Fix the Sitter Situation

[MeanestBossEver]

Any solution would be better than what we have now. We just had a total mess in my clan because of this absurd security failure.

Here's my suggestion for a relatively small project: start with games. Allow a method for assigned sitters to take turns (including in game chat) using their login & password instead of yours. In addition to closing the security hole, this will allow for tracking and reporting of when a turn or a remark was a made by a sitter rather than the player. Other features can be added later. And players who need/want to give their sitters greater access can share their passwords. For them, it won't be any different.

I've been a paying member of CC for 5 years. I've recruited other people to play and I've been a clan leader. But I'm holding off on renewing my membership. I'd like to see this fixed first. I know my $25 is not much in the overall revenues, but hopefully it makes it clear how seriously I take this.

[Dukasaur]

I think before we get lost in arguments over exactly how much a sitter should be able to do, we can all agree that there should be a sitter function of some kind. Whether it includes game turns only, or games and PMs, or games and PMs and forums, is something that can be tweaked later. First, let's get a basic sitter function enacted, so that sitters log in with their own password and can be accurately tracked.

[watsy]

I think before we get lost in arguments over exactly how much a sitter should be able to do, we can all agree that there should be a sitter function of some kind. Whether it includes game turns only, or games and PMs, or games and PMs and forums, is something that can be tweaked later. First, let's get a basic sitter function enacted, so that sitters log in with their own password and can be accurately tracked.

prefect

[Bruceswar]

I think before we get lost in arguments over exactly how much a sitter should be able to do, we can all agree that there should be a sitter function of some kind. Whether it includes game turns only, or games and PMs, or games and PMs and forums, is something that can be tweaked later. First, let's get a basic sitter function enacted, so that sitters log in with their own password and can be accurately tracked.

Are you sure everybody agrees?

[macbone]

I do.

MeanestBossEver is right on the money. The current system is fraught with security issues, and being able to log in with one's own PW would shore them up. I trust my sitters not to go through my PMs, my private forums, or change my password, but those options still exist.

There's been a great deal of support for a sitter function for years. It's time one was implemented.

[rishaed]

I do.

MeanestBossEver is right on the money. The current system is fraught with security issues, and being able to log in with one's own PW would shore them up. I trust my sitters not to go through my PMs, my private forums, or change my password, but those options still exist.

There's been a great deal of support for a sitter function for years. It's time one was implemented.

+1!

[watsy]

I do.

MeanestBossEver is right on the money. The current system is fraught with security issues, and being able to log in with one's own PW would shore them up. I trust my sitters not to go through my PMs, my private forums, or change my password, but those options still exist.

There's been a great deal of support for a sitter function for years. It's time one was implemented.

+1!

+2

[DoomYoshi]

So one major problem:

Let's say Dukasaur is sitting for me.

If there is a switch for me to turn him on and off, then he can't just sit my turns when I am away from home for an extended time (since I would have to activate him in advance).

If there isn't a switch, and I can just have another player set up as a semi-permanent sitter, than Dukasaur can still decide he hates me and destroy all my games.

Which is basically the current setup. With one exception of things being "tracked". Except we already "track" IP addresses to log in.

So that whole argument falls apart.

---------------------------

Still a great suggestion though, but this is going to be something we have to think about.

[Teflon Kris]

is just sloppy

Yep, describes many things that need fixing.

[MeanestBossEver]

So one major problem:

Let's say Dukasaur is sitting for me.

If there is a switch for me to turn him on and off, then he can't just sit my turns when I am away from home for an extended time (since I would have to activate him in advance).

If there isn't a switch, and I can just have another player set up as a semi-permanent sitter, than Dukasaur can still decide he hates me and destroy all my games.

Which is basically the current setup. With one exception of things being "tracked". Except we already "track" IP addresses to log in.

So that whole argument falls apart.

Still a great suggestion though, but this is going to be something we have to think about.

The worst Dukasaur can do is take a couple of turns for you. You'd probably realize quickly. Under the current model, he could:

1. Make comments as you.
2. Read your messages and send messages as you.
3. Get passwords that other people have sent you (oops...they didn't want to share with him)
4. Friend and foe people.
5. Join games as you .
6. Make ratings as you .
7. Access private forums.
8. Get your email address.
9. Change communication preferences.
10. Change your password.
11. Add and remove people from my clan (for clan leaders).

[rishaed]

^This. And throw an anonymous proxy in there, careful planning, and/or public computers from a local library and the person that you is sitting for you can do just about anything as long as he doesn't log into his account at the same time without repercussions.

[Bruceswar]

The worst Dukasaur can do is take a couple of turns for you. You'd probably realize quickly. Under the current model, he could:

1. Make comments as you. Yawn... If you are worried he will post as you then I feel sorry for you.
2. Read your messages and send messages as you. A good sitter will only do what is needed to help you out while you are away.
3. Get passwords that other people have sent you (oops...they didn't want to share with him)Nobody in their right mind has passwords kept in their inbox. That is just not smart
4. Friend and foe people. One click could solve this. Then again a good sitter would not do that.
5. Join games as you . OMG sauce so you have to play an extra game if he happens to join one. A good sitter would only join the needed tournament games.
6. Make ratings as you . I doubt any sitter has time to rate people. Ratings are worthless anyhow.
7. Access private forums. Pick someone you trust and this is a non issue. Clans usually keep sitters within their own clan.
8. Get your email address. OMG Someone is gonna spam my email box! Whatever should I do! Seriously a non issue.
9. Change communication preferences. Also another non issue. Not gonna happen.
10. Change your password. They could change your password but that would mean you picked a very very bad sitter. Again this has happened maybe a handful of times during CC's whole time.
11. Add and remove people from my clan (for clan leaders). You cannot be serious? Again if you picked a sitter than did that to you, it would be easy to fix and you would have picked a very bad sitter. Just not an issue on CC.

My responses are in red. You are making a mountain out of this. There is really nothing to see about sitting other than a few rare cases of something bad gone wrong and every time it was just a bad apple that someone picked. I have had tons of sitters in my time on CC and not a one of them has ever done something crazy on my account.

[hotfire]

ive never hada problem and never expect a problem cuz i have reliable sitters but i still want this implemented

also they should track who sits for who and when ,everytime a sitter logs in, and store it away somewhere for easy reference in case of abuse situations.. it would be 100X better than the current model

[MeanestBossEver]

Brucewar -- your entire argument boils down to: "I have good sitters and have never had a problem, therefore this isn't an issue." It's like saying you've never been robbed so you don't see why we need locks on doors. It's absurd.

[macbone]

ive never hada problem and never expect a problem cuz i have reliable sitters but i still want this implemented

also they should track who sits for who and when ,everytime a sitter logs in, and store it away somewhere for easy reference in case of abuse situations.. it would be 100X better than the current model

Ideally, a sitter system would do this. If someone takes a turn from the sitter account, the turn would be logged in chat. Perfect accountability.