1

Mobile games typically have lots of users that take multi-month (or year) breaks and come back much later when they've heard about an update to the game or have a nostalgic urge to come back.

Typically the way games work is that you start the app and can immediately start playing. The idea is to prevent any friction at the beginning of the gaming process. However, it also means that you don't know much of anything about the account other than the device they played on and what they've done in the game; no emails and no account creation process to capture personal information.

There typically needs to be a support process for getting back accounts as you might have spent hundreds of hours (or more) playing your accounts. This can be after years of inactivity and the user might have moved to a different country. Switched from Android to iOS etc.

The question is: What sort of ideas are there to recover accounts in such a setting without being vulnerable to social engineering?

Some people sell their high-level accounts and then work with tech support to "get the account back", thereby defrauding the purchaser.

From a purely information theoretical standpoint, you would have to be able to ask something that only the original owner could know as well as something with enough entropy that it's difficult to guess while remaining possible to remember.

10
  • This is part of why e.g. Apple created Game Center, so games can survive device resets and updates as no one has collected any data. It doesn't help though if someone switches from iOS to Android or vice versa.
    – eof
    Oct 24, 2022 at 14:08
  • Then use OAuth2.0 with one of the big boys like Apple accounts etc? But you still need an account, you want a random identifier or what exactly? Oct 24, 2022 at 16:03
  • Most devs use Game Center or Google Play, but people still lose their accounts. The problem is that most games fail and can't afford to put any registration obstacles whatsoever. Once they succeed, they suddenly notice that they have millions of accounts and know nothing about them. This is what I'm asking about. It's a very hard problem and I was hoping that there are folks on this site that has actually grappled with it. I've never seen any company external useful material. Everyone assumes you first register like with every web service.
    – eof
    Oct 24, 2022 at 16:06
  • Yes, I get that part, but if I want to transfer my 'account' to a new device, what does tech support do?
    – schroeder
    Oct 24, 2022 at 16:10
  • An example would be asking for some device code from the previous device. Problems arise when you lost your old one.
    – eof
    Oct 24, 2022 at 16:11

4 Answers 4

1

With a topic like account recovery, you are opposing two things: On one hand, you want to ensure availability for your customer, on the other hand, you want to ensure confidentiality of the account.

There will be situations, in which you as a system designer have to prioritize one over the other. Specifically, if a customer is in a situation, where they have lost access to the account, but cannot sufficiently prove that it is indeed their account. You either risk locking them out of their account, or risk giving unauthorized third party access to the account.


Before implementing such a system, it's helpful to write down goals and implicit assumptions about the authentication system:

  • New users should have as little friction as possible.
  • Users should be able to recover access to an account, even if the original device is no longer available (lost, stolen, broken, etc.)
  • Users may not want to use third-party services for authentication
  • Users may not be very technically adept

There are several ways such systems are implemented in the real world. One very common example is that users initially are tied to some device ID, so they can simply start playing. Let's call such users guests. A guest may not even be aware that they have created an "account", which is good for non-technical users.

Guests should then be told to register a "proper" account, in case they lose access to their device. This could be as simple as an e-mail address, to which a one-time link is sent. They click the link, confirm ownership of the e-mail and now they have a proper account registered to the user. To register a new device, merely entering the e-mail address is enough. A one-time link is sent again, which confirms that the user has access to the e-mail address.

The upside of this scheme is that it's very easy to use. It requires very little technical knowledge aside from "What is my e-mail address?" (which admittedly can be a challenge for older users). The downside is, that access to the e-mail address is indeed the only then authenticating the user. No password, no second factor, etc... This would indeed make it easier for people to impersonate the real user and claim they have lost access too their e-mail account. (I personally had a similar thing happen once, where I forgot which e-mail address I used for signing up, and in the end support would let me transfer the e-mail address of that account to one of my e-mail addresses. This could have caused me to lose access to my account if it had been an attacker).

It also has an additional characteristic of offloading the responsibility of account access to the user. Didn't sign up properly and lost access to your device? Too bad! This would swing the other way, leading to disgruntled users not getting their accounts back. As I said before, you really have to pick your poison here.


For more technically apt users, you can also allow setting a password, setting a second factor (SMS, TOTP app, FIDO2 key, etc.). While this increases complexity on your side, it has the advantage of enabling technically apt users to secure their account from third-party access. (And making it more likely they lose access to one of their factors).

In order to prevent social engineering, you can also ask users questions about their account, which they should be able to answer:

  • When did you last play?
  • What device did you play on?
  • How often did you play?
  • Who is your most-used character?
  • When did you last spend money on the game? If so, can you send us a receipt of that purchase?

For example, I would be able to answer you all these questions for a mobile game I am playing. For an attacker, however, these would be quite difficult to answer.

An exception to this is streamers, who stream most of their gameplay. As their viewers would of course see when they would play, how they would play, etc... Although in such a case, support may have good ways to deal with people trying to steal "popular" accounts.

Other Authentication Schemes

For the sake of completeness, I'd like to discuss some other authentication schemes I have come across:

  • Guest Account Only (Device ID bound)

    There is no way for users to "register". Their account is tied to their device and if they lose access to the device, they lose access to the account. Not ideal, but I thought I should mention it.

  • Guest Account Only (File-based)

    Similar to the above, but the "ID" is written to a file on the device. It could be a private key, but most likely it's just a really long random string. By backing up that file, users back up their identity. While this "works", it is basically impossible for non-technical users. Your users are also only one oopsie away from permanently losing account access if they don't back up their accounts.

  • Username + Password Sign-Up

    The classic username+password combination. It's widely understood by the vast majority of users. Pick a username, pick a password and optionally enter an e-mail address in case you forget your password. The advantage is that most users understand how that works, but with the downside of people generally picking really bad passwords. Like, how often do you think the name of the game will be used as password? A lot.

  • "Transfer Code" + Password

    Very popular in certain Japanese gacha games, users receive a "transfer code" upon request. A random string looking like BF62-HS01-GG52-OP87, together with a password set by the user. The idea is that users keep that transfer code safe (writing it down or more likely sending it to themselves via e-mail) and if they need to access the game on a new device, they enter that code and their password. For the developers, this works, because it's minimal overhead, while for users it's clunky and there's always the fear of what if you lose your transfer code?

  • Third-Party Authentication

    Also very popular in the mobile game sphere, authentication can just be offloaded onto the OS provider. For example, Google offers a "Sign in with Google Play" option on Android, and I am certain Apple offers something similar. It's very likely users will already have such an account, so authentication is rather easy. However, some users may be unwilling to connect any game to their Google or Apple account, so you may have some resistance from users.

Defrauding Account Sales

Most ToS explicitly forbid sales of accounts, so it's usually not in the best interest of developers to make account sales easy. In fact, the more dangerous for buyers it is, the less likely there is a market for game accounts. If anyone could easily defraud you, you likely won't spend money.

In Short

There is no silver bullet. You have to weigh account availability against confidentiality. You can offload some of that to your users by letting them decide how secure against third-party attacks they want to be.

Asking players for information only they should know could be a good idea against account theft.

0

It is a difficult to solve issue.

If users take a break, change their devices and lose all proofs that they own the said accounts (e.g. don't remember passwords, have lost long-lived auth tokens, can't answer security questions, don't have a recovery email/phone number etc) then there's literally no way to distinguish them from account highjackers.

You need at least one way to confirm that users requesting access to accounts are legit and in order to do this you need to use something that is established the first time the users create the accounts.

An easy way, although not bullet-proof, is to use a mobile phone number or email registered during the account creation so that you can send a recovery action message to them. The reason this is preferred is because people tend to keep their mobile phone numbers and email addresses for long periods of time (even years) due to the way many services in our societies depend on them.

However, since you don't use that (as you mention), another approach would be to ask users to enter a secret word at the beginning of their gameplays, so that you can establish the association between each player and the respective game, without actually depending on the device they use. Again, not bullet proof, but it works and is simple enough not to cause user bouncing.

0

You want to make the beginning as frictionless as possible, with the user able to start playing immediately, while allowing someone that spent hundreds of hours playing able to recover back their account.

So, the answer is, unsurprisingly, that you should set up that at some intermediate point.

I imagine the initial screen with some user information (username, points, 'recovery email (none)', some buttons to start playing or exchanging items...) from which they could easily set it up whenever they want. And then, after the user achieved more than X points / played for more than Y hours, I would remind them with a 33% probability whenever they open the application a warning that they have no recovery options set so they would lose access to the account should they lose their device.

They might still choose Not now dozens of times, and then lose access to the device, and to the game account with it, but that would be on them if they chose not to register a recovery email (or password, or other supported method).

0

One easy way that I've seen some developers use is having their own backend service that stores their save data to a server. Users can sign up using their email addresses. The user is simply sent an email asking them to click on a link to approve the creation of the account and they are all set.

When the user wants to access their game account on a different device, they just need to give their email address. If the email exists on the server, the server sends them a confirmation email asking to connect the new device to the service.

This way, you don't need to worry about password management. The only serious attack vector that's left open, assuming the server side is set up correctly, is if the player's email account is hacked and an attacker were to request an account deletion and then confirm it from the user's email account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .