Many Pokerstars accounts hacked recently, Stars accepts no liability - Page 13 - Poker News

Why are Pokerstars still providing physical RSA tokens, let alone charging their customers for them?

There are so many software solutions these days, my understanding is that carrying an RSA token is pretty outdated. For other non-poker access I already have an iphone app that when I log into an online service sends me a message via the app that my account is being accessed. I have to open my phone beyond it's passcode locked screen and then verify it's me or decline by tapping a button.

To register my device to be able to authenticate I have to go through a registration process that binds the account verification to my device. So without my phone you can't access my account. Should someone try and access my account I'm notified as soon as it happens, like the very first logon attempt.

It's 2015 Stars, get your **** together already. You can provide this service to your customers if you choose to.

Quote

03-21-2015 , 07:41 AM

#302

Deurdy

Carpal \'Tunnel

Join Date: Dec 2008 Posts: 10,646

Stars giving 2+2 community the finger with that bar chart. It's sad that someone as statistically sound as Josem had to come in here and post it. Very sad.

Quote

03-21-2015 , 10:06 AM

#303

kYndr

banned

Join Date: Nov 2013 Posts: 136

So anyone knows if its possible to get this 48 hour deposit restriction removed?

Quote

03-21-2015 , 11:17 AM

#304

wahoo3

veteran

Join Date: Sep 2008 Posts: 2,805

Quote:

Originally Posted by SweatOnMySkin

they already have this.

https://www.pokerstars.com/poker/roo...smsvalidation/

it isn't as secure as an rsa token, and those sorts of tokens are not outdated at all, though a lot of places have turned them into phone apps that provide you a pin instead of requiring a separate physical device.

and from earlier sgt rj, i wasn't purposefully ignoring their procedures for deposits etc being a potential problem, but honestly earlier itt most people dropped that as an issue. i mean, they've handled things this way for years and it's now a problem when a couple dozen? people get hacked as part of one possible larger incident, and they've stated they handle things this way because a large part of their user base would be inconvenienced if it was made more restrictive, in order to prevent a tiny percentage of hacks. it's not fair to compare them to banks when there are pretty different demands and capabilities on each business.

Quote

03-21-2015 , 11:57 AM

#305

skinroy

journeyman

Join Date: May 2006 Posts: 292

why would u want to try to hack anything other than stars.if u are succesful in gettin any money off the site you are good ,after that there are no reprocusion because stars will help by hiding everything.even the cashout way.if you did thid to any kind of regulated buisness they will at least try to find out what happened and how to stop it.why should stars?if you bother them to much they will just stop responding....so sickining

ps.. what risk do american accounts have of this happening?

Quote

03-21-2015 , 11:57 AM

#306

pissychips

veteran

Join Date: Jul 2012 Posts: 2,029

Quote:

Originally Posted by SweatOnMySkin

That all just sounds very inconvenient and a lot of hassle.

Obviously that level of security is a must have if you've thousands in your accounts but the majority of people don't. Unless I missed it, none of the hacked accounts had more than a few hundred.

I know you said it's for none poker accounts too so would help keep your e-mail and grindr accounts safe but to me it would become tedious having to enter a pin on my phone every time I did anything.

Quote

03-21-2015 , 12:13 PM

#307

ChoakMyDee

old hand

Join Date: Oct 2008 Posts: 1,768

I can't use SMS verification so I wish you guys would stop suggesting that they force people to use it.

This thread is getting annoying with the troll showing up and we're losing sight of what the real issue is IMO. The glaring problem with Stars security is that they allow people to cash out to a different account than normal within minutes of depositing from a different account than normal. This is insane. This is the reason why people are being held responsible for deposits they didn't make. It's because of Stars ridiculous security and TOS. They need to change it pronto. Let's not lose sight of that please.

Quote

03-21-2015 , 01:31 PM

#308

Conan776

Pooh-Bah

Join Date: Jul 2007 Posts: 3,748

Quote:

Originally Posted by PokerStars Michael J

Let us also address some of the other issues raised in this thread:

-In many of the cases claimed in this thread, players have posted emails from PokerStars explaining that there were no failed password guesses. This strongly suggests that the hackers knew the passwords.

Actually, if someone has the hash, and knows the hashing method, there's absolutely no need to use the PokerStars client itself to "brute force" anything. In fact that would be quite dumb since lockouts after a number of failed attempts are standard everywhere. And really, there are only a half dozen turnkey hashing methods out there.

Quote:

-There is no evidence of any misbehaviour by PokerStars insiders in this situation. Because PokerStars passwords are hashed, even if a PokerStars insider were somehow able to gain access to the password database, they would not be able to decrypt a player’s password.

To join the chorus: are they just hashed, or are they hashed and salted?

Because if they aren't also salted, anyone with the hash and the hashing method can just use a rainbow table to crack passwords of 8 characters or less.

Quote

03-21-2015 , 04:09 PM

#309

ftlolft

banned

Join Date: Mar 2015 Posts: 40

I asked Pokerstars to block any cards NOT in my name, as this is STANDARD for any normal company to help its customers be protected against fraud. Not to my surprise this was the response

Hello XXX,
>
> Thank you for your email.
>
> Unfortunately we are not able completely block the option to deposit with card not in your name in a system.
>
> If you would like to block some cards in PokerStars that are not in your name please provide us with the last four digits of cards you wish to block and we will block them.

So Pokerstars does not care to protect its customers against fraud. Can someone go to the press already. How the **** do I block cards that haven;t scammed my account yet you morons. And this is the biggest and "safest " site? Jesus god help anyone with ANY money on here of value to them. They really have no interest cooperating with customers to help protect their accounts saftey

Quote

03-21-2015 , 04:26 PM

#310

pmarrsouth

Pooh-Bah

Join Date: Oct 2007 Posts: 4,123

Quote:

Originally Posted by ftlolft

Perfect, so just email them a list of 10,000 "cards" (last 4 digits 0000-9999) minus the ones that you own that you use on their site - really quick and easy to do on excel.

Not sure why stars angle themselves with a poorly worded email like this

Quote

03-21-2015 , 04:38 PM

#311

ftlolft

banned

Join Date: Mar 2015 Posts: 40

Quote:

Originally Posted by pmarrsouth

I mean I am simply trying to HELP protect myself from being frauded in the future. This is something that should not even have to be asked. It is mandatory to have a name that matches for a large number of business. What is going on here. At worse just flag my account on CC deposits and review. Simple? Nope. Pokerstars clearly has no interest in preventing this scenario. They can have zero legal justification in holding players/customers liable under these circumstances. Especially when I proactively asked. This is just LOL

Quote

03-21-2015 , 04:46 PM

#312

smacc25

veteran

Join Date: Dec 2014 Posts: 2,969

Quote:

Originally Posted by pmarrsouth

+1
i like you're thinking here

Quote

03-21-2015 , 04:47 PM

#313

spoutnic

enthusiast

Join Date: Aug 2010 Posts: 87

I dont know if it has been mentionned, but stars should send emails to when you do something new to confirm its you. And confirm the security breach is comming from the player, not stars. If you can access your stars account, your are a few key strokes, or screen tapping

, away from your email box.

-"Hey, are you having a nice vacation in russia? We would like to confirm its you logging from this new ip address. You will have access to your account minutes after you answer this email. Enjoy your time there, and good luck on the tables!"

It could be a more official template, but you get what I mean

Quote

03-21-2015 , 05:16 PM

#314

Joee

adept

Join Date: Apr 2010 Posts: 848

Quote:

Originally Posted by PokerStars Michael J

Hello,

Sincerely,

Michael Josem
PokerStars Communications Team

LOLOLOLOL.

Can I have irrelevant, misleading statistics for 200, Alex?

Stars (I mean Amaya) has clearly jumped the shark. Sad but true.

Quote

03-21-2015 , 05:22 PM

#315

DirkkDiggler

banned

Join Date: Jul 2013 Posts: 427

i didnt read the full thread, dont know how it ends but

i dont understand and i cant believe the canadian guy at page 2 or 3... everytime i make a deposit, i cannot cashout before 48h (and i only can make a single cashout 24h too) and i put a limit too and if i want to change it, it will take 7 days to activate the new limit.

so i really dont know what happen with theses guys. its not normal and the scam should be from stars inside

now i understand why i got a popup few weeks ago saying to inscrease security with 2 more security questions

Quote

03-21-2015 , 05:24 PM

#316

DirkkDiggler

banned

Join Date: Jul 2013 Posts: 427

Quote:

Originally Posted by madlex

I remember back in the day pre-BF, I cashed out from my PS account a lot when I was travelling and needed cash on my credit card. Stars security always sent me an email asking me to confirm that it's me who is trying to cash out from Vegas or wherever right now.

I wasn't too happy about the process being slowed down by a couple hours at least, but it always made me feel my money was save there.

That said, it's a little hard for me to feel sorry for people who didn't use any of the securty features stars offers.

This morning when I logged into Stars, I got a pop-up that told me about some additional security questions I could use.

not 100% sure, but RSA token cost a lot of FPPs when youre not SN

Quote

03-21-2015 , 05:24 PM

#317

rakemeplz

Carpal \'Tunnel

Join Date: Feb 2006 Posts: 12,648

Grunching from page 3 and I'm clearly quite dumb but it seems nvgish people saying "woah there's been a spate of hacks recently", pokerstars says nope, hacks are down this month and last month too. And nvgish people are like LOL data, LOL SAMPLESIZES, the hacks are out of control!!! How is stars wrong here?

Quote

03-21-2015 , 05:30 PM

#318

ftlolft

banned

Join Date: Mar 2015 Posts: 40

Quote:

Originally Posted by xyzzz

I want to help you from being frauded in the future. Here you go.

Spoiler:

Code:

I feel more secure already

Quote

03-21-2015 , 06:07 PM

#319

ArtyMcFly

Carpal \'Tunnel

Join Date: Dec 2014 Posts: 13,256

Quote:

Originally Posted by ftlolft

If you would like to block some cards in PokerStars that are not in your name please provide us with the last four digits of cards you wish to block and we will block them.

That's so crazy. Stars will allow you to block your own credit cards being used on your account, but does nothing to prevent transactions being made on your account by someone with a different ****ing name!

Quote

03-21-2015 , 06:16 PM

#320

Sect7G

Carpal \'Tunnel

Join Date: Jun 2009 Posts: 11,234

Quote:

Originally Posted by ArtyMcFly

I asked them to block all deposits on my account and they were unable to do that.

Quote

03-21-2015 , 06:24 PM

#321

pmarrsouth

Pooh-Bah

Join Date: Oct 2007 Posts: 4,123

Quote:

Originally Posted by Sect7G

I asked them to block all deposits on my account and they were unable to do that.

what did they reply with when you followed up asking them for just the above, without any additions to it?

Quote:

Originally Posted by Sect7G

In light of this thread I emailed Pstars asking that no deposits be allowed on my account and no withdraws be allowed unless it's a paper cheque and the reply was this isn't possible.
I'm trying to proactively protect myself and I get denied.

Quote:

Originally Posted by pmarrsouth

Getting deposits turned off should be easy enough, just respond asking for the email to be sent to the correct dept

Quote:

Originally Posted by Sect7G

I asked that all deposits not be allowed unless it's confirmed over the phone (I don't deposit ever).

Quote:

Originally Posted by pmarrsouth

Tbf, that is pretty different than what you stated originally. I presume if you emailed them just asking for deposits to be turned off they could do that for you. It's very different to be asking to put a hold on a deposit until someone manually calls you - their cashier dept would grind to a halt if they were to start doing this sort of thing imo

If you want them off then ask for deposits to be turned off. Unsure if they would go one step further and do something like making you wait X weeks (your choice) to turn them back on after you email them should you request them on again

Quote

03-21-2015 , 06:26 PM

#322

mme

old hand

Join Date: May 2009 Posts: 1,668

[x] confirmed chart is meaningful by reproducing it in ms.paint

[x] hashed result for additional security. down another 2%

..now would you guys please stop posting my luggage pin on 2+2

Quote

03-21-2015 , 06:46 PM

#323

ftlolft

banned

Join Date: Mar 2015 Posts: 40

Quote:

Originally Posted by Sect7G

I asked them to block all deposits on my account and they were unable to do that.

They only seem able to remove a credit card from the system. The details on the card are irrelevant aside from last 4 digits. Their " high level of security" has no relevance in regards to credit card deposits. Here is some reading on credit card and fraud protection in general that may be helpful to some. Any lawyers here that can speak to a company that allows stolen cards to make purchases on someones account such as EBAY or AMAZON. Do these companies hold the account holder responsible? Or similar companies where someone can hack an account, maybe switch the account holders address than make purchases and have it delivered to a fake address with a stolen card. The name has to match the the account holders doesn't it? Even SHARKSCOPE forces the information to match

http://www.consumer-action.org/downl...ud_Leaders.pdf

http://www.fcac-acfc.gc.ca/Eng/forCo...-Fraudepa.aspx

Quote

03-21-2015 , 06:52 PM

#324

Rant

old hand

Join Date: Oct 2006 Posts: 1,436

Quote:

Originally Posted by SGT RJ

Nor should withdrawals ever be allowed before the funds have actually cleared.

I originally thought that too but this just leads to chip dumping or joy-riding.

They need to fully lock down suspicious accounts OR, if that's bad for business, THEY need to be on the hook for the fraud, not the player.

At the very, very least there should be a way to switch your account to high security so anything remotely suspicious locks it out.

Quote

03-21-2015 , 06:52 PM

#325

pontylad

banned

Join Date: Sep 2008 Posts: 8,720

Guys, the problem isn't Stars cashout methods or their security measures. The problem is almost solely at the feet of the individual to ensure his account is secured. There are plenty of options available, and it would seem that every account hacked used zero of these features (if i read this correctly).

There are many good reasons why stars would want to provide a cash out process like this for it's customers. Poker is dying anyway, you don't want to put off even more people/fish from playing online poker than already do. There are lots of things stars do that in an ideal/secure world could be better, but the combination of cost and the fact it often creates a barrier for people to play means that they probably have the balance pretty close to optimal for everyone.

Quote

Page 13 of 37

First

3 8 9 10 11 12 13 14 15 16 17 18 23 33

Last

Post Reply Subscribe

...

Page 13 of 37

First

3 8 9 10 11 12 13 14 15 16 17 18 23 33

Last