Thread: So... If I really were hacked

My account would be torn to shreds. I recieved the following email... But there is a catch!

Turbine is concerned that a third-party recently may have attempted to access your account. There is no indication that your account was modified or compromised. For your protection we have changed the password on your account to a new, random password.


To change your password to a new password of your choice and reclaim your account, please follow these steps:
Go to https://myaccount.turbine.com/ and click on "Forgot your password?" You may also click this in the game launcher.

Follow the instructions on how to recover your password. A new password will be sent to this e-mail address.

Once you have received the password reset e-mail, change your password to a new, unique password you do not use anywhere else.
Turbine takes your account security seriously. If you have any questions, please feel free to contact us at https://support.turbine.com. You may submit a new inquiry to our Customer Service team, and they will be able to assist you further.

Thank you,
Turbine Support

And that catch is that I can't log in on my PC, because I've not changed the password. I can't get in-game or on the forums.

Wait, how am I posting this?

This peculiar mobile device has apparently outwitted Turbine.

Mobile device: 1 -- Turbine: 0

Good effort I guess.

What's your point? There are details given how to get a new password. But instead you act like you've outwitted turbine who is only trying to help you.

Account security? What account security? Psh who needs it.

Originally Posted by Lohi

What's your point? There are details given how to get a new password. But instead you act like you've outwitted turbine who is only trying to help you.

He seems to be saying that he can't log into his LOTRO account or the forums on his PC due to the lock-out caused by Turbine's changing the password the e-mail is telling him about (I'm assuming his Browser is still remembering the old one) .. but he CAN still log in and post on his mobile phone using the old password.

On the face of it, taking his description entirely at face-value, it does seem very weird.

Originally Posted by Kraggy_Eldar

He seems to be saying that he can't log into his LOTRO account or the forums on his PC due to the lock-out caused by Turbine's changing the password the e-mail is telling him about (I'm assuming his Browser is still remembering the old one) .. but he CAN still log in and post on his mobile phone using the old password.

On the face of it, taking his description entirely at face-value, it does seem very weird.

The funny thing is - turbine makes me auto relog every time I visit this site when I leave this browser for an extended period of time. However, it's pushed through automatically and I am not having to enter in anything.

My password should be changed;is changed -- I've not done anything with it yet. I shouldn't be able to post here.

Darn right it's weird. I also believe that support should be able to back my outlandish claims if they check records.

I did contact support Turbine pointing to this thread. Now I'm going to sit back and /popcorn.

Hopefully it's only from your cell you are able to log in.
Could be that you have ckecked the box to auto log in and have cookies and Temp-internet files that makes you skip the log in. (That is one reason why you shouldn't use password sites on public computers)

Turbine (and many other companies) has multiple copies of the user id and password file. The master file is the one associated with MyAccount. If someone changes information in the master, there is time delay before all the slave files are updated synced. For a time, there will be two passwords in the system.

In Turbine's case, there is a very long time delay between updating MyAccount and sync update to the web server copy. The last time I changed by password on MyAccount it took 2-3 weeks before the change was occurred for MyLotro, the forums and the other web services.

Companies keep multiple copies for several reasons:

1) Destruction of the master does not bring the entire corporation to its knees.

2) Outages of the master, do not lock out of all of the systems.

3) Many systems can not use the same file due to software constraints. The application needs a specific format for the user id and password file. Or specific location.

4) Performance reasons. It does not make much sense for a South Florida software development engineer to authenticate with the corporate HQ in Munich, Germany.

All these copies make for a target rich environment for a thief. All the thief has to do is find a open door to one of them.

One company I worked for had 100s of copies. A software development engineer like me that worked this multinational had one entry in the local authentication files at every facility. Every facility had multiple authentication files. I do not think I ever learned all the development centers located all over the world. When I changed my password, it would take 24 hours for all the authentication files to update. I had to be careful to not trigger the 3 strikes your out lockout while the update was under way. You could still work (depending on where the lock you started) because it took 24 hours to fully lock you out.

Bottom Line - The web services do not know that password has been changed yet. The web services are using a different authentication file with the old password.

Still no official response.

Props to the person though that said my issue should be regarded as trolling.

I'd love to go on my PC and go into detail, but I can't. Bummer.

You will never get an official response on the forums. The forums are not a means of customer support. Contact customer support if you care about resolving some problems.

Originally Posted by Lohi

You will never get an official response on the forums. The forums are not a means of customer support. Contact customer support if you care about resolving some problems.

If you read above you may note that I already did such. I pointed them to this as an example of ongoing use despite the implented changes... Which should not allow me to post on said device.

Yula's response, although in-depth misses the target. The web services obviously have been updated as I'm not able to log in via my PC.

Turbine however gave me a lovely automated email saying I could fill out a service survey. Of course this gave me great joy.

I'd post it here, but that negative repper would probably just slam this post again, calling it trolling. In the eyes of that individual, since I posted a 'private communication' and that I've severely violated the rules here at turbine, I deserve some sort of divine punishment.

Originally Posted by deaddove

The funny thing is - turbine makes me auto relog every time I visit this site when I leave this browser for an extended period of time. However, it's pushed through automatically and I am not having to enter in anything.

Even if you used the "Log Out" link in the upper right corner before?