Change password?

I was browsing my profile the other day and accidentally pressed "Reset password" (I thought it was going to offer me the chance to enter a new one). Without warning, my old password (which I had entered at some stage) was wiped and now I can't find where to set it!

How do you set your OWN password?

You don't set your own password. LG sends your new password to the e-mail address it has for you.

Thanks for the reply. I know you are not responsible, but I have your ear, so here goes...this is bs! when I joined LG over 9 yrs ago, I was able to set my own password. It was the same password I used on several games websites. Now, due to a single accidental click, LG have wiped out my password WITHOUT WARNING and I can't it back.

When was this ridiculous functionality implemented and why is this not a bigger deal for the players here?

It's already been like that when i registered here a year ago and I also thought it's quite stupid. It even kept me from playing here until someone else convinced me to... I don't wanna know how many newcomers turned littlegolem the back because of it. :o

Probably your password is in this format: babababa, where b is a consonant and a is a vowel.

Number of possible passwords: 20^4 * 6^4 = 207.360.000 (not so many!!!)

The ability to set your own password was definitely available on LG when I joined 9 years ago. Reading various articles by Googling this, it seems players have started to complain about passwords on LG from around 2010. This suggests that the functionality was removed around that time. I can only assume it was either the result of a technical upgrade that made it difficult to set own passwords (and the developers never got around to fixing it) or it was an accidental blunder.

The ability to set your own password is a must-have bit of functionality. I play on several games websites and use the same password to log in (modified slightly with site-specific meta-data). Having a website which has an incongruous password system is frustrating. I am reluctant to do so, because I love LG, but I will stop playing here if this is not resolved. I have already withdrawn from all tournaments so that only my existing games can wind down and no new ones will start.

If anyone who runs LG is listening, please provide this functionality soon or at least provide an estimate of when the development team can provide this functionality. At the very, very least (and this is a trivial change to your javescript) at least ask the user to confirm that their current password will be wiped and replaced by a random one, are they happy to continue!

Thanks!

As they say, "you get what you pay for".

In other words, I assume Richard is more likely to react
to suggestions made by "LG members".

I guess there is no development team to which you can ask for developing features, as a long time user of LG you surely know that.

I never enter my password in LG as I use cookies.

Otherwise, I would say it is not so good a habit to use modified versions of the same password on different sites and to proclaim this on the internet. There are many solutions of password wallets for which you just need to remember a master password (or note it down): Gpassword Manager, KeePass, LastPass... (not affiliated to any of them).

This absurd password policy has been complained about in some other forum thread also.

It's bad that you can't set your own password.

It's bad that the system emails a generated password to you in plainly readable text.

It's bad that the generated passwords have such a weak form.

Oh well. I still enjoy playing games here...

(And I second the recommendation for a password manager; I'm quite happy with KeePassX.)

@Johannes Waldmann: Not being a member does not preclude you from making sensible and/or desirable suggestions. If your opinion is that being able to enter your own password is an undesirable feature, then state that opinion more plainly. LG members operate under the same absurd password policy.

@Carroll: The fact that they new games are being periodically introduced (for example, recently Shogi was added) suggests that there must be a development team, which leaves me puzzled by your comment. It is not true that I "surely know that".

@Russ Williams: Agree with all you say. Its entirely likely that passwords on LG are not stored encrypted with salt anyway. The passwords to LG accounts are not of high value to hackers which is certainly the biggest plus in their security! I will look into KeePass, thanks for the suggestion. How does it work? Is it something you launch when you want to enter a site or is it something that runs always in the background?

@alain Carrolli implies that the development team is one man, Richard himself and that old-time users of the site know this - at least if they followed the forums regularly.

In fact I meant it not the way LG works, you can always ask highly desirable things to Richard, but usually Richard does what pleases him most, new games. And most of the times it is an enjoyable experience for us users.

For the question about password managers, for LastPass at least, the is a plugin you install in your favorite web-browser, you set your highly secure master password once, he grabs all the passwords your browser knows, and then when there is a site with a form, he may automatically fill in your name, social security number, password...

All this is stored on an encrypted (with master password) file on your laptop, phone, tablet... but also at the same time on the servers of LastPass, so that if you lose your hardisk you don't end up being locked out of all your accounts.

I think I discovered an attack which would make account hijacking theoretically possible. The methods used are not necessarily reproduceable now, but it's entirely possible that this site-selects-a-password-for-you policy was introduced to combat such attacks. (The attack would change your password to what the *hacker* wanted.)

alain: managers like KeePassX are a locally run program and locally stored database (unlike LastPass which is also a webservice storing your database on their site). You can use as long/strong a master password (to open your database) as you like, and set how long it stays open until closing (e.g. 5 minutes, an hour, whatever policy you want) and how resistant it will be to brute force (by how many iterations the encryption goes, i.e. how long it takes to test if an entered master password is valid) and also can specify a local file (of arbitrary length) which is used as part of the key (so that an attacker who e.g. gets an archived copy of your database on another machine and knows your password somehow still doesn't know what file is needed to open your database). If you want access to your password database on multiple machines, then you would need to be responsible for propagating it to those other machines in whatever manner you like.

I keep my password on a Post It Note on my monitor. Not very high tech but it does work.

@FatPhil: The only security advantage I can see for we-choose-the-password policy is when the end-user has, unknown to them, a keylogger or similar installed (and perhaps that is the basis for your password-substitution suggestion?) If that were the case, though, the end-user has bigger problems!

There are two fundamental problems I have with the system here and one lesser problem:
1) The password is reset WITHOUT WARNING. I cannot believe this is not a trivial fix. As an professional Delphi/C++/C# developer, I am sure this is not hard in javascript.
2) Its entirely possible that the email address you originally signed up with is now obsolete. This was the case with me until very recently. I do not rely on email notifications from LG as I log in regularly, and as I had signed up years ago the original email had slowly become clogged with spam and abandoned and I had forgotten to update the email. Ok, so now the user clicks the reset password button, perhaps accidentally, and without warning...BAM! they've lost their account forever!

In my opinion, the above two issues are largely addressed simply by warning the user of the consequences and asking if they are sure.

The lesser problem is one of convenience. Almost every other website lets me choose my password. Forcing a random selection of hard-to-remember letters on me, and then sent in plaintext, is annoying. And, yes, I have now learnt about KeePass and other programs like that so at least I've learnt something interesting from this.

@Russ: Thanks!

@alain
I understand. It happened to me also, but I can live with it (I had to change it a few times until I had one I can remember).

Have you tried messaging Richard directly about the issue ?
I am a 100% sure that Richard is capable of changing the password system in every possible way. I am also sure that he will not express or debate his views on the subject in the forum. But he reads forums and makes very sudden changes always without any warnings ever...

Anyway, if you send him a message directly he might not answer it at all, but, if this is your request, he will possibly very quietly reset the password to the value you would be asking for. I would try it!

------
@the rest of LG
Is it just me or do I really sound like a believer of some obscure religion. "Do not try to understand. He will answer your prayers ! But with in unexpected ways..." :)

@bennok: Thanks, I have emailed Richard directly (even asking him to please reset my password!) but no response yet...

Reminder to everyone to keep their email address up-to-date. A bit of overly late-night gaming and one accidental click and your account is gone!

In the beginning I was annoyed, but now I don't care anymore. I only have to enter it when playing from somewhere else and I even learned it.

Yeah, I'm getting used to it as well, surprising to say. Still think this has to be changed - you can lose your account forever with one accidental click, without warning.

You don't lose your account, you just get a new password. Or am I misunderstanding?

Alain mentioned that under these conditions you can lose your account:
- The password is reset without warning.
- The email address you originally signed up with is obsolete.

This happened to me ( Robin). I had to create a new account.

@romei: Thanks, that's exactly right.

This nearly happened to me. I was looking at my profile and noted my email was *way* out of date. It didn't matter as I don't rely on any notifications. I quite liked not having the right email as a spam-preventer anyway. For the sake of completeness, I happened to update the email address (in hindsight, I'm not sure why, it was just lucky as it turned out!). After doing that, I was curious if I could strengthen my password as I've done at several sites eg. "My123PasswordSITE1" for website 1 and "My123PasswordSITE2" for website 2. If that is not clear you use one strong password for all sites, but add some site-specific meta-data at the end to make it different for each site.

Note that at this point I was NOT aware, as others implied I should have been (why?), that the LG functionality had changed - I had definitely set my own password years before. So I clicked the password button, and without warning, it was reset! If I hadn't updated my obsolete email account a few seconds before, my account would be lost forever!

This is a serious flaw. To a large degree it is addressed by simply warning the user of the consequences and getting their confirmation before resetting the password. Ultimately, though, you've got to let users set their own password (and then encrypt them with salt).

I'm with Richard on this issue. Choosing users' passwords can only increase the strength of the weakest passwords. Richard doesn't have to worry about, say, spammers discovering a weak password.

Is it possible to change your email after clicking change password?
If you aren't logged out by clicking change password, then it would presumably be possible to update the email address on the user data page and click change password again.

"Choosing users' passwords can only increase the strength of the weakest passwords."

But so letting users set their own passwords, and having the system reject weak passwords, forcing users to pick a stronger password.

Anyway, the current CVCVCVCV scheme does not create very strong passwords. Many users would pick stronger passwords than that.

And sending passwords to the users in plaintext email is not strong either.

@MarleysGhost: Relying on the LG password-generator is unlikely to be better than getting users' to enter their own. If that were the case, more than only LG (of all the dozens of websites I use) would use such a system. If password strength is a concern, just do what many websites do and have a "password-strength" indicator and encourage / enforce users entering stronger passwords. If the user insists on entering a weak password (and LG doesn't enforce strong passwords), that's their business, not yours or LGs'. The password LG generated for me (again, without warning) is much weaker than the one it replaced.

Maybe LG should auto-generate a super-strong randomised length=255 password using all characters in the ASCII(32-127) range...and do it without warning for all users at midnight CET tonight...and email the password to their on-record email. Who'd support that???

@kingofthebesI: You might be right, not sure. If you didn't realise the consequence of clicking the password button (or didn't spot that the email was obsolete or your browser crashed or ) then it is possible to lose your account forever after one click.

This is not "secure", its flawed. As Russ points out, quite apart from relying on LG's relatively weak password-generator, the password is sent in plain text to a (possibly obsolete) email.

I just read romei's warning, and I realized my email has changed, so I submitted my new email here, and my password was reset without warning. Good thing I typed my email in correctly!

I use LastPass, a plugin for Firefox and Chrome which can automatically generate random passwords as long as I like. I can tell LastPass to remember this new password for me, and hopefully there will be no problem. I haven't paid my membership in a long time, so I humbly submit to the will of he who controls the horizontal.

I renewed my membership on Aug. 13. At that time, I sent a message to Richard Malaschitz (the webmaster). As of today, that message has not been read! (if you click on "messages" in the main menu, then click on "Sent" you can see which messages have been read). Maybe his development team is on Sabbatical...

@Ray: Just checked and a message to Richard on 23/09/13 (and then a few later ones about this password problem) has not been read. That's not as old as your unread message though!

Happened to me and now I have a MUCH weaker password than what I created before.

I use random passwords for everything and, even then, I change them every so often.