Guild Wars 2

Our team already made some changes last week that should address your concern. Are you still seeing this issue?

The “Forgot password” button has been temporarily disabled for additional security. If you need your password reset, please contact our support team for assistance (http://en.support.guildwars2.com/). Thank you!

Thanks for not only bringing this to our attention but also taking the time to ensure it had not been corrected yet. This issue has been escalated to our security team for further investigation. Thanks again!

Hi all,

I’d like to clarify our position on this particular question.

First and foremost – there is a rate limiting mechanism in place, which severely impairs the ability of automated attackers to brute-force account logins. We have carefully balanced this mechanism so as not to inconvenience legitimate users, while still presenting a substantial impediment to unauthorized account access.

Second, it is correct that we do not currently lock out accounts for failed login attempts. The reasoning for this is that if an attacker knows your email address, he can basically deny you access to the forums/game indefinitely by just logging in with bogus passwords every few seconds – something trivial to automate. This form of attack would be much more difficult to stop and create a much larger burden on customer support for resolving “locked account” issues.

Last but not least – we take security very seriously and are making every effort to ensure that our game and associated services are as trustworthy and safe as possible. We appreciate your feedback on these issues and welcome further suggestions regarding how to improve our collective safety.

Thanks!

The pause is deliberately short because we don’t want to interfere with people who legitimately need a minute to remember (or correctly type) their password. As I mentioned, we wanted to make sure that it doesn’t inconvenience people. So the rate at which you can “humanly” hit the login page won’t cause issues until you’re doing a substantial number of attempts.

Automated attempts generally have to be done at very high volume to be effective, though, and the rate limiting will hit those attackers much harder than it will ever hit someone who just retypes their password a few times on the login screen.

Obviously I can’t get too specific, but suffice it to say we are monitoring the rate of login attempts from various sources, and we have strong evidence that this system is hampering attackers precisely as we intended.

CAPTCHAs on logins are certainly an option, but creating one that is still human readable while being immune to computer cracking is extremely difficult. Even the best known methods are mostly broken, such as reCAPTCHA (which has an 80% crack rate at this point using a variety of attacks). Since we don’t have any experts to help create a strong CAPTCHA system internally, our general feeling is that we can do other things which have better bang for the buck so to speak.