With yesterday's release of the authenticator, I was thinking about doing a bit of a review of the security policies that Jagex has. However, before I started going to all this work (there will be a good amount of investigation required to put everything together), I was just wondering if anyone had already done this or if anyone here knew where would be a good place to start looking for this. 

You probably want to answer questions like these:

 

How easy is it to recover an account?

When an account is recovered, is a link to reset the password sent, or are the log in credentials sent instead?

Does Jagex enforce good password security?

How easy is it to bypass the new security system?

You probably want to answer questions like these:

 

How easy is it to recover an account?

When an account is recovered, is a link to reset the password sent, or are the log in credentials sent instead?

Does Jagex enforce good password security?

How easy is it to bypass the new security system?

I know what questions I'm looking to answer (for the most part, and all of those are part of it), I'm mostly trying to figure out if other people have investigated this before me, which could do one of two things:

 

1) Save me time trying to get the answers

2) Give me a baseline to compare their current security to

(More than likely the second, but I might have difficulty getting through to Jagex if their previous customer service reputation is anything to go by).

 

(On a side note, I've already figured out that the passwords you can use are terrible - no special characters, case insensitive, limit of 20 characters - makes me cringe)

If you're already making an effort in this regard, you might want to write it up and submit it for the Times =).

If you're already making an effort in this regard, you might want to write it up and submit it for the Times =).

 

I'd be more than glad to so long as I don't have to give exclusive publishing rights to the Times (I can do timed exclusivity, but I want to keep the rights just in case I want to do something else with it). 

 

If you're already making an effort in this regard, you might want to write it up and submit it for the Times =).

 

I'd be more than glad to so long as I don't have to give exclusive publishing rights to the Times (I can do timed exclusivity, but I want to keep the rights just in case I want to do something else with it).

 

I would be very surprised if they required exclusive publishing rights to Times articles.

I can't wait for this, I hope you do a well research before beginning writing this. I wish you all the best of luck! :)

 

Something you might want to include is if there is any possible problems or if any programs can bypass this by any chance, I'm not an expert, just putting it out there.

 

Good luck :)

 

 

If you're already making an effort in this regard, you might want to write it up and submit it for the Times =).

 

I'd be more than glad to so long as I don't have to give exclusive publishing rights to the Times (I can do timed exclusivity, but I want to keep the rights just in case I want to do something else with it).

 

I would be very surprised if they required exclusive publishing rights to Times articles.

 

We are nowhere near formal enough for that. 

 

I would be very surprised if they required exclusive publishing rights to Times articles.

 

We are nowhere near formal enough for that. 

 

 

I figured as much, I just wanted to be doubly sure. 

 

I can't wait for this, I hope you do a well research before beginning writing this. I wish you all the best of luck! :)

 

Something you might want to include is if there is any possible problems or if any programs can bypass this by any chance, I'm not an expert, just putting it out there.

 

Good luck :)

 

I will definitely look at malware and what it has the potential to do to your account. And don't worry about it being well-researched - this is going to be written very slowly, with a focus on getting everything right from good sources, not on getting it written as quickly as possible.

 

Also, since this is being written for the RS audience, who might not necessarily be knowledgeable about security in general, I'm going to also focus on making this educational about security in general as well.