are either helpful or hurtful, is simply unexplainable. For some players to be able to win their accounts back while others are left victimized and snubbed is, simply put, demoralizing. This inexplicable discrimination as well as the extremes in attitudes from the representatives is completely unacceptable. It seems quite obvious to us that our attempts, in the face of the only people who can possibly help us, are in vain.

Solutions: Rightful Demands for Relief
Though the situation has recently worsened and an increasing number of players are losing their accounts, we feel that there is still a chance to salvage those stolen ones through proper reparations. Additionally, we believe that there are quite reasonable solutions in being able to provide better protection over our accounts.

1. First, we respectfully, but rightfully, demand the fair return of the stolen accounts. The victims have unfairly lost their accounts due to circumstances in which they had no tenable link to. These victims should be able to provide some form of past records in order to prove their legitimate claim and ownership.

2. Second, we respectfully, but rightfully, demand extra methods of protection in overseeing our accounts. As it is now, any unauthorized access to our accounts can permanently abolish any chance of retrieval ever again, because of Playonline’s emphasis on current credit card information. We would like to see changes that allow us to provide prior addresses, credit card information, or some other type of proof over the phone. Having a valid way of identification that is inaccessible by anyone other than ourselves is surely a way to establish more than adequate protection. Not only would the extra authentication allow us to be more secure, but it would highly discourage Real Money Traders from trying to steal and sell accounts as the original owner could take back the stolen account at any time. Extra protection would essentially dissolve any incentives in the buying and selling of accounts.

3. Third, we respectfully, but rightfully, demand efforts from Playonline to ensure that these situations do not occur in the future. Square-Enix has committed itself in trying to eliminate the practices of Real Money Trader activities and has largely been successful. Commitment by Playonline should be parallel as well, as creating methods of obstructing account theft would further deter RMT activities as well as undermine their business.

Implications and Final Thoughts
We, as the players, are not interested in a radical change in Playonline policies. Rather, we are simply looking for a commitment in protecting our accounts, or rather, identities. While on the surface Final Fantasy XI is just a game, to us it is considerably more than that. For many of us FFXI has been a place to meet new people, build communities, and develop lasting friendships. For us, FFXI is a world in which we’re allowed to develop, maintain, and devote ourselves our own individual identities. However, by not giving us a chance to re-establish our rightful characters, and by not providing us with a decent means of protection, we are at the mercy of devious behavior. Moreover, by not allowing us these reparations, Playonline policies only serve further the cause of Real Money Traders, and only encourage them to continue stealing. These policies provide them with an internet marketplace in knowing that once they’ve stolen an account, it will be theirs forever, to use or sell as they wish. By not giving us the necessary change which we are pleading for, we as the players are being deprived of our hard work, characters, and identities.


Kisada of Quetzalcoatl

great

additionally i just wanna say, for people who either just lurk/don't like to post but do in some part agree with it, i'd appreciate it if you posted a response.

if we get more people advocating change, it'll induce others to follow too, and that's really what we need here.

Originally Posted by SathFenrir

The important thing to remember is SE's BBB rating of F and the solemn tradition of "we don't care"ism.

Since then it's gone up to a B.

while i understand the at-large skepticism, really the idea behind this is that we recognize something is inherently wrong. if we do get enough people to support the petition, there's a chance that they may change things, and at the very least they'll recognize that we agree on something in unity. however, if nobody supports the idea then there'll be zero chance.

but that's what petitions are about: showing unity on an issue that you feel needs reform. like many other issues in life, yeah sometimes you disagree with something and it doesn't work at first. but if it garners enough interest and maintains its support, it absolutely has a chance to go somewhere. and if you get loud enough, someone out there will listen and be on our side.

if we do nothing, then nothing will happen for sure.

I will sign up but how? lol >.>

Originally Posted by byte

I've yet to see a petition ever work

One word: Futurama

Easy:

Instead of basing the ownership of the account on what current credit card is on it, base it on the installation codes the account was created with.

Short of breaking into someone's house to steal their manual, there is no way for someone to obtain this information, right?

There is only one problem I can see with this: I'm guessing a lot of people have probably lost their original FFXI installation codes, and I'm not sure how to overcome that - but for those people, they are no better or worse off than right now anyway - if RMT steals their account, they are fucked now, and they would be fucked then.

But other than that, this would combat both the stealing of accounts, and the selling of accounts. There would be no way to steal an account without physically stealing a person's manual, or if the person was stupid enough to store these codes on their PC for some reason, and there would be a severe dissuasion from buying an account since you could never guarantee that the seller wouldn't just keep the codes and take it back.

Should have multiple layers of "proofing".

Eg : person gets hacked. SE then ask the person who called up - "Do you have your registration codes?" - if yes, then the person who called up should heavily be trusted. If not, they should move on to things such as credit card numbers, as well as an IP check, blahblahblah.

When a hacker changes your account, you shouldn't be accused of being a culprit, you should be treated as a Victim. So you gave out your password to a friend? Big fucking deal, however that has nothing to do with your swiped account. If anything, the fact you gave the pass out should help the GM track who got your account and go through with the consequences. The fact that nothing happens to people who hack/scam other accounts is the reason why there's no bad feeling going on with these guys, since they can just go and do it again.

Now imagine if they got caught and punished for their deeds, then much like the RMTs, there'd be much less bullshit and a much more fun game.

just making a personal note here: i think being able to use the registration codes would be one of the more solid ways of increasing account security.

i'm also thinking of possibly just adding an appendix at the end with a list of security suggestions by specific players. if there is a long enough list of actual, reasonable suggestions, they may see that there are enough people who really do care to get this fixed.


and to one of the above posters, the purpose of this thread is to A: comment on possible changes before i finalize the draft there isn't a petition created just yet) and B: to see if there really are enough people who like the idea and WOULD sign a finalized draft. so again, i'd like to encourage people to post here if they support it, even if they don't wish to add any comments.

i know it's reiteration, but the more people we have showing that they do support this, the more interest it'll receive and the more clout it will have. so if you like it, just say so.

Backups of player accounts should be made weekly. In the event an account gets jacked (easily determined by the radically different credit card information that seems to be attatched to each theft), just roll it back. SE seems paranoid about stuff getting duped, but I can't see how this could be worse than the standard
: We're sorry but there's nothing we can do. You're fucked.
we've been getting for the past several years.