How 'secure' is SCID?

[StormHeart]

Forum members are required to declare their date of birth when registering their forum account. It is possible to see "today's birthdays" on the front page of the forum.

You do have complete control over whether or not it is displayed and, if displayed, in what format. Some choose to show their date without the year, others just their age, but there is also an option for full date of birth.

Personally, I hide my date of birth, so it is visible only to Supercell staff, other mods, and admins.

If anyone wants to check on their own profile, tap on settings at the top of the forum page, scroll right down, and tap on "edit profile" at the bottom left.

I was talking about the game itself, didn't consider the forum. I suspect my birthday is off on the forum. Tagged shows your age and today I got a lot of birthday wishes. Correct day but the year is wrong. That creates another problem, should I have an issue with accessing the account, I won't know the correct birthyear. I'll check the forum settings here. Displaying your birthday on the Internet is a common thing and VERY bad idea. I worked for a government agency. The customer service reps would key highly on birthday for phone calls. The people working the phones told me a relative posing as the individual they were asking about, would usually not know the correct birthday. I'm headed to setting but I suspect I already turned that off.

[Darian[Supercell]]

Nice post.. This has helped alleviate some of my concerns..
My worry was "surely not everyone whom loses their account is slack with breaking the TOS or personal details"..
But I am starting to realise that they probably are after all... Or at least the vast majority are.

As I stated here: https://forum.supercell.com/showthre...5#post12746055

whenever I have been asked to further investigate an issue there has only been 3 times where a ban was reversed due to agent error. 3 times in the 3 1/2 years I've been here out of hundreds of requests. The Support agents handle thousands of requests. 3 out of thousands is a pretty good ratio.

In almost every single "my account was phished" or "my account was banned for no reason" we've seen very suspicious activities on the accounts. Most of the time it's because they bought the account or was "given" the account and the original account holder is trying to retrieve the account, causing a dispute of ownership. It's quite a common scam.

Additionally, even if the original account holder was very strict about their data security, we see instances of players letting Clanmates or friends play on the account to sometimes do their War attacks or Clan Games tasks when they don't have to do it. Perhaps the friend they let use the account may have had a keylogger or compromised email address because they use the exact same password for all of their personal accounts (banking, email, work, online shopping, etc.). So then as a result that friend gets the account compromised.

There are literally large groups of individuals who play the long game and collect personal information over time with the intention of stealing accounts to sell them or somehow make a profit with it. It's not like there was one single instance where you revealed all of your information in a single Clan message that they were able to use to steal your account.

Are you public about playing Clash on social media? Do you really think that random person who has a super model for a profile pic is actually a single, insanely physically attractive individual who added you as a friend because they want to get to know you? That person is likely a scammer who is now looking at what you post on social media to collect enough personal information to steal any account of yours they can because most people aren't aware of what they actually post publicly.

[joshsgrandad]

As I stated here: https://forum.supercell.com/showthre...5#post12746055

i know, I took particular notice of that post.. Kinda put things into perspective

In almost every single "my account was phished" or "my account was banned for no reason" we've seen very suspicious activities on the accounts. Most of the time it's because they bought the account or was "given" the account and the original account holder is trying to retrieve the account, causing a dispute of ownership. It's quite a common scam.

Additionally, even if the original account holder was very strict about their data security, we see instances of players letting Clanmates or friends play on the account to sometimes do their War attacks or Clan Games tasks when they don't have to do it. Perhaps the friend they let use the account may have had a keylogger or compromised email address because they use the exact same password for all of their personal accounts (banking, email, work, online shopping, etc.). So then as a result that friend gets the account compromised.

There are literally large groups of individuals who play the long game and collect personal information over time with the intention of stealing accounts to sell them or somehow make a profit with it. It's not like there was one single instance where you revealed all of your information in a single Clan message that they were able to use to steal your account.

Are you public about playing Clash on social media? Do you really think that random person who has a super model for a profile pic is actually a single, insanely physically attractive individual who added you as a friend because they want to get to know you? That person is likely a scammer who is now looking at what you post on social media to collect enough personal information to steal any account of yours they can because most people aren't aware of what they actually post publicly.

TBF, I got used to those girls when I used to visit Uncle Hugh at the mansion, so tend to ignore them nowadays..

I dont do social media.. Need to be social for that.. But no doubt I probably inadvertently give away snippets of information all the time, although cant recall anything specifically.

Good post again tho.. Anything that will make people stop and think can only be a good thing.

[ESCANOR0803]

Do you really think that random person who has a super model for a profile pic is actually a single, insanely physically attractive individual who added you as a friend because they want to get to know you?

This point is really hilarious but so true.

[meonhoc]

Guilty, I skimmed through the thread, read some posts and posed a moment before a cat avatar..... so what I am going to say may have been mentioned.

Even before SC ID, I experienced a few accounts owner verification process (changing device iOS/android, removed GC/FB account). I was lucky enough to join forum quite early after I started playing and read a lot about ownership verification process.

Had I not been on this english forum,I would surely fail at some questions. I wish there is a big red warning to players about to start a new account , in multiple language, about the information they are going to use in the game.

We can't prevent people from being careless, but have we told them which kind of information they should be careful about?

An active and well organised clan will always have some form of group communication, which can reveal some of their information of an average player (fb profile, phone number, email, location via IP address....). Some group chat keeps history, so even if you leave the group, new member joining can still read about what ever you shared without knowing you. How many of us actually think about it?

I would love a thing like "secret questions and answer to 1-time recover your account" (to combine with other info). Or something similar to make player aware of the seriousness of the situation.

I don't like the system as it is, because average players are not well prepared against scammers. There is a lack of information about how to protect one's account efficiently while still being social.

[chilepepper101]

Guilty, I skimmed through the thread, read some posts and posed a moment before a cat avatar..... so what I am going to say may have been mentioned.

Even before SC ID, I experienced a few accounts owner verification process (changing device iOS/android, removed GC/FB account). I was lucky enough to join forum quite early after I started playing and read a lot about ownership verification process.

Had I not been on this english forum,I would surely fail at some questions. I wish there is a big red warning to players about to start a new account , in multiple language, about the information they are going to use in the game.

We can't prevent people from being careless, but have we told them which kind of information they should be careful about?

An active and well organised clan will always have some form of group communication, which can reveal some of their information of an average player (fb profile, phone number, email, location via IP address....). Some group chat keeps history, so even if you leave the group, new member joining can still read about what ever you shared without knowing you. How many of us actually think about it?

I would love a thing like "secret questions and answer to 1-time recover your account" (to combine with other info). Or something similar to make player aware of the seriousness of the situation.

I don't like the system as it is, because average players are not well prepared against scammers. There is a lack of information about how to protect one's account efficiently while still being social.

just dont give away age, name, password, email, phone #, or even device type to anyone whose face you haven't seen with your own 2 eyes.

[Darian[Supercell]]

Guilty, I skimmed through the thread, read some posts and posed a moment before a cat avatar..... so what I am going to say may have been mentioned.

Even before SC ID, I experienced a few accounts owner verification process (changing device iOS/android, removed GC/FB account). I was lucky enough to join forum quite early after I started playing and read a lot about ownership verification process.

Had I not been on this english forum,I would surely fail at some questions. I wish there is a big red warning to players about to start a new account , in multiple language, about the information they are going to use in the game.

We can't prevent people from being careless, but have we told them which kind of information they should be careful about?

An active and well organised clan will always have some form of group communication, which can reveal some of their information of an average player (fb profile, phone number, email, location via IP address....). Some group chat keeps history, so even if you leave the group, new member joining can still read about what ever you shared without knowing you. How many of us actually think about it?

I would love a thing like "secret questions and answer to 1-time recover your account" (to combine with other info). Or something similar to make player aware of the seriousness of the situation.

I don't like the system as it is, because average players are not well prepared against scammers. There is a lack of information about how to protect one's account efficiently while still being social.

There are multiple warnings, including in-game tips that warn people not to give out their account information. People don't read the TOS or even the in-game tips we provide. If we came up with a list of how information could be maliciously used, those same individuals probably won't read that either.

[williemaykit]

Hi Darian,

Slightly off topic to this disucssion, but with regards to players getting other players to do their clan games or war attacks etc as mentioned above, has their been any internal disucssion around a holiday mode option (or similar name)?

The idea is that a player puts a start and end date for when they are away, for whatever their reason, they assign another player to temporaily manage their account foe the stated period?

Yes there are risks in that someone could do whatever they liked to that account, but this could be circumvented by having limitations placed on what actions that account sitting player could do, eg.. disband clan, kick people out, transfer account etc..

The holiday account would effective be in a locked down state, just being able to attack (raiding, war CWL etc), upgrades, do challenges etc

Then once the designated period is up, it reverts back to the original owner.

During the 'holiday period' the original owner would be blocked from accessing the account, harsh but clean as they put the account into holiday mode in the first place

I have seen this work quite well in other games. yes it has been abused but due to their own stupidity!

Of course you can't stop players assigning it to the wrong person, but that is their risk and with the limitations placed on the other player this would limit any damage.

Just my 2 cents.

[Darian[Supercell]]

yes it has been abused but due to their own stupidity!

Of course you can't stop players assigning it to the wrong person, but that is their risk and with the limitations placed on the other player this would limit any damage.
.

These two reasons alone show why it's not a good idea for a voluntary account sharing system. Just one use case scenario, the person who is temporarily taking care of the account sells it for whatever reason. Maybe they are hurting financially and the offer is too good to turn down. Maybe they're greedy. Whatever.

So now the account has been illegitimately sold to another person. So when the original owner returns to the game, they find out some unauthorized person has now taken over the account and done irreversible harm or perhaps even got the account banned for whatever reason.

Let's say the person who bought the account commits multiple violations, maybe they made violent threats against another person. Maybe they inappropriately harassed a player who is underaged.

When the original owner comes back to the game, who do we hold responsible for these actions? The original owner for giving control to someone else? The temporary account holder who the owner gave access to? Or the person who bought the account and committed the violations? Either way, they were all done on a single account and must be actioned.

Is that fair to the original owner who didn't do these things?

There is no safe way for something like this to happen without making it wide open for abuse.

[williemaykit]

These two reasons alone show why it's not a good idea for a voluntary account sharing system. Just one use case scenario, the person who is temporarily taking care of the account sells it for whatever reason. Maybe they are hurting financially and the offer is too good to turn down. Maybe they're greedy. Whatever.<br>
<br>
So now the account has been illegitimately sold to another person. So when the original owner returns to the game, they find out some unauthorized person has now taken over the account and done irreversible harm or perhaps even got the account banned for whatever reason. <br>
<br>
Let's say the person who bought the account commits multiple violations, maybe they made violent threats against another person. Maybe they inappropriately harassed a player who is underaged. <br>
<br>
When the original owner comes back to the game, who do we hold responsible for these actions? The original owner for giving control to someone else? The temporary account holder who the owner gave access to? Or the person who bought the account and committed the violations? Either way, they were all done on a single account and must be actioned. <br>
<br>
Is that fair to the original owner who didn't do these things?<br>
<br>
There is no safe way for something like this to happen without making it wide open for abuse.

That's where the limitations come into play as to what the account sitter can actually do, or can't do. I would think that the only thing the account sitter could do is from an account perspective is;

- collect resources
- participate in events
- participate in war ( though double edged)

Enerything else is off limits Yes would require some coding effort no doubt.

I don't know the numberof players that do get someone else to attack etc on the others behalf, even though its against the current TOS but if the number is high enough then this could be added as a Quality of Life change.

Potentillay could reduce the volumn of work that Supercell staff have to do in checking it out and would free them up for more value add activites

I do agree with you around the harassing and violent threats which is never acceptable.

With regards to who would be responsible it would be the account sitter as they are the ones who are performing the actions and this I am sure could be traced 'behind the scenes".

People don't like accountabilty and it seems to be getting worse for some reason in society, but if the rules are clear I in relation to account sitting if it were to go ahead) then there is no excuse, failure results in a permanent ban from the game for the sitter if offenses are committed.

I know in my clan that there are times when this feature would be super helpful, I would expect there to be similar scenario's in other clans, but could be wrong.