Old School Runescape

Old School Runescape Dev Tracker




25 Jun

Comment

Originally posted by Ali9666

Live support needs to be added. They didn't even mention it in this post. Also ip tracking would make it trivial to tell if someone is the actual owner.

You are right, but this blog is about account security. Live support is a massive undertaking and a complex process if we are to ensure people are not held waiting in long queues, and we need to consider what type of support can be offered through a live chat system where user verification is challenging. One approach is to look at answer bots that can guide people to help in a 'live' experience, but still offer a traditional contact route to a human support channel if needed. We haven't scoped this yet but it's certainly something we have in mind when considering all support options we might introduce in the future.

Comment

Originally posted by [deleted]

[deleted]

Yes, that would be one element of allowing complex passwords to be set

Comment

Originally posted by G_N_3

Please consider a better version of Jagex Account Guardian, that was amazing tbh.

Thanks for your comment, I recall from the days of JAG that it was actually quite problematic, people forget their answers, typo the answers, use spam answers (jelly1, jelly2 etc.) or set answers that can be easily guessed or obtained through social engineering. At the same time, I also hear people (like yourself) saying it worked well ... as mentioned in the blog we are looking at account security overall so it's good to have that context and feedback and we will explore all options.

Comment

Top tier content! Who'd make up the elite 4?

Comment

Originally posted by Lostasomething

I have a main account however about two years ago my friend logged into it and it was locked and I'm unable to recover it. If I tweet a jmod would that help in recovering the account? I have picture evidence of the multiple names the account used but yeah recovering is quite difficult =(

Unfortunately, tweeting a Jmod won't enable us to verify who you are, and verify that the info you provide is enough to prove you are the owner of the account - you can get info and advice here: https://support.runescape.com/hc/en-gb/articles/206666629-Denied-password-resets

Comment

Originally posted by Lostasomething

I have a main account however about two years ago my friend logged into it and it was locked and I'm unable to recover it. If I tweet a jmod would that help in recovering the account? I have picture evidence of the multiple names the account used but yeah recovering is quite difficult =(

Nope, to recover an account we need to verify you are the owner and we just can't do that over Twitter - when your requests are denied does that happen quite quickly or does it take a while to hear back from us? If you are being denied quickly it means that very little (or none) of the base information you are submitting matches up, if it takes longer it's actually quite good news, it just means you need to improve the info a bit - and we usually let you know the specific areas to improve to strengthen the next request

Comment

Originally posted by DIYRunar

Bank PIN is useful mainly because Jagex never asks for it outside of the game. If a website or email asks for your PIN, you immediately know that it must be a scam. Jagex should emphasize that when setting a PIN because it's a good way of spotting phishing sites.

That's a great point, I'll see if we can build that into our advice/comms. Edit: We've updated the Bank PIN Support Article to include this specif tip, thanks again :)

Comment

Originally posted by BoulderFalcon

With blizzard you legit send proof of your Driver's license/State ID to get into your account. Would this be realistic to implement, at least as an option?

You have to understand some items are billions of gp and take years to earn. When your past 4 years of effort are stolen from you it's heartbreaking. I would gladly risk being unable to play my account for a few days if it meant it were more secure.

Hey Boulder, any system requiring players to send in verification documents is unlikely. For data-handling reasons including data protection (e.g. GDPR compliance), we're leaning away from this sort of thing.

Comment

Originally posted by jirinji

Work with a third-party provider is underway to implement a system which searches the internet for breached password data. That way we can warn you if you’re using a password that might not be safe

Does that mean you're storing passwords in plaintext

We're not storing in plain text. We can't share the details, but all the required security procedures are in place.

Comment

Originally posted by Special_Feeling

πŸ¦€ πŸ¦€ πŸ¦€ THE CRABS ARE GOING EXTINCT πŸ¦€ πŸ¦€ πŸ¦€

Seriously thank you guys for the thought-out post on security. It sounds like Jagex is listening and making big steps in the right direction.

Edit: Downvoted for thanking the mods for giving us what we wanted, wild. I hope you all realize any company will take time to fix things....

Thank you. It is a first step of many steps and we will be keeping you guys and girls informed every step of the way.

Comment

The newest masterpiece.


24 Jun

Post

Let us know which questions you'd like answered on Wednesday's Q&A livestream at 5pm BST!

Questions that provoke discussion are valued over Yes/No questions.

twitch.tv/OldSchoolRS

Thanks!

External link β†’
Comment

Originally posted by BasicFail

There was no update. The last thread was removed not too long after a JMod asked for more details. Honestly, it sounds like we got bamboozled.

For reference:

It turned out to be a phishing lure via Discord, we found no issues with the trade system. Edit: Offenders were permanently banned.

Comment

Congratulations on your wedding, OP, and it's amazing to see what kinds of lifelong friendships can spawn from something as simple as chatting to someone in Clan Chat.

All the best in the future!


22 Jun

Comment

Originally posted by jarjardinksbtw

Need more lemon pledge

I see you.