The way BMG takes care of accounts (with all respect)

[Milkshake95]

Hello,

I sent an e-mail to BMG, but no respons yet either about getting an e-mail switch to enter my account again.
With all respect, I must say that this is a very sloppy performance by BMG so far. They are busy solving the problem, I get that. But this major issue shouldve been fixed easily.
Like they should make everyone enter their account again and give them an abillity to change the e-mail by themselves and change PW. There was no notification or anything about this on the browser-version.

Thats honest feedback, I would like it if they would reply to this instead of closing it, so the people reading this would get more understanding about this issue and the way BMG is dealing with it.


- Richard

[ScarfVendetta]

Hackers were abusing the fact that lots of players hadn't changed their passwords on their own accord: compromising accounts and using bots to gamethrow games on a large scale. Implementing a blanket requirement to change passwords was the most effective solution to combat this.

[Milkshake95]

Hackers were abusing the fact that lots of players hadn't changed their passwords on their own accord: compromising accounts and using bots to gamethrow games on a large scale. Implementing a blanket requirement to change passwords was the most effective solution to combat this.

Reasonable, but understand that alot of (fair) players have become a victim out of this policy. The point i'm trying to make is that the way BMG handeled this, victimizes alot of other players.

[Flavorable]

Hackers were abusing the fact that lots of players hadn't changed their passwords on their own accord: compromising accounts and using bots to gamethrow games on a large scale. Implementing a blanket requirement to change passwords was the most effective solution to combat this.

Reasonable, but understand that alot of (fair) players have become a victim out of this policy. The point i'm trying to make is that the way BMG handeled this, victimizes alot of other players.

While I do get the frustration, you also have to understand that the changing of passwords should have been done by these players over a year ago already.

The protection of accounts and the locking out of hackers and bots is never something that any Developer should have to feel bad about.

The thing you don't realize is that you might be a "fair" player, but that doesn't mean that bots and hackers don't have access to your account and might abuse it to either spam racism, or gamethrow on a large scale. And while it might be a hassle to change your password, at least it's for your own internet safety.

[Milkshake95]

Hackers were abusing the fact that lots of players hadn't changed their passwords on their own accord: compromising accounts and using bots to gamethrow games on a large scale. Implementing a blanket requirement to change passwords was the most effective solution to combat this.

Reasonable, but understand that alot of (fair) players have become a victim out of this policy. The point i'm trying to make is that the way BMG handeled this, victimizes alot of other players.

While I do get the frustration, you also have to understand that the changing of passwords should have been done by these players over a year ago already.

The protection of accounts and the locking out of hackers and bots is never something that any Developer should have to feel bad about.

The thing you don't realize is that you might be a "fair" player, but that doesn't mean that bots and hackers don't have access to your account and might abuse it to either spam racism, or gamethrow on a large scale. And while it might be a hassle to change your password, at least it's for your own internet safety.

Thanks for the reply, to make clear, there is no frustration at all.
I understand that this measurement has been done to make the enviroment safer. Ofc the developers shouldnt be ashamed of that, but read carefully here, I don't argue that!
Im speaking about the communication, for example that i've been playing for a long time and pretty much everyday, I have never seen an announcement pushing me to change my PW. My suggestion would be to put those notifications in the update screen, wich I havent seen either. The last notification in the login is one from 25 januar 2019, come on, be real here, that isnt very strong communication, again with all respect.

[Berts]

A mass email was sent out last January to all TOS players, after the Data Breach happened, informing them of the breach and encouraging users to change their passwords ASAP. The situation was also addressed on the forums at the same time.[/quote]

It does not seem to be true for me as I last changed my password on June 10th, 2019 and I have also been locked out of my account.

[Superalex11]

Hackers were abusing the fact that lots of players hadn't changed their passwords on their own accord: compromising accounts and using bots to gamethrow games on a large scale. Implementing a blanket requirement to change passwords was the most effective solution to combat this.

Reasonable, but understand that alot of (fair) players have become a victim out of this policy. The point i'm trying to make is that the way BMG handeled this, victimizes alot of other players.

While I do get the frustration, you also have to understand that the changing of passwords should have been done by these players over a year ago already.

The protection of accounts and the locking out of hackers and bots is never something that any Developer should have to feel bad about.

The thing you don't realize is that you might be a "fair" player, but that doesn't mean that bots and hackers don't have access to your account and might abuse it to either spam racism, or gamethrow on a large scale. And while it might be a hassle to change your password, at least it's for your own internet safety.

Thanks for the reply, to make clear, there is no frustration at all.
I understand that this measurement has been done to make the enviroment safer. Ofc the developers shouldnt be ashamed of that, but read carefully here, I don't argue that!
Im speaking about the communication, for example that i've been playing for a long time and pretty much everyday, I have never seen an announcement pushing me to change my PW. My suggestion would be to put those notifications in the update screen, wich I havent seen either. The last notification in the login is one from 25 januar 2019, come on, be real here, that isnt very strong communication, again with all respect.

A mass email was sent out last January to all TOS players, after the Data Breach happened, informing them of the breach and encouraging users to change their passwords ASAP. The situation was also addressed on the forums at the same time.

The fact that problems are still being resolved a year later shows that mass email to have been completely insufficient.

[Flavorable]

Hackers were abusing the fact that lots of players hadn't changed their passwords on their own accord: compromising accounts and using bots to gamethrow games on a large scale. Implementing a blanket requirement to change passwords was the most effective solution to combat this.

Reasonable, but understand that alot of (fair) players have become a victim out of this policy. The point i'm trying to make is that the way BMG handeled this, victimizes alot of other players.

While I do get the frustration, you also have to understand that the changing of passwords should have been done by these players over a year ago already.

The protection of accounts and the locking out of hackers and bots is never something that any Developer should have to feel bad about.

The thing you don't realize is that you might be a "fair" player, but that doesn't mean that bots and hackers don't have access to your account and might abuse it to either spam racism, or gamethrow on a large scale. And while it might be a hassle to change your password, at least it's for your own internet safety.

Thanks for the reply, to make clear, there is no frustration at all.
I understand that this measurement has been done to make the enviroment safer. Ofc the developers shouldnt be ashamed of that, but read carefully here, I don't argue that!
Im speaking about the communication, for example that i've been playing for a long time and pretty much everyday, I have never seen an announcement pushing me to change my PW. My suggestion would be to put those notifications in the update screen, wich I havent seen either. The last notification in the login is one from 25 januar 2019, come on, be real here, that isnt very strong communication, again with all respect.

A mass email was sent out last January to all TOS players, after the Data Breach happened, informing them of the breach and encouraging users to change their passwords ASAP. The situation was also addressed on the forums at the same time.

The fact that problems are still being resolved a year later shows that mass email to have been completely insufficient.

BMG did what was required of them. In the end, it's a two-way street of responsibility.

To me, it's troubling that over 1 million accounts have not changed their password in over a year. Anyone who ventures onto the internet and creates accounts for anything should be taught that it's important to keep up with information and to change all passwords for every account they have at least once every 6 months.

In my own, personal opinion, I find it to be madness that BMG has to resort to a massive force reset, effectively hand-holding a large portion of their community for something that shouldn't be necessary in the first place.

[Superalex11]

BMG did what was required of them.

Doing the bare minimum required is something to be looked down on, not used as an excuse. There's a reason people who just "do what was required of them" don't get very far in life. BMG is no exception, as evident by where the game is today (both broadly, and to do with these security issues).

In the end, it's a two-way street of responsibility.

It may be two-way, but the split is nowhere near 50/50 as it seems you're implying. The breach is on the fault of BMG, not the players. Solving the breach is on BMG, not the players. Ensuring the game is in its best possible state is overwhelmingly on BMG, though here the players do have some input. The fact of the matter is that BMG had the opportunity to do more to ensure problems regarding the breach were solved as soon and as efficiently as possible, but they didn't.

To me, it's troubling that over 1 million accounts have not changed their password in over a year. Anyone who ventures onto the internet and creates accounts for anything should be taught that it's important to keep up with information and to change all passwords for every account they have at least once every 6 months.

In my own, personal opinion, I find it to be madness that BMG has to resort to a massive force reset, effectively hand-holding a large portion of their community for something that shouldn't be necessary in the first place.

Well it's troubling to me that you don't know your core audience, then. You might want people to act in a certain way, and you might expect people to be reasonable (especially when it comes to money), but as is one of the first things people learn playing this game, people are irrational. And on top of that, many players are not adults, so expecting the same out of them is even more baffling.

[LevinSnakesRise]

Personal feelings aside, BMG did send out emails to every single account that existed at the same time. Albeit, in bursts rather than all at once, but still within the same day, sent out emails. If users did not change their passwords per instructions, that is technically still on them. Here we are a year later, some people didn't change their password and their accounts started to cause havoc in-game and even here on the forums, and now people are asking why they were asked to change passwords. A few people found the email in their spam/junk folder a year later now that they have had this prompt pop up for them, and have done so. Some cannot because either they used a fake email, or one that is no longer in use. In the latter, it isn't anyone fault if a certain email provider stopped providing services, etc.

Regardless, the Developers tried to handle this under a finite scope, targeting specific accounts and locking out their accounts, without having to cause almost 1 million users to be lost and confused. Unfortunately this didn't help, and a wider-spread of accounts were taken advantage of after the first few attempts to contain the issue. Now they had to go broader and do any accounts before 2019 that didn't update their password, so over almost a million accounts just got forced to reset their password. Now the question is, would the outburst still be as bad if they did this in the first place? Of course cause of all the people who weren't able to get the email in any capacity, or got it sent to their spam/junk folder.

BMG did what they had to, including up to this point. It wasn't flawless, but it's been done, and now they have to assist hundreds upon hundreds of users to try to get their accounts back, because they didn't change their passwords.


The original suggestion to allow people to login and change passwords and emails would not work because that's all information that's available on the web, and anyone, at any time, could easily 'claim' the account, so that was not a feasible course of action to take. The small scopes were their best shot, and unfortunately they had to resort to any and all accounts prior to the breach in 2019 that didn't update their passwords. That's a ton.
BMG isn't 'victimizing' anyone. They're solving a security issue. That's standard for any website who gets breached; tell people to change their passwords, or as a last resort; force password resets on everyone.

While I agree that the web client could have been updated, it was updated literally everywhere else possible. The flash client is about to die this year in December, so they're not focused on updating the client. Yes, it should have been updated for this specific issue, but when they updated everyone everywhere else, including emails, not updating the browser client isn't exactly that much of an issue in the grand scheme of things.

[Milkshake95]

Personal feelings aside, BMG did send out emails to every single account that existed at the same time. Albeit, in bursts rather than all at once, but still within the same day, sent out emails. If users did not change their passwords per instructions, that is technically still on them. Here we are a year later, some people didn't change their password and their accounts started to cause havoc in-game and even here on the forums, and now people are asking why they were asked to change passwords.

Yes, but the thing is that there are alot of reasons that people couldnt read their e-mail. Spambox, different e-mail, locked up e-mail, etc.

In the latter, it isn't anyone fault if a certain email provider stopped providing services, etc.

But this is the problem for alot of players right now. You cant just ignore that and say that in the end the player have a problem but its actually not anyones fault. And again, this topic wasnt meant to blame anyone, but you do understand that if you keep defending BMG so much and keep telling how 'great' they did, it triggers a certain reaction.

BMG did what they had to, including up to this point. It wasn't flawless, but it's been done, and now they have to assist hundreds upon hundreds of users to try to get their accounts back, because they didn't change their passwords.

And so my topic title fits very well if hundreds opon hundreds of accounts have been lost. And you keep saying that the players just shouldve changed their PW, as if it has been everyones choice not to change it, as if its ignorance and our own fault. I couldve only known if I was playing that time the message was sent out on the forums and luckily came accros that one topic that mentioned it.

BMG isn't 'victimizing' anyone. They're solving a security issue. That's standard for any website who gets breached; tell people to change their passwords, or as a last resort; force password resets on everyone.

Or add a phone/question/personal name/whatever- verification, its just too poor that the only way to to able to verify your account, is by e-mail. So if you lost the e-mail or for any other reason, you are screwed.

Yes, it should have been updated for this specific issue, but when they updated everyone everywhere else, including emails, not updating the browser client isn't exactly that much of an issue in the grand scheme of things.

Well as you can tell it sure is 'a huge issue' for some players. That one flaw that couldve been avoided, wouldve been the reason for me and most likely hundreds of more players to be able to reset our PW.


Im leaving this now, I stay to my thoughts that BMG did well on the securty matter, but the way they have handled it and communicating it to the players, was really poor. Not only am I speaking about the way they informed the players about the PW-change, but also the moderators on this forum seem to say that BMG did absoluty great and the players have digged their own grave, BMG shouldnt be there to solve the problems for us, own fault, no account. Thats how I feel about all this. Shame.

[LevinSnakesRise]

Yes, please take your trolling elsewhere. Nowhere did anyone say BMG did great, nor did we praise them in high regard for their efforts. We also didn't say that users dug their own graves. Your putting words into our mouths.

Thank you however for your initial feedback.

[Milkshake95]

Yes, please take your trolling elsewhere. Nowhere did anyone say BMG did great, nor did we praise them in high regard for their efforts. We also didn't say that users dug their own graves. Your putting words into our mouths.

Thank you however for your initial feedback.

seem to say

I have tried to start this discussion with respect and at the end you say that i'm trolling, but also you thank me for the feedback, strange but okay. This says alot.
Let me only rephase that last sentence then, it feels like the people that cant enter their account have dug their own graves. But stay rude, keep jumping to conclusions and make it as personal as you want. It doesnt bother me at all, it just shows alot of things for the people reading this.