Fix the Sitter Situation

[MeanestBossEver]

Any solution would be better than what we have now. We just had a total mess in my clan because of this absurd security failure.

Here's my suggestion for a relatively small project: start with games. Allow a method for assigned sitters to take turns (including in game chat) using their login & password instead of yours. In addition to closing the security hole, this will allow for tracking and reporting of when a turn or a remark was a made by a sitter rather than the player. Other features can be added later. And players who need/want to give their sitters greater access can share their passwords. For them, it won't be any different.

I've been a paying member of CC for 5 years. I've recruited other people to play and I've been a clan leader. But I'm holding off on renewing my membership. I'd like to see this fixed first. I know my $25 is not much in the overall revenues, but hopefully it makes it clear how seriously I take this.

[Dukasaur]

I think before we get lost in arguments over exactly how much a sitter should be able to do, we can all agree that there should be a sitter function of some kind. Whether it includes game turns only, or games and PMs, or games and PMs and forums, is something that can be tweaked later. First, let's get a basic sitter function enacted, so that sitters log in with their own password and can be accurately tracked.

[watsy]

I think before we get lost in arguments over exactly how much a sitter should be able to do, we can all agree that there should be a sitter function of some kind. Whether it includes game turns only, or games and PMs, or games and PMs and forums, is something that can be tweaked later. First, let's get a basic sitter function enacted, so that sitters log in with their own password and can be accurately tracked.

prefect

[Bruceswar]

I think before we get lost in arguments over exactly how much a sitter should be able to do, we can all agree that there should be a sitter function of some kind. Whether it includes game turns only, or games and PMs, or games and PMs and forums, is something that can be tweaked later. First, let's get a basic sitter function enacted, so that sitters log in with their own password and can be accurately tracked.

Are you sure everybody agrees?

[macbone]

I do.

MeanestBossEver is right on the money. The current system is fraught with security issues, and being able to log in with one's own PW would shore them up. I trust my sitters not to go through my PMs, my private forums, or change my password, but those options still exist.

There's been a great deal of support for a sitter function for years. It's time one was implemented.

[rishaed]

I do.

MeanestBossEver is right on the money. The current system is fraught with security issues, and being able to log in with one's own PW would shore them up. I trust my sitters not to go through my PMs, my private forums, or change my password, but those options still exist.

There's been a great deal of support for a sitter function for years. It's time one was implemented.

+1!

[watsy]

I do.

MeanestBossEver is right on the money. The current system is fraught with security issues, and being able to log in with one's own PW would shore them up. I trust my sitters not to go through my PMs, my private forums, or change my password, but those options still exist.

There's been a great deal of support for a sitter function for years. It's time one was implemented.

+1!

+2

[DoomYoshi]

So one major problem:

Let's say Dukasaur is sitting for me.

If there is a switch for me to turn him on and off, then he can't just sit my turns when I am away from home for an extended time (since I would have to activate him in advance).

If there isn't a switch, and I can just have another player set up as a semi-permanent sitter, than Dukasaur can still decide he hates me and destroy all my games.

Which is basically the current setup. With one exception of things being "tracked". Except we already "track" IP addresses to log in.

So that whole argument falls apart.

---------------------------

Still a great suggestion though, but this is going to be something we have to think about.

[Teflon Kris]

is just sloppy

Yep, describes many things that need fixing.

[MeanestBossEver]

So one major problem:

Let's say Dukasaur is sitting for me.

If there is a switch for me to turn him on and off, then he can't just sit my turns when I am away from home for an extended time (since I would have to activate him in advance).

If there isn't a switch, and I can just have another player set up as a semi-permanent sitter, than Dukasaur can still decide he hates me and destroy all my games.

Which is basically the current setup. With one exception of things being "tracked". Except we already "track" IP addresses to log in.

So that whole argument falls apart.

Still a great suggestion though, but this is going to be something we have to think about.

The worst Dukasaur can do is take a couple of turns for you. You'd probably realize quickly. Under the current model, he could:

1. Make comments as you.
2. Read your messages and send messages as you.
3. Get passwords that other people have sent you (oops...they didn't want to share with him)
4. Friend and foe people.
5. Join games as you .
6. Make ratings as you .
7. Access private forums.
8. Get your email address.
9. Change communication preferences.
10. Change your password.
11. Add and remove people from my clan (for clan leaders).

[rishaed]

^This. And throw an anonymous proxy in there, careful planning, and/or public computers from a local library and the person that you is sitting for you can do just about anything as long as he doesn't log into his account at the same time without repercussions.

[Bruceswar]

The worst Dukasaur can do is take a couple of turns for you. You'd probably realize quickly. Under the current model, he could:

1. Make comments as you. Yawn... If you are worried he will post as you then I feel sorry for you.
2. Read your messages and send messages as you. A good sitter will only do what is needed to help you out while you are away.
3. Get passwords that other people have sent you (oops...they didn't want to share with him)Nobody in their right mind has passwords kept in their inbox. That is just not smart
4. Friend and foe people. One click could solve this. Then again a good sitter would not do that.
5. Join games as you . OMG sauce so you have to play an extra game if he happens to join one. A good sitter would only join the needed tournament games.
6. Make ratings as you . I doubt any sitter has time to rate people. Ratings are worthless anyhow.
7. Access private forums. Pick someone you trust and this is a non issue. Clans usually keep sitters within their own clan.
8. Get your email address. OMG Someone is gonna spam my email box! Whatever should I do! Seriously a non issue.
9. Change communication preferences. Also another non issue. Not gonna happen.
10. Change your password. They could change your password but that would mean you picked a very very bad sitter. Again this has happened maybe a handful of times during CC's whole time.
11. Add and remove people from my clan (for clan leaders). You cannot be serious? Again if you picked a sitter than did that to you, it would be easy to fix and you would have picked a very bad sitter. Just not an issue on CC.

My responses are in red. You are making a mountain out of this. There is really nothing to see about sitting other than a few rare cases of something bad gone wrong and every time it was just a bad apple that someone picked. I have had tons of sitters in my time on CC and not a one of them has ever done something crazy on my account.

[hotfire]

ive never hada problem and never expect a problem cuz i have reliable sitters but i still want this implemented

also they should track who sits for who and when ,everytime a sitter logs in, and store it away somewhere for easy reference in case of abuse situations.. it would be 100X better than the current model

[MeanestBossEver]

Brucewar -- your entire argument boils down to: "I have good sitters and have never had a problem, therefore this isn't an issue." It's like saying you've never been robbed so you don't see why we need locks on doors. It's absurd.

[macbone]

ive never hada problem and never expect a problem cuz i have reliable sitters but i still want this implemented

also they should track who sits for who and when ,everytime a sitter logs in, and store it away somewhere for easy reference in case of abuse situations.. it would be 100X better than the current model

Ideally, a sitter system would do this. If someone takes a turn from the sitter account, the turn would be logged in chat. Perfect accountability.

[Bruceswar]

Brucewar -- your entire argument boils down to: "I have good sitters and have never had a problem, therefore this isn't an issue." It's like saying you've never been robbed so you don't see why we need locks on doors. It's absurd.

And you are saying build a palace in the ghetto.... This is a game. Pick a good sitter and get on with it. Talking about security issues for a game is ridiculous! I mean sure nobody wants to have issues with their account, and sure a sitting feature could be of use, but it will need to be lots of things to lots of people. It is not an easy fix.

As I said... I have only ever seen a handful of cases where some sitter did something bad to the account they were sitting.

[Shannon Apple]

I read some of the linked threads and facepalmed.

Rule number 1. DO NOT BE A MUPPET and use the same friggen password for gaming sites that you use for your email, online banking etc etc. Anyone who does that needs a swift kick in the teeth. People should have learned these things by now. Even if you never shared your pw, a malicious attack on any site could compromise that.

Rule number 2. DO NOT BE A MUPPET and provide an entire list of clan passwords within your clan forums. That's asking for trouble and is downright stupid. Pick one or two people that you trust and give them your password. My clan have many people on Skype and a list of who sits for who (without PW). This way if someone is about to miss, or something happens, there's a greater chance of getting in touch with the sitter.

If someone fucks with your account, they'll get banned from the site.

As for the suggestion:
The simplest way to implement it is to provide secondary security. You log in with your main PW to the game, but there is a second password needed to enter the PM inbox and forums. The other way seems way too difficult to implement lol. That could get annoying, but the security PW could be made optional, so it can be switched on/off.

[macbone]

I've always chosen only the finest, most morally upstanding players of this grand site to serve as my sitters, so I'm not slamming them at all. =)

Shannon's right about security issues. A year and a half ago or so, a former member of O&H guessed a few passwords and jumped from account to account, stealing passwords held in each player's inbox, going from clan forum to clan forum. He even broke into Team CC's forums via accounts.

Sometimes players who rage-quit go into other people's accounts they have passwords for and do crazy things, like start a bunch of 1v1 games and deadbeat them all.

A sitter option would have minimized the breaches in the first case and blocked the second case completely.

Bottom line - don't pick easy-to-guess passwords, and don't store passwords in your inbox.