Hacker News Reader

Comment by djsumdog | Hacker News Reader

To be fair, that's a game account. I realize some MMOs can have really real-money valuable characters/items, so this argument can break down, but the security should be different from an MMO and a VPS solution or a bank.

All of my security questions are passwords. I once had someone at a bank ask "Wait, your mother's maiden's name has a number in it?"

"Wait, you actually answer security questions that any of your friends can guess honestly?"

View on HN

Magic Online simulates paper Magic. You buy packs to get cards, each card is its own individual digital object which can be traded and sold, card sets go out of print or have limited runs, and rare promos are released. It even has its own digital currency, "tickets", which are reasonably easily converted to cash.

Magic Online accounts can be worth tens of thousands of dollars.

And at least back when I played, if your account got compromised and all your cards were liquidated, the response from customer support was pretty much "that's too bad, shouldn't have let your account get compromised". I seriously doubt they ever added 2FA or anything either.

> Magic Online accounts can be worth tens of thousands of dollars.

It might cost 10k+ dollars to make a behemoth account, but I don't think they are worth that much. It's basically fake internet points, I can gain these for free in this very comment.

No, you can get actual money for them.

Used to be easier when you could directly trade digital cards for paper cards..

You can depending on how recent they are.

> To be fair, that's a game account. I realize some MMOs can have really real-money valuable characters/items, so this argument can break down

You want to know how bad it can break down? I imagine the worst case scenario, for so many reasons, actually happened and was mtgox.com. It started out as a Magic: The Gathering Online Exchange (from what I understand) before it became the now infamous Bitcoin exchange that was hacked[1] and massive amounts of money was stolen. I don't know for a fact that old accounts before the pivot to Bitcoin still existed and worked, but it's not inconceivable that they would. One hopes they adopted much better security compared to when they were a trading card exchange (if it wasn't already exceptional at that time), but there could very well have been a time when it was gaining traction for financial type services but didn't have good account safeguards.

1: Or whatever. From what I remember that's a story convoluted and with enough conspiracy theories it's worth a movie.

MTGOX was purchased as a domain name for a possible MTG exchange, but it never went further than a domain name. There was never even a site.

Are you sure? Wikipedia[1] seems to indicate it at least got into a beta, but it also implies that the domain was what was reused for the bitcoin exchange, not the code base. That said, the references on wikipedia point to the Internet Archive, which shows a placeholder page that says it's in beta, but there's little there to indicate there was ever anything working. It also says it was used to advertise another card game later, but that was just a link to another domain.

I guess that's a long-winded way of saying you are probably right.

Then again, bitcoins were worth so little in 2010 that I could imagine the account security on exchanges back then being comparable to hobbiest exchange sites, so the spirit of the comment may be valid even if the specific example falls down. :/

1: https://en.wikipedia.org/wiki/Mt._Gox#Founding

Reply on news.ycombinator.com