Security issue regarding sid and normal login

skeith_sk8 · 06/20/2017, 10:59

Hi guys,
After a while waiting for BP to fix this i have decided to share this in order to avoid that you guys have troubles while sharing accounts. I hope that after this thread it also gets fixed.

As we all know, when someone enter on our account using password, we get a 99 error in the backpage as the SID changes and if someone enters on our account and goes to the spacemap we get a connection lost error. However, even if the SID is different if you press reconnect you will be able to recover the connection.

In other words, imagine that you share your account using password or sid, it does not matter, with a friend. If your friend does not close the spacemap window he will keep access to the spacemap forever even if the SID changes or you change password or whatever. This can cause a huge variety of issues, such as billions of dishonor == bye bye account, all ammo gone, kill people that shouldn't be killed, say on global chat "i am a bot user", pushing, etc etc.

So be careful guys with who get access to your account, and don't be that confident with SID, as even if it changes the other player can keep connection.

Regards
skeith
PS: You guys can test it just by openning 2 browser. Just connect with browser 1 to the spacemap. Then go browser 2 and enter on spacemap. You will have connection lost on browser 1. Press reconnect and you will recover the connection even if the SID is gone. Sometimes you can get a infinite trying to connect. The other user can just create 5-6 tabs with the spacemap and if 1 get stuck just close and press reconnect in the other one.

linksus · 06/20/2017, 11:14

Thanks for info

～Demetrio～ · 06/20/2017, 20:33

Quote:

Originally Posted by skeith_sk8

Hi guys,
After a while waiting for BP to fix this i have decided to share this in order to avoid that you guys have troubles while sharing accounts. I hope that after this thread it also gets fixed.

As we....

This is a know bug ! sometimes it doesn't connect to spacemap sometimes it does after a user login into the account!

But anyway, BP don't care the players! Even if there are hacked users BP will be happy to earn money from them! [no bot users].

skeith_sk8 · 06/20/2017, 20:53

Quote:

Originally Posted by ～Demetrio～

This is a know bug ! sometimes it doesn't connect to spacemap sometimes it does after a user login into the account!

But anyway, BP don't care the players! Even if there are hacked users BP will be happy to earn money from them! [no bot users].

It always connect actually (unless the screen gets bugged)

shiroe98 · 06/20/2017, 21:52

thx

~~Sydno~~ · 06/20/2017, 22:04

First of all say thanks because they remove sid from game page url

)

somalia_ · 06/21/2017, 15:34

I thought that was a feature rather than a bug.. That's too bad. :/

:thonking: · 06/21/2017, 23:52

This was an actual method how I saved my account about 4 years ago when the account hacking was easy(?). I could keep the account online at spacemap and it was always a mark that if my ship was moving, I knew someone was on my account. So fast login to backpage and changing the password and all was good.

However nowadays it's:

1. Impossible(?) to get into your account without knowing the username and password or sid (point: unable(?) to crack).
2. Even if it happens, the infinite connection bug might **** up your chances to save your account.

Just don't know should I laugh or cry, maybe just be neutral as the game sucks and idc if someone steals my acc. xD

skeith_sk8 · 04/17/2018, 12:01

As a little update on this thread i can say that they finally patched this issue (partially). Since some days/weeks you can only keep the connection till the next server restart. After that, the client windows will not longer provide you the access to the account.

grimreaper13 · 04/18/2018, 15:10

so there is possibility to connect to an account with only SID?

PNTX · 04/18/2018, 23:19

Quote:

Originally Posted by grimreaper13

so there is possibility to connect to an account with only SID?

there is. and always was.

grimreaper13 · 04/19/2018, 00:32

Quote:

Originally Posted by PNTX

there is. and always was.

how is that even possible? :O

skeith_sk8 · 04/19/2018, 07:35

Quote:

Originally Posted by grimreaper13

how is that even possible? :O

manulaiko3.0 · 04/19/2018, 17:45

Quote:

Originally Posted by grimreaper13

how is that even possible? :O

The Session ID is a unique 32char hex identifier that is randomly generated with each login. It's not any kind of security vulnerability, in fact is used everywhere you can login, it's just how the internet works.