So disappointed of suport of GGG

"

Sarno#0493 wrote:

"

bloomhead#3858 wrote:

You can't even follow a discussion. No further comments needed.

You're the one who was responding to my link and my thoughts on why it was relevant.

I don't need to "follow" my own point - I understand it; I am the one making it.

---

1. How the Person Got Access in the First Place

The person gained access to GGG's system by talking their way past Steam Support.


2. How 2FA Would Have Prevented Access to GGG's Systems

Now, if GGG 1) had 2FA support, and, 2) implemented it properly, and, 3) mandated its use for all staff accounts then the data breach would never have occurred - even after Steam approved the sign in attempt, GGG's authentication server could have still forcibly demanded a 2FA code. You have said 2FA doesn't help if they already have access to GGG's "system", while seemingly not understanding that the primary goal of supporting 2FA is preventing such access in the first place.


3. You Are Wrong To Dismiss the Data Breach

In GGG's post which I have now quoted for your benefit multiple times, they vaguely disclosed that account information had been accessed for "a significant number of accounts". If you look at the categories of information accessed, it is exactly what Support asks for when dealing with "please help, I've lost access to my email account and can't sign in"-style requests. It is the very information used by Support to validate account ownership, at which point they help someone access the account. That information having been leaked is, consequently, a disaster.

Because of this breach there will be new account compromises continuing years into the future.


4. You Are Wrong About 2FA Not Being Effective

If someone who previously had access to GGG's customer service portal downloaded the account information belonging to "a significant number of accounts" (their words!) tried leveraging that information to brute-force their way into accounts they now have the email addresses for, 2FA being enabled for those accounts would make this an order of magnitude more challenging.

At that point, it would essentially render such attacks non-feasible for most of all non-state actors. Potentially even state actors, if we hypothetically assume that GGG's approach to security is significantly more impressive than would appear to be the case.

---

I have no idea why you have spent multiple consecutive posts ranting about the number 66. This breach has almost certainly already resulted in a four-digit number of accounts being successfully accessed by unauthorised third-parties. This will, sadly, continue for years into the future.

"

bloomhead#3858 wrote:

1. How the Person Got Access
Yes, they social-engineered Steam Support — which means the attack vector was Steam's verification process, not GGG's authentication system. 2FA on GGG staff accounts wouldn't have changed the outcome if the attacker was operating through a legitimately approved Steam session. You're conflating two separate authentication layers.

"

bloomhead#3858 wrote:

2. Your 2FA Argument Has Three Big "Ifs"
You literally listed them yourself: GGG would have needed to 1) support 2FA, 2) implement it properly, and 3) mandate it. That's not an argument that 2FA would have prevented this — that's an argument that a completely different security infrastructure might have. You're critiquing a hypothetical GGG, not the actual breach.

"

bloomhead#3858 wrote:

3. The Breach Severity
"A significant number of accounts" is vague by design — companies write breach disclosures with legal teams present. Treating that phrasing as confirmation of your four-digit unauthorized access claim is speculation, not analysis.

"

bloomhead#3858 wrote:

4. 2FA Effectiveness Post-Breach
Here you've actually shifted your own argument. You started by saying 2FA would have prevented the breach, now you're saying it would make follow-on attacks harder. Those are different claims. The number fixation comment is a deflection. Stay on the actual points.

"

xx_PsYcHol_xx#7415 wrote:

Hello,
I have been a player of POE2 since the very beginning and have already spent over 2000 hours in the game. I’ve dedicated a huge amount of time to it.
Two days ago, my account was hacked and I was robbed of everything. All my items worth several mirrors are gone — I have nothing left. I lost around 30 mirrors in total. All 15 of my characters have been completely stripped.
I would like to point out what I received from GGG:
A big “f...off.” Nothing more.
I hope others will also realize that they don’t care about us — only about making money.

"

Sarno#0493 wrote:

"

bloomhead#3858 wrote:

1. How the Person Got Access
Yes, they social-engineered Steam Support — which means the attack vector was Steam's verification process, not GGG's authentication system. 2FA on GGG staff accounts wouldn't have changed the outcome if the attacker was operating through a legitimately approved Steam session. You're conflating two separate authentication layers.

I am conflating nothing.

You can implement 2FA such that a user will be prompted for a code upon being redirected by an OAuth provider. While it is certainly possible to implement such logic exclusively as part of the standard email & password sign in process, that is a decision - and a poor one, at that.

"

bloomhead#3858 wrote:

2. Your 2FA Argument Has Three Big "Ifs"
You literally listed them yourself: GGG would have needed to 1) support 2FA, 2) implement it properly, and 3) mandate it. That's not an argument that 2FA would have prevented this — that's an argument that a completely different security infrastructure might have. You're critiquing a hypothetical GGG, not the actual breach.

For someone who has repeatedly critiqued my ability to follow a discussion, you are notably all over the map yourself.

My only point the entire time has been that 2FA would improve account security, and that the breach is a good argument as to why. If you are now conceding that 2FA support would have prevented the breach, then we now agree with one another - even if you aren't quite across that.

"

bloomhead#3858 wrote:

3. The Breach Severity
"A significant number of accounts" is vague by design — companies write breach disclosures with legal teams present. Treating that phrasing as confirmation of your four-digit unauthorized access claim is speculation, not analysis.

If a legal team were present - and I must say, I do hesitate to accept your speculation that one was - they would have almost certainly argued in favour of either "a number", or, "a large number".

It is completely valid to observe what GGG chose to acknowledge in their post.

"

bloomhead#3858 wrote:

4. 2FA Effectiveness Post-Breach
Here you've actually shifted your own argument. You started by saying 2FA would have prevented the breach, now you're saying it would make follow-on attacks harder. Those are different claims. The number fixation comment is a deflection. Stay on the actual points.

Thanks for attempting to define my argument for me.

I am arguing more broadly that 2FA support being released by GGG would improve PoE account security. There is nothing incorrect about noting multiple examples as to how it would have changd things. While I understand you might dislike seeing multiple examples as to how you had been wrong, I won't be narrowing my points just to make you feel better.

"

AbyssianOne#1625 wrote:

That's a childish notion. If you're running a business you're not going to do well if you keep robbing your own customers. The drug dealer who cuts his product too much or otherwise steals his customers money isn't going to have customers for long.