EDIT: In light Sandy Hoey poiting this one out to me, I shall probably list the reason why I want this feature to be toggle so badly:

I live an extremely mobile lifestyle, which results in constantly changing location and IP. This may result in several verifications PER DAY. More importantly, I also rely mostly on cyber-cafes to game. Which means I very rarely use the same computer twice to game. Again, it may result in several verifications per day. Sure, each verification only takes from 30 seconds up to 2 minutes depending on connection speed. But keep in mind, that those 30 second to 2 minutes are part of playing time that I actually pay for, with real money to game. Now stack 30 seconds up to 2 minutes, up to times 20 per month if you game at a cyber cafe 20 times a month. That's 600 up to 2400 seconds, of paid for gaming time, wasted on verification, per month. That's up to 40 minutes. And that is with only 20 verifications. If you play every day, and maybe even several times a day on weekends, that can go up to 40+ verifications per month. That's from 1200 up to 4800 seconds of paid for game time wasted in paid for game time. That's right. From 20 minutes, up to a hour and 20 minutes lost to verification, a month. Now multiply per 12 to have the figure for a year. That's up to 16 hours. Let's take my case as an example even further. I've been playing osu for a minimum of 5 years. Maybe even 6 at this point. Let's take 5 years. That'll make a total of 80 hours. If you pay for your gaming time on a per hour basis, as with a lot of internet cafes, that's 80 hours one will pay for, JUST for verification. That it is roughly 72000 times that I will need to verify my account (calculations were made assuming 40 verifications per month and that each month has 30 days). That is a lot of money lost for a security feature which I don't even need in the first place because I have never failed to secure my account without it, not once.



So hear this one out.

See this account verification security feature? The one which requires you to constantly login to your e-mail everytime you change location or computer? It needs to either be completely gone and be togglable. Why might you ask? Hear me out:

1. It's not as effective as other, more practical safety measures.

Having the user to constantly verify their account is a hassle. A hassle in a game which is supposed to be easy to install and play right off the bat. And it's strategically unsound: it wastes the player's time when everything is fine, the player is in possession of their account, playing safely, yet they still to have waste time by verifying. Why not have the player needing to verify and contact support only when something is wrong? I.e. when the password is forgotten, when there is evidence of account sharing or when someone steals/scams the account away.


2. It does not prevent account sharing.

If this security feature has been implemented as a deterrent to account sharing then ... It's utterly pointless. An account can be shared as easily as creating a dummy e-mail, then give the password to said e-mail to anybody who the user wants to share with. Sure, now the share-user has to write down two passwords on a paper instead of one, but they still will have access to the account just as easily as they used to.


3. It's does not increase safety.

It's much easier for a hacker to break into an e-mail address than into osu. Matter of fact, it's as easy as breaking into the e-mail and then requesting a new password from osu. They don't even need to break into osu. More importantly, do you really think that just because you warn users to not have the same password on their e-mail and on osu, doesn't means that they will actually do it. The increase in security is minimal.


4. Osu! is not a swiss bank.

You know steam, right? That platform on which some players have accounts worth way beyond a few thousand dollars? Yep, them. They have a similar account verification process. And guess what? It can be disabled for user convenience. That's right. Accounts which can be worth several thousand dollars can have security features not wanted by the users turned off for user convenience. Now if we try to figure out why in the world is this account verification mandatory with osu!, we're at an impasse. The most expensive thing that hackers can "steal" from an osu! account is subscription time. And even then, more often than not, the user will get their account back before said supporter time runs out. Hell, even stats are not as important. Steam collects stats on games which are played into world game championships. Several of these games. And they STILL allows the verification to be turned off. What is it so precious that osu! has to guard to limit player convenience in such a dramatic way?


5. Convenience.

That is EXTREMELY important. I'll take my own case as example, but I'm sure I'm not the only one in such a situation. I often play osu on different computers or at different locations, including internet cafes. Sometimes I pay just for 30 minutes of computer usage. If I have to authorize, every time I change computers, not only it becomes extremely annoying, time wasting and repetitive, but it also stacks up as wasting my paid for game time. Verifying can take anywhere between 30 seconds up to 2 minutes depending on connection speed. Stack this up a couple dozen times for each time you have to verify, and you'll get a LOT of time lost because of a forced, unwanted security feature.


6. Promoting account fraud.

Now this one is blatant. This security feature is actually counterproductive to what the osu! team has been trying to achieve for so long, and that's the one-account policy. Because of this poorly implemented, mandatory, crude and over-zealous security feature, I now can't play the game with friends online. At all. I have to wait through a lengthy support process, I have to write into forums and waste everybody's time, including mine and yours. Now I do this because I have an issue with bending the rules. But the first though that came into my mind? Here, I'll quote it:

"I just came from a hard night of work, at 1 in the morning and I want to have fun and relax with my friends. But because of a draconian and useless security feature, I can't access my account. Well, I just want to make a new one". Yup. That's right. Now I didn't do this and instead prefer to talk it out with you guys. But how many people actually did this, because YOU pushed them to it with an unwanted, unsafe, poorly implemented, repetitive and annoying safety feature? ... Think about it.


Here are just a few reasons for which I want to see this feature permanently gone, or at least to see a switch somewhere in our profiles where we can easily disable this crude, laughable initiative at security which, frankly, fell flat on it's face. I'm sure the community may find even more reasons and flaws in this feature.

/discuss

EDIT:

Reason #7: No need for handholding

If this forced security feature has been introduced to legitimately battle people losing access to their accounts ... I would like to actually see some study done to see how much people did have their accounts stolen. In percentage. In ... I don't even remember ... 5? 6 years? ... In all this time, I never once have lost my account or had it stolen. Not. Once. I'm sure many people here are in the same situation. In fact. I'm sure the VAST MAJORITY of players never once had their accounts stolen. Without this useless feature. Why? Because many players are aware of their actions and can already maintain their accounts safe without forced security feature which hold their hands. Why force this majority of players into extra hassle for extra security they don't need? To be honest, it's a little insulting to me that the osu! team implies that I'm too stupid to ensure my account safety without a draconian, obligatory safety feature ...

You put a lot of effort in to being lazy.

Naturally these security measures wont do you any good if you don't use them effectively.
I've got two step authentication on my email as well, it's very unlikely to get stolen unless somebody gets hold of my phone, which is not happening.

As such I've effectively got phone authentication on my account on here as well, making it pretty secured even if somebody gets hold of my password. *

• 1. Preventing account theft is not really a waste of the users time.
  Having staff dealing with people forgetting their passwords or losing their accounts when given plenty of options to secure them looks to me like a huge waste of time.
  
  2. Pretty sure it's not supposed to prevent account sharing. Fairly certain there are other measures in place to combat this.
  
  3. *
  
  4. As unimportant as my account may be, I still wouldn't want it stolen.
  
  5. This is just you being lazy and/or not using it effectively. In the year of 2016 do you yet still not have a phone capable of reading emails?
  
  6. Isn't supposed to combat multi-accounting either. Fairly certain there are other measures in place to combat this.
  
  7. There has been a few cases of people (me included) getting their accounts stolen.

A toggle off button can exist but in reality it's not as big of a deal as you make it out to be. If used correctly it will do you more good than harm.

You just got a reply on your other unnecessarily long post on the help forums from Peppy himself. Sorry bud, better learn to use an email

boat wrote:

You put a lot of effort in to being lazy.

Naturally these security measures wont do you any good if you don't use them effectively.
I've got two step authentication on my email as well, it's very unlikely to get stolen unless somebody gets hold of my phone, which is not happening.

As such I've effectively got phone authentication on my account on here as well, making it pretty secured even if somebody gets hold of my password. *

• 1. Preventing account theft is not really a waste of the users time.
  Having staff dealing with people forgetting their passwords or losing their accounts when given plenty of options to secure them looks to me like a huge waste of time.
  
  2. Pretty sure it's not supposed to prevent account sharing. Fairly certain there are other measures in place to combat this.
  
  3. *
  
  4. As unimportant as my account may be, I still wouldn't want it stolen.
  
  5. This is just you being lazy and/or not using it effectively. In the year of 2016 do you yet still not have a phone capable of reading emails?
  
  6. Isn't supposed to combat multi-accounting either. Fairly certain there are other measures in place to combat this.
  
  7. There has been a few cases of people (me included) getting their accounts stolen.

A toggle off button can exist but in reality it's not as big of a deal as you make it out to be. If used correctly it will do you more good than harm.

1. It is a waste of time if the users are smart enough to keep their account safe on their own and don't want or need the feature.

2. Whew, that's a relief.

3. ?

4. Then why not be more careful with your passwords? More importantly, just because the feature is useful for you, why force it on others?

5. It's exactly that. Not only do I not have a smartphone, I do not have a phone WHATSOEVER. Because surprise, not everybody has the means for it. And now that you have talked about laziness. How hard is it to put a simple checkbox toggle into user profiles to enable disabling of an unwanted, un-needed and obnoxious security feature which disables the need for verification? Hint: not hard at all. You don't even need to be any good at scripting, some HTML and there you go, you have your toggle. All you need to do next is merely have that toggle ignore whatever script forces the verification. You don't need to write an entire script to disable the feature. Not implementing the toggle in the first place is lazy. Not wanting to do upwards of 20 verifications a month, is wanting more convenience. Surely, there is a difference.

6. A relief, as well.

7. There are also cases of people who are irresponsible enough to shoot themselves with their own gun due to forgetting to use their safety. But again, just because a few users are irresponsible enough to lose their accounts, must these security features for these irresponsible people be forced on everybody? Especially on users who have managed to keep their accounts perfectly secure without changing their password even once? All because they are responsible enough to not need handholding?

wouldn't verifying your account be easier than making a second account? JS

Kibbleru wrote:

wouldn't verifying your account be easier than making a second account? JS

You know, to be honest I'm starting to think he just wants to steal someone else's account. lol. Seems like a lot of work to just click a link on your email
jk jk

Kibbleru wrote:

wouldn't verifying your account be easier than making a second account? JS

It is. Except when you don't upkeep your e-mail. And having a toggle to disable the verification once, is even easier than having to do upwards of 20 verifications a month if you primarily play out of internet cafes. Why such a toggle has not been implemented is beyond me.

CFW Magic wrote:

Kibbleru wrote:

wouldn't verifying your account be easier than making a second account? JS

It is. Except when you don't upkeep your e-mail. And having a toggle to disable the verification once, is even easier than having to do upwards of 20 verifications a month if you primarily play out of internet cafes. Why such a toggle has not been implemented is beyond me.

i suppose, in your situation, it would be rather useful.

CFW Magic wrote:

Why such a toggle has not been implemented is beyond me.

I think the main reason it hasn't been implemented is because your scenario is so unique that it hasn't been brought up before. I can see how that would be annoying, but it is still a measure of security that can save accounts from being taken.
I think a lot of time could have been saved if you just wrote that in the OP instead of all that other stuff

lol @ the gun analogy, yeah gun laws are totally not a thing.

You need this feature in order to properly secure your account and the staff needs this feature to not have to deal with peoples accounts getting stolen.
Preventative measures are not a waste of time when they save a lot of it in the long run. The feature is useful to everyone if they put a minute or two in to setting it up correctly, and if you don't then you're the one wasting everyones time including your own.

You don't need a high end phone to be able to check your email on it. You could probably just skip going to internet cafés once a month and be able to pay for a plan with a decent phone.

CFW Magic wrote:

4. Then why not be more careful with your passwords?

Nothing wrong with my passwords, but security breaches happen. Two step authentication is a solid way to prevent problems.

CFW Magic wrote:

Wouldn't it be fair to let the users sacrifice their security for convenience, especially if they know what they are doing?

This would mean trading off the convenience of the staff so you can be lazy. Not particularly fair.

Sandy Hoey wrote:

CFW Magic wrote:

Why such a toggle has not been implemented is beyond me.

I think the main reason it hasn't been implemented is because your scenario is so unique that it hasn't been brought up before. I can see how that would be annoying, but it is still a measure of security that can save accounts from being taken.
I think a lot of time could have been saved if you just wrote that in the OP instead of all that other stuff

I don't disagree that this security feature can indeed be useful, especially for users who genuinely have issues to keep their accounts secure. That is true. I'm not saying that it should be completely removed, it won't be anyway and I got over that. But why not toggle it? I mean, after all, if the user wants to remove it and understand the consequences, why still force them to go through this verification process? And if you want the used to be absolutely aware of their security, why not have the user to read and agree to terms which would claim that shall the user chose to disable this feature, they are the sole responsible for their security and as such security support will not be provided shall the account be stolen. Wouldn't it be fair to let the users sacrifice their security for convenience, especially if they know what they are doing?

EDIT: Good point. Added the precise explanation of my situation in OP.


@ Boat > Again, you seem to misunderstand my statement. This security feature is particularly useless in MY case, since I have kept my account secure for years. I never said that this feature is useless for those irresponsible users who can't keep their accounts secure, or those unlucky users who have no idea how to periodically maintain their computer safety to avoid possible viruses, keyloggers e.t.c.

But once more, why is this feature mandatory? It may not be a waste of time in everybody's case, but it is a waste of time in my case in more ways than one. Not only it literally wastes my time, as I often play out of internet cafes and thus switch computers often enough to have to verify each time, thus losing valuable playing time that I bought with REAL money. But it also wastes my time because I'm confident enough with security to not need a forced preventative measure. My account hasn't been stolen or lost once. This feature has zero use for me, as I simply do not get my accounts stolen or lost.

More importantly ... Are you seriously telling me to invest into a phone just to play osu? I don't need a phone. Whatsoever. At all. I don't have any money to waste for a smartphone either, even a low end one. More importantly, having a phone is a breach to my security and privacy, as government agencies here in France use these same phones to possibly track the user's location. Having a phone is a breach in security I can not allow myself to have.

EDIT: Have you failed to read my statement? The user disabling the feature would have to ready and accept terms which would claim that the staff hold no responsibility over accounts which disable the security feature and will not recover or assist the users with the feature disabled in any way. How would be the convenience of the staff be impeded, if they will not be recovering an account which is lost if it's verification feature is not enabled? The security staff wouldn't have to lift a finger. Or are you talking about the convenience of the programming staff who wouldn't have to implement a simplistic checkbox into the user profile? If the programming team is incapable of this, I will gladly write this simple checkbox myself in HTML and present the staff with it. Again, how is it an inconvenience, if the user explicitly acknowledges full responsibility and renounces the right to security support by disabling the feature?

Oh I see what's going on here, sorry, I did not notice the tinfoil hat.

I'm done here lmao

boat wrote:

Oh I see what's going on here, sorry, I did not notice the tinfoil hat.

I'm done here lmao

Pleased to see you go. I'm sorry that I faced you with too many valid arguments such as this one:

"The user disabling the feature would have to ready and accept terms which would claim that the staff hold no responsibility over accounts which disable the security feature and will not recover or assist the users with the feature disabled in any way. How would be the convenience of the staff be impeded, if they will not be recovering an account which is lost if it's verification feature is not enabled? The security staff wouldn't have to lift a finger. Or are you talking about the convenience of the programming staff who wouldn't have to implement a simplistic checkbox into the user profile? If the programming team is incapable of this, I will gladly write this simple checkbox myself in HTML and present the staff with it. Again, how is it an inconvenience, if the user explicitly acknowledges full responsibility and renounces the right to security support by disabling the feature?"

And that you had to resort to aim for my privacy preferences instead of responding with a constructive argument. As for tinfoil hats ... I'm also pleased to see that you are the kind of people who enjoys talking without knowing. Not only you do not live in France and are not aware of recent political and law events, but you also seem to believe you know it all. Please, inform yourself on latest developpements before making uneducated assumptions. Recent French emergency laws EXPLICITLY allow french law enforcement to go through your phones, plant bugging software on your cars, examine your social network activity and more. All of it without the authorization of a a judge. Do you even realize what kind of implications this is? It basically means that the law enforcement organizations can arbitrary have anybody spied upon, so long as they pull the excuse of "terrorist suspicions". Of course, you never knew any of this and I can't blame you for it, but must you talk and judge without knowing? Anyway, this is going off topic. Please feel free to come back and talk again, once you have an informed, educated and constructive opinion.

Here's a little example of actual information on French surveillance law, just to point out how quick you were to make an uneducated judgement about "tinfoil hats": http://www.recode.net/2015/11/14/116206 ... llance-law

peppy wrote:

Sorry but this isn't up for discussion. It should only take around 20 seconds per new PC to complete verification, so I'm going to have to ask that you just deal with it. Do note that verification is only required under certain circumstances, for instance when you are attempting to change account settings. It is designed to be as non-intrusive as possible.

peppy wrote:

It's preventing bad things happening. It's called being cautious. It's present on most other services, including google, steam, facebook, microsoft accounts, apple to name a few.

It is not toggleable because users will turn it off without realising the implications and then bad things will happen. Recently there have been hundreds of accounts compromised each week due to people sharing passwords between services or using weak passwords in the first place. Adding one more step ensures that we aren't just relying on passwords any more.

Conversation thread: t/487371