1

Many games and websites have an explicit policy that the owner of the account is fully responsible for any and all activity from that account and therefore suspensions will not be shortened or removed even if the activity the account was suspended for had been perpetrated by a hacker while he had been illegitimately accessing the account. (Wikipedia is among important exceptions here, though).

This opens up an attack vector to pemanently strip the legitimate account owner of their account. If a hacker simply changes the password of the account, the account may still be reclaimed by its legitimate owner with the help of the site or game's support. However, if the hacker purposefuly perpetrates a serious violation of the site or game's ToS and consequently the account gets permabanned, then the account owner will never be able to use this account again. Apparently, this does happen in practice (example 1, example 2).

What I find perplexing is that these same games, who refuse to lift bans issued for hackers' misdeeds, still provide facilities for account recovery. They even encourage to contact support if the standard recovery facilities (e-mail) fail (example: this vs this).

Therefore, may I have two questions?

  1. Does the policy not to lift bans issued for hackers' behaviours arise from the difficulty of determining whether the account was indeed hacked?
  2. If the above is true, is it more difficult to determine whether the account was used by its legitimate owner on a given occasion than who is the legitimate owner and whether its current user is the legimitate owner (since support does trouble itself with account recovery)?

BTW: Since I used the case of LoL to provide examples: A disclaimer to keep my conscience clear of an accidental misrepresentation of facts: I have feeling that regardless of the official policies LoL support sometimes does lift such bans, though I'm not certain of that.

closed as off-topic by David, Eric G, CaffeineAddiction, Conor Mancone, Rory Alsop Jan 8 '18 at 21:38

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – David, Eric G, CaffeineAddiction, Conor Mancone, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm not sure why people are downvoting this question - this seem like a good match for the site! – Cowthulhu Jan 8 '18 at 20:44
  • 1
    It is closed because it is not a good fit for this site at all. Any answers to those two questions will depend on individual company policy, circumstances, or any number of factors. – Rory Alsop Jan 8 '18 at 21:38
3

Does the policy not to lift bans issued for hackers' behaviours arise from the difficulty of determining whether the account was indeed hacked?

Based on the log data a service like League of Legends is going to collect and store, it is impossible to distinguish between multiple users of a single account.

That's not the reason for the policy though. Policies like this get enacted because people like to externalize their problems and, more importantly, lie.

Someone guessed/obtained your password and used your account to test out hacks? Your negligence created problems for other players. The evidence suggests it was you. You can't prove it wasn't. You don't get to have an account if you can't be trusted to secure it.

With or without your consent, your say your brother used your account and went on a racist tirade in-game? That sucks, but damage was done. Even if you weren't the one doing it, you allowed it to happen, and there are consequences for this. You don't get to have an account if you're going to share it or leave it logged in on an unlocked workstation.

At the end of the day they're providing you credentials to their network to access a service they provide for commercial gain. If the provider determines you're more trouble than you're worth because your drama impacts their image or revenue, they're entirely within their rights to not let you participate. What's "fair" is not a factor in this equation. Justified or not, banning one problematic player costs less than giving them the chance to drive away other paying customers through cheating or spree trolling.

But these tales usually fall into one of two categories-- unverifiable or BS. Everybody lies. Cases like this or this or just about everything here are more indicative of what turns up when time is spent actually looking into it.

If the above is true, is it more difficult to determine whether the account was used by its legitimate owner on a given occasion than who is the legitimate owner and whether its current user is the legimitate owner (since support does trouble itself with account recovery)?

It is impossible to distinguish legit owners from imposters; that's why shared accounts are generally banned on networks. One can try to make some educated guesses at best but it's still weak evidence that is easily falsified (just use a VPN when you want to do some trolling so the geodata doesn't match your established history, then claim it was a hacker). More trouble than it's worth. The ban button is just one click away.

  • "Someone guessed/obtained your password and used your account to test out hacks? Your negligence created problems for other players. The evidence suggests it was you. You can't prove it wasn't. You don't get to have an account if you can't be trusted to secure it." While this is true, it should also be noted that ultimately it is impossible to 100% secure one's account and therefore, given enough time, the probability of getting hacked approaches 1. – gaazkam Jan 8 '18 at 20:44
  • @gaazkam While true, in practice there are many ways to mitigate this specific threat, including just changing your password once a year. Blizzard and Steam, possibly others, are also enabling/forcing 2FA as additional security so it's not the only factor considered. – Ivan Jan 8 '18 at 22:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.