Security Checks - LocalId v Chk Code

[Le Petit Prince]

Hello Admins,

So, I would like to ask about the two security checks that are in place, and why we can't always have one instead of having both. In particular, I would prefer we just use the chk code, and would like to understand why the localid is necessary.

GPers are familiar with both. The chk code is mapped to things such as telegrams and formerly to endorsements, and achieved some measure of infamy as a part of the magical url pre-endorsement Defenders were using back in 2011 - viewtopic.php?p=6946885&sid=748cd414e95f760670a8634af186da9c#p6946885

The localid is a newer security check, and is behind the annoying security stops that Unibot mentioned here - viewtopic.php?p=19139204#p19139204

The chk code is mapped to things like - telegrams, leaving the WA, ejections and bannings

The localid is mapped to things like - endorsements, moving and the settings page

The localid changes everytime something it is mapped to is affected, with the interesting exception of endorsements. Meaning, if I am about to move somewhere, but I opened a settings tab and changed my flag, I can't simply return to the regions tab and move, I have to refresh.

Or, as I was reminded by when I was listening to the latest Malicious Broadcast, I can't simply open up a bunch of region tabs and move to all of them, I need to refresh each time to get the new localid.

Why is this necessary? Why can't everything be mapped to the chk code, which persists throughout the session?

I understand the security concern, but I don't understand how the localid is an improvement over the chk code - If someone can get past the same-origin security policy, then the localid is of no additional help. If I install a malicious extension, the fact that the localid is always changing won't help, it will easily be parsed for and utilized because the extension has persistent access to the client. Similarly, if I visit a malicious third party site, while the localid makes things a little more difficult than the chk code, there are multiple ways the site could make you keep requesting NS pages, and thereby parse for and use your localid.

The point is, you aren't supposed to ever get past the same-origin policy, the most typical way to get past it is downloading an extension - which warns you all your data is accessible. To do it through a third-party site would be a major hack that I think goes beyond what NS users are capable or willing of doing to each other. And once you are past the policy, I don't see how the localid is really any better than the chk code, as I have explained.

Or am I missing something?

Since endorsing and banning are either tied to the chk code or don't alter the localid, and these are the most likely to be abused (as I can think of, such as making someone banject/endorse a player they dont' want to) and given the fact that most people are never going to have their chk code OR localid compromised unless they download an extension - then it is there fault, really - why the need for the localid? It only gets in the way of GP, slowing down movement, punishing people for getting distracted before a jump, etc....

This affects both raiders and defenders.

Therefore, I would suggest the chk code replace the localid in all circumstances, unless I have totally missed something and there is an explanation why the localid is more secure than the chk code, or is needed. I hope I haven't missed anything big though.

Thank you!

[Improving Wordiness]

As a defender I do not have that issue. Fact is that invaders are greedy and want to speed through a hundred regions using the godmod of pinpointed update times. You really need it dummied down even further?
Refresh the page before you jump...it aint hard

[Le Petit Prince]

As a defender I do not have that issue. Fact is that invaders are greedy and want to speed through a hundred regions using the godmod of pinpointed update times. You really need it dummied down even further?
Refresh the page before you jump...it aint hard

Putting aside the rather preposterous notions of "dummied down" and "godmod", I think you are missing the nature of the question, which is fundamentally one of security.

If the localid doesn't make people anymore secure than the chk code, and I don't believe it really does, then there is no reason for its inhibitions.

And respectfully, you may not have had the misfortune of rubbing against said inhibitions, but then again, I can't remember the last time you liberated anything.

It isn't appropriate for inactive GPers to comment on technical issues in such a manner, really, if we are trying to address problems and assess impact. You can't say, It doesn't affect me as X when you hardly do X, in this case, liberations or spotting on the defender side.

Those defenders who are active in these areas, have reported it to be a problem. So your testimony, while appreciated, is so obviously laced with the adversarial politics of R/D that it has no place in a technical thread, especially one that is really about superfluous security inhibiting GP generally, for all players, not about this or that or point-scoring among certain groups.

And quite frankly, your side needs more help than we do. We don't need the extra seconds, we can beat you well enough already. This is simply about things working as they should.

If I hit "Move Region", I should move. And if not, there should be a damn good reason for it.

[Shadow Afforess]

See this thread: viewtopic.php?f=15&t=266206

[Improving Wordiness]

Le Petit Prince you made the choice of speaking for invaders and defenders.

Speaking as a defender it does not cause me a problem......I am as entitled to an opinion on this matter as any player regardless of what your opinion on my gameplay habits are.

[Le Petit Prince]

See this thread: viewtopic.php?f=15&t=266206

I'm not seeing how this addresses my question... Multiple logins don't really have anything to do with these security codes as I understand it, because you are immediately logged out before doing anything. That tells me the verification is not the localid, but is happening at the pin code level, which is a HTTP cookie and something entirely different.

But maybe I am incorrect? I'm not seeing if that was the case though, why the chk code would still be tied to important things, like ejecting people. It seems the localid would have nothing to do with logging in more than once, I was able to get around this by passing the pin code.

It would be interesting to see if one was served the same localid if they had the same pin code across sessions, but I was told this pass was illegal so I am wary of testing it myself.

Le Petit Prince you made the choice of speaking for invaders and defenders.

With all due respect, I didn't mean to speak for anyone. I quoted a rather well known Defender who recently explained that it was a problem.

[Improving Wordiness]

I imagine Afforess meant to post a link to this thread http://forum.nationstates.net/viewtopic.php?f=15&t=286495

It was recently discussed by the look but I can only imagine that it being buried on page 2 made you overlook it. Fortunate it was a well known gameplayer that posted it so it was easy to find.

[Le Petit Prince]

I imagine Afforess meant to post a link to this thread http://forum.nationstates.net/viewtopic.php?f=15&t=286495

It was recently discussed by the look but I can only imagine that it being buried on page 2 made you overlook it. Fortunate it was a well known defender that posted it so it was easy to find.

That is the post I mentioned in my OP!

I know about that, it still doesn't answer the question of what makes the localid necessary if we have the chk code!

[[violet]]

It's not for security; it's to create the effect that you dislike. That is, "localid" exists precisely so that it can be used to prevent a player from opening a bunch of region pages in advance, then cycling through them clicking each one's "MOVE" button. It's a gameplay decision, not a security decision.

So your question should probably be not "what added security does localid provide over chk" but "why can't I open a region page in advance, go do some other stuff, then come back and click the move button."

[Le Petit Prince]

It's not for security; it's to create the effect that you dislike. That is, "localid" exists precisely so that it can be used to prevent a player from opening a bunch of region pages in advance, then cycling through them clicking each one's "MOVE" button. It's a gameplay decision, not a security decision.

So your question should probably be not "what added security does localid provide over chk" but "why can't I open a region page in advance, go do some other stuff, then come back and click the move button."

Ah, okay.

I was under the illusion it was there for security.

My mistake then.

I don't suppose you are going to change your mind on the gameplay element, then?

[[violet]]

I don't suppose you are going to change your mind on the gameplay element, then?

I'm open to it; it's more Ballotonia's area than mine, though.

[Mallorea and Riva]

I don't suppose you are going to change your mind on the gameplay element, then?

I'm open to it; it's more Ballotonia's area than mine, though.

You just gave that poor guy a heart attack and you might not even know why

[Cormacville]

Le Petit Prince you made the choice of speaking for invaders and defenders.

Speaking as a defender it does not cause me a problem......I am as entitled to an opinion on this matter as any player regardless of what your opinion on my gameplay habits are.

It doesn't cause you a problem because TITO does, at most, 1-2 defenses per update, and that's only when you aren't too busy requesting game changes that would eliminate R/D.

When I was in the UDL, security checks did in fact cause problems for defenders -- particularly during liberation attempts. If a page is open for too long and you don't refresh, which is often the case prior to a liberation attempt, you're very likely to get security checks and we had to constantly remind people to refresh their pages a few minutes before a target region would update. Security checks were a common reason for the failure of liberation attempts. Security checks could also be occasionally problematic when defending against tag raids, though I don't think anyone does that anymore. But this issue does in fact impact both raiders and defenders.

Now, to [violet]'s above stated goal for the security check: It isn't doing what you want it to do. Yes, it's annoying, but a raider who knows what they're doing and practices can still move from region to region in 1 or 2 seconds. This is just yet another way that admins have confined participation in R/D to a small elite -- we can, and do, get around the barrier that security checks apparently are intended to be. An average new player who wants to participate in R/D won't know how.

[[violet]]

Now, to [violet]'s above stated goal for the security check: It isn't doing what you want it to do. Yes, it's annoying, but a raider who knows what they're doing and practices can still move from region to region in 1 or 2 seconds.

That's significantly longer than without the check, though. Particularly in percentage terms.

This is just yet another way that admins have confined participation in R/D to a small elite -- we can, and do, get around the barrier that security checks apparently are intended to be. An average new player who wants to participate in R/D won't know how.

How is it biased against a new player? I'd have thought it wouldn't be noticeable unless you were doing more advanced things, e.g. opening up lots of tabs for pre-targeting multiple regions.

[Mallorea and Riva]

This is just yet another way that admins have confined participation in R/D to a small elite -- we can, and do, get around the barrier that security checks apparently are intended to be. An average new player who wants to participate in R/D won't know how.

How is it biased against a new player? I'd have thought it wouldn't be noticeable unless you were doing more advanced things, e.g. opening up lots of tabs for pre-targeting multiple regions.

That's not generally how we tag raid. Or at least how I tag raid. The regions aren't given to us in a list in advance, it'd be too much clutter.

[Cormacville]

How is it biased against a new player? I'd have thought it wouldn't be noticeable unless you were doing more advanced things, e.g. opening up lots of tabs for pre-targeting multiple regions.

That's not generally how we tag raid. Or at least how I tag raid. The regions aren't given to us in a list in advance, it'd be too much clutter.

This. The exercise the OP refers to, conducted by The Brotherhood of Malice, is a speed exercise with non-WAs in regions we created expressly for that purpose. The idea behind it is if you can move quickly from region to region, even needing to refresh, you're going to have no problem moving quickly during real raids where you aren't moving from pre-tabbed region to region. But during normal tag raids, we don't get a list in advance and security checks aren't much of a problem.

Security checks become a problem in basically two situations: 1) When raiders or defenders are going to raid or liberate a single region and have the region's page open for a while, and then perform other game actions that cause the security check; 2) When defenders are defending against tag raids, which often involves performing multiple actions quickly -- cross-endorsing, spotting with the Activity page (formerly with Reports), and moving.

The problem for newer players is they aren't going to even know security checks exist until they encounter them and their raid or liberation fails, and then unless they come dig through Technical or ask someone else they aren't necessarily going to know how to prevent them either. Meanwhile, it still isn't curbing tag raids at all because it has nothing whatsoever to do with the mechanics of how raiders tag raid.

[Sichuan Pepper]

Funny enough most of the views expressed in this thread are invader ones. I find it hard to believe that it is out of concern for new players however taking it a face value I would recommend simplifying a few other things before worrying over security checks.
Security checks are not a problem for Defenders. Time is a problem.

EDIT : Improving Wordiness posting from my current WA nation.

[Land filled with People]

-on elitism and woe is the noob-

How does this impact noobs at all? Most new N/R/D players are not going around tagging. In fact, they're doing well if they even move while update is running, so the 2 second hiccup of a security check is not impacting them at all. If a new group does pop up that is tagging then they are likely already experienced, and hence know how to avoid the security check. You literally just have to refresh the page.

Security checks become a problem in basically two situations: 1) When raiders or defenders are going to raid or liberate a single region and have the region's page open for a while, and then perform other game actions that cause the security check; 2) When defenders are defending against tag raids, which often involves performing multiple actions quickly -- cross-endorsing, spotting with the Activity page (formerly with Reports), and moving.

You provided your own solution to both of these issues:

Meanwhile, it still isn't curbing tag raids at all because it has nothing whatsoever to do with the mechanics of how raiders tag raid.

Perhaps you should follow their process? Then this can continue being the non issue it is.

[Cormacville]

Funny enough most of the views expressed in this thread are invader ones. I find it hard to believe that it is out of concern for new players however taking it a face value I would recommend simplifying a few other things before worrying over security checks.
Security checks are not a problem for Defenders. Time is a problem.

EDIT : Improving Wordiness posting from my current WA nation.

I would just like to point out that the OP of this thread links to an earlier thread, posted by Unibot, in which he says that this is a problem for both raiders and defenders. Security checks are a problem for defenders, for the reasons I've already stated. Security checks are not a problem for you because you're still defending like it's, what, 2005?

And yes, clearly, raiders would have no concern for new players, because none of us have ever been new players, recruited new players, or integrated new players into the game and trained them to raid. No. Unlike other players, we come not from Feeders but are born directly from the mystical life force of [violet] as the fully trained menace of founderless regions.

How does this impact noobs at all? Most new N/R/D players are not going around tagging. In fact, they're doing well if they even move while update is running, so the 2 second hiccup of a security check is not impacting them at all. If a new group does pop up that is tagging then they are likely already experienced, and hence know how to avoid the security check. You literally just have to refresh the page.

I take it you couldn't be bothered to read the multiple instances of me saying this doesn't actually impact tag raiding. To be frank, the players I've most often seen security checks impact are the boatloads of unskilled non-gameplayers that Unibot used to pull out of thin air at the last minute for liberation attempts. So maybe you're both right and I should drop this issue. Raiders usually grasp after being told once or twice how to avoid security checks; it's defender liberators who can't seem to get it.

[Sichuan Pepper]

Honesty Cormac it is difficult to take you seriously when you base most of your posts in an attempt to get an argument. Now I do not mind what or how you think of how I Defend. That is not what this thread is about.
Again I am saying security checks are not a problem for me, an active Defender.

[Unibot III]

I take it you couldn't be bothered to read the multiple instances of me saying this doesn't actually impact tag raiding. To be frank, the players I've most often seen security checks impact are the boatloads of unskilled non-gameplayers that Unibot used to pull out of thin air at the last minute for liberation attempts. So maybe you're both right and I should drop this issue. Raiders usually grasp after being told once or twice how to avoid security checks; it's defender liberators who can't seem to get it.

If Gameplay is expecting (i) defenders to fight extensive piling, (ii) every liberation participant to be experienced and well trained... I can tell you that it's about as likely to happen as me turning into a multicolored peacock. Mostly because of labour limitations. There's only so many people you can get for a mission.

These security checks often make a newbie liberator's first experience with R/D pretty non-eventful.

[Land filled with People]

I take it you couldn't be bothered to read the multiple instances of me saying this doesn't actually impact tag raiding. To be frank, the players I've most often seen security checks impact are the boatloads of unskilled non-gameplayers that Unibot used to pull out of thin air at the last minute for liberation attempts. So maybe you're both right and I should drop this issue. Raiders usually grasp after being told once or twice how to avoid security checks; it's defender liberators who can't seem to get it.

Once again. You have provided the solution yourself.

If people are running into this issue then there is a command, organisation,and planning problem.

There is a reason taggers don't run into this issue (and no, it is not experience).

There is a reason this has never been an issue for me, an active defender, even when I first started defending.

Once again. This is a non-issue.

[Le Petit Prince]

Hello, I am going to bump this again because I think it merits attention.

Cormac makes intelligent points, this is a problem, particularly for new players.

The views represented by those of us who do GP most actively (raiders and non-TITO defenders) confirms that this is a problem, again, particularly for new players.

It's an issue for technical because it is a case of the site saying, "You can do this" - Move Nation X To Region Y - Oh no wait, you actually can't do that, whoops!

That shouldn't happen, on a pure design level. A website shouldn't prompt you in a way that is going to lead to a confusing error in potentially critical situations, such as when you need to move into a target with an accuracy in the neighborhood of a few seconds.

It makes something that is already tricky for new players to handle more difficult, in a way that has nothing to do with the essentials around R/D but is essentially about making them deal with the site deceiving them into thinking they are about to do something and then throwing up an error message at the last second.

This is really about good design and the site communicating to new players in an accurate way, and the lack of this is why it is an issue for all sides of the spectrum who actively do GP.

[Consular]

I still do not see a problem. I always remind all my troops, both new and experienced, to refresh their pages just before jump time. It really is that simple. The inexperience of individual soldiers can be effectively mitigated by competent leadership.

[Le Petit Prince]

I still do not see a problem. I always remind all my troops, both new and experienced, to refresh their pages just before jump time. It really is that simple. The inexperience of individual soldiers can be effectively mitigated by competent leadership.

This is not a good argument. Anything can be managed, eventually, it is about what ought to be managed and what ought to be handled by the game.

Like I said, it is simply bad design to have a button that doesn't work.

Should we have endorsement buttons on all nations, most of which won't work, and then say, "Well, competent GP leadership could easily explain that away?"

Would you like it if the security checks applied to endorsements as well? Would you say for that, "Well, I will simply spend time instructing people to disregard what the site is communicating to them?" What if everything was tied to the localid, would that be enough for you to explain to people?

No, you shouldn't have to do that. Moving without the security check will not tip the scales of R/D in any direction, it will equalize it for all players by removing this bad element of a button saying "You can do X" and then not allowing you to do that.

That isn't something that anyone should have to spend time explaining, training troops in the actual craft of R/D is enough of a task. This isn't dumbing anything down, it is removing a bad design element that has no real purpose, and only serves to confuse new players and trip up old ones.

Tags and targets are not given well in advance, as Cormac noted. This would not make raiding easier, it would likely make liberations, of all things, more effective.

Most importantly, it would help active, interested new players - which are rare enough - not get discouraged by confusing, needless error messages.