A comment on email addresses and WoW security

[Sarayana]

This was posted on the WoW forums. Since the poster is uncertain whether it's permitted, I'll post the text below:

I apologize if this would be the wrong forum, but I thought this might help illustrate to hacking victims how important it is to protect your email address for WoW.

Over the last 3 weeks I did an email experiment with wow fansites, guild sites, etc, to see how many "fake" blizzard emails I'd get that were phishing and social engineering attempts to get my wow info. What I did was create a fresh gmail address for each site that I simply signed up for and used to create an account on the site. The email addresses were random jarbles of letters and numbers to try and eliminate "guessing" an email address. The addresses were shared or posted nowhere, and were used solely for the one site each was created for. I then checked the inbox and spam folders of each address after 3 weeks to see what I'd find. The results might surprise you.

I'm not sure if I'm allowed to post the site URL, so I will instead refer to the site "name". (if this must be removed as well, a blue can certainly do it or inform me) Below is a list of the sites, along with the number of "fake" phishing/scam emails I received in a 3 week period with the above fresh email addresses and sign ups. What's surprising is that several of these sites supposedly "hide" your email address.

guild portal - 16 phishing emails
guild o matic - 16 phishing emails
guild launch - 23 phishing emails
curse - 1 phishing email
wow installer - 19 phishing emails
mmo-champion - 0 phishing emails
wow insider - 4 phishing emails
world of raids - 7 phishing emails
battle.net - 0 phishing emails




I hope this illustrates the importance of NOT using your battle.net email at any other fansites or guild sites! (or anywhere for that matter)

I do not claim my methods are perfect or infallible. Take this for what you feel it's worth, be it nothing at all, or an interesting test.

I cannot stress how important that conclusion is: CREATE A SEPARATE EMAIL ADDRESS FOR YOUR BATTLE.NET ACCOUNT THAT YOU DO NOT UNDER ANY CIRCUMSTANCES USE ANYWHERE ELSE.

This simple step will go a far, far way towards protecting you against phishing attempts.

[Vephriel]

I fully agree.

When the battle.net conversion first came around, I went and created a brand new email address specifically for that login. The email is a very random assortment of letters and numbers that only make sense to me, and I don't use it for anything else. It's never been posted anywhere and no one even knows it asides from myself.

[VelkynKarma]

This is a very smart idea. Of course it's also important to note that you shouldn't share your email information around, period, otherwise this plan won't work. So yeah....nooooo sharing, keep it secret folks

~VelkynKarma

[Ryai]

Bleh guess I'll go change my email now >.>

[Mania]

Two things I wanted to add:

Some e-mail providers are more secure than others. Hotmail, for instance, has some flaws that I feel make it a bad choice for account e-mails like these. I have been extraordinarily happy with GMail in this way, however, and would recommend to it anyone.

Secondly, although using a separate e-mail address for your actual WoW account is a very good idea, be aware that it might not protect you from e-mail phishing attempts completely. An example ...

I have several domains registered to me: manaiasarcania.com, warcraftmounts.com, wow-petopia.com, a couple of business-related domains, and my personal domain ... among others. Since I am the only user for all of those, I have set it up so that I receive all the e-mail sent to any user. For example, I get e-mail send to fred@wow-petopia.com even though there is no such account.

And oddly, this non-existent Fred with his non-existent WoW account gets phishing spam about his account being under review and so forth. Even more oddly, so does fred@akuli.com, a site we haven't even fished setting up yet.

So the scammers may not be targeting you or your account or your e-mail specifically. Automated tools make it easy to spam thousands of e-mail addresses at once, and enough people play WoW these days that a shotgun approach can sometimes be effective.

Anyway:

1. Yes, definitely use a separate e-mail address for your WoW account.
2. Make sure that e-mail address is as secure as you can make it, both on your end (by never sharing it with anyone) and on their end (by choosing a secure and reputable e-mail provider).
3. Take precautions even with e-mail that is sent to your account address. Take a look at the e-mail header to see where the e-mail actually originated from, go to the Blizzard site directly instead of following a link in the e-mail, etc. Because you may have been lucky enough to get completely random untargeted spam.

[Saturo]

Hmm...
So, theoretically, it would be possible for me to scam you...?

Excellent...

[Vephriel]

Mm, I'll throw in my vote for Gmail as well.

I used to use Hotmail as my sole email address, but late last year there was a massive hack that occurred throughout tons of hotmail addresses. My email was one of the ones that was taken, and it was absolutely a headache trying to get possession of it again. Took me weeks of dealing with automated responses and unhelpful hotmail 'support' staff.

Anyways, truthfully I'm glad it happened in a way because I prefer Gmail way more now.

[Sarayana]

Excellent points Mania. To be honest, I just threw this up before logging on last night, with Minimal Effort (tm). I just basically wanted to underscore some of the things that have been discussed in various hacking threads on these forums. There's so much talk of "but I don't go to Bad Websites, I don't understand how...!!!" when in fact, it is very hard and takes a LOT of work to run a secure site - particularly one related to WoW. (Thanks, Mania!! )

I couldn't agree more about gmail. It's the only email domain I have aside from private domains that I feel I can trust. Well, "trust," since as you say, you're never 100% safe. But Yahoo, Hotmail, or Godknowswhat.com, they just don't cut it with security in my opinion.

[Saturo]

GMail ain't that secure either... They only run with an 128 bit encryption.
What we need is 4096 bits encryption!

[kairii]

@Mania
They target emails that they can see, you yourself know there are bots on here 'data-farming' and they will pick up on your email you have posted on the site which then get sends out there into the web for anything.

As for Hotmail I haven't had a issue with it before. and when ever I do allow my boyfriend to log my account (its not account sharing if he is moving me when im stuck) I will always create a new email and change my WoW one
Call me paraniod but I really HATE battlenet

[Ryno]

Bleh. I tried to change my email for my WoW account recently, but I don't remember my security question.

Baffles me, since I know what the question is, and I know what I should have put as an answer. And of course, in order to get the answer from Blizzard, I went through two different people through emails, and ended up with a large form that needs filling out, along with a photocopy of either my driver's license or my birth certificate.

Bleh hassles. Didn't feel like filling all that out. And I really don't want to spend a half hour or more waiting for Blizzard on the phone, but I may eventually have to...

[Saturo]

Don't get me started on security questions...
*Favorite colour?*
Dark Blue
*Incorrect. Please try again.*
Darker blue...?
*Incorrect. Please try again.*
Dark red?
*Incorrect. Please try again.*

(For some reason, it was green...)

[Sarayana]

@Mania
They target emails that they can see, you yourself know there are bots on here 'data-farming' and they will pick up on your email you have posted on the site which then get sends out there into the web for anything.

That's not entirely true Kairii. My parents have a domain for their company and they receive spam/phishing mails exactly like those Mania described daily. The recipient doesn't exist but because they've configured their system to receive all mail to @domain.com, they still receive it.

It's like shooting a scattergun. With that many bullets, you're bound to hit something, right?

[Ryno]

Don't get me started on security questions...
*Favorite colour?*
Dark Blue
*Incorrect. Please try again.*
Darker blue...?
*Incorrect. Please try again.*
Dark red?
*Incorrect. Please try again.*

(For some reason, it was green...)

Yeah, mine was my first pet, so I typed in everything I could remember about my first "pet". I never really owned one myself (besides fish) so I'm trying to remember names of my fish, names of dogs of other family members, names of video game critters I might have put in for fun, and... damn, none worked!

My account still isn't hacked at least, but meh. It irks me.

[Gala]

holy crap ryno, i feel your pain.

i went through all that crap this morning. finally just gave up. i have an authenticator. it seems to work pretty well.

[Ryno]

holy crap ryno, i feel your pain.

i went through all that crap this morning. finally just gave up. i have an authenticator. it seems to work pretty well.

Same.

Plus my virus scanner caught like, two programs trying to steal my WoW info (a few weeks ago), I think it can catch most, or at the least the ones that I'd be likely to get...