Dual factor authentication for free trials?

[Slippa]

13 minutes ago, BIGNEWY said:

The team have decide 2FA is the best option currently. 

thank you

Christ. (Currently. I hope the team can come up with something less intrusive).

For what it’s worth, personally, I’d be ok with the email bounce.

thanks.

[Gianky]

Well, I guess that means no more free trials for me, after the two I started last week.

[Beirut]

7 hours ago, Gianky said:

Ditto.

 

 

On one hand I don't like it and I'm pretty sure it kills the free trials for me.

 

On the other hand the free trials themselves are very generous and I have enjoyed them a great deal while I was able to use them.

[Rudel_chw]

1 hour ago, Gianky said:

Well, I guess that means no more free trials for me,

 

yes, me neither, tough I have not been a big user of free-trial as I tend to purchase most modules during pre-release, the last aircraft I trialed was the MB.339. On my case, it won't be a big deal, but I feel sorry for newer users .. they will have to submit to 2FA or be left out of trials.

 

Honestly, I don't understand why ED is forcing this ... maybe they detected people creating multiple accounts to free-play all year long, who knows?

[Art-J]

7 minutes ago, Rudel_chw said:

Honestly, I don't understand why ED is forcing this ... maybe they detected people creating multiple accounts to free-play all year long, who knows?

^ I suspect that was the case. But if there are ways to get around 2FA without a phone number and with a payment which is still a fraction of DCS module cost, will this solution really work in the long run? I guess we'll all see, devs included.

[BIGNEWY]

47 minutes ago, Rudel_chw said:

Honestly, I don't understand why ED is forcing this

See my previous comments in this thread,  
 

Quote

Sadly some people abuse the system so measures had to be taken. As always a small group of people make things harder for others. But we want to keep the free trials going, its great for trying before you buy.

The team have decided 2FA is the best option. 

thank you

[Tom Kazansky]

43 minutes ago, Rudel_chw said:

maybe they detected people creating multiple accounts to free-play all year long, who knows?

That would make ED's move completely sensible.

Nothing good in the world without some guys making the worst of it.

My solution is to buy every module I'm interested in like I used to do it before free trials. Worked for me and ED I guess.

[Beirut]

1 hour ago, Rudel_chw said:

Honestly, I don't understand why ED is forcing this ... maybe they detected people creating multiple accounts to free-play all year long, who knows?

 

I would think it's mostly people who have bought few if any modules and mostly lurk on the forums. I can't imagine someone who is a serious DCS player getting into that sort of thing

 

It would be nice to just show the DCS guys my $1000 in payments on Steam for DCS modules and that would suffice. But if some people are being ***** are abusing the system and ruining it for everyone, what can you do, eh?

[NineLine]

I love 2FA, it's like a mini-game to get your code in before the app refreshes it

[Tom Kazansky]

19 minutes ago, Beirut said:

It would be nice to just show the DCS guys my $1000 in payments on Steam for DCS modules and that would suffice.

Would be cool if we could earn a state of trust.

[NineLine]

2 minutes ago, Tom Kazansky said:

Would be cool if we could earn a state of trust.

It's not about a lack of trust, it's about the world we live in where people will try and take advantage of things, its also about security, if you spent 1000 on DCS modules on the E-shop, then that is a huge investment that you should have extra protection on. I use 2FA on almost everything if it's available. 

[Tom Kazansky]

50 minutes ago, NineLine said:

It's not about a lack of trust, it's about the world we live in where people will try and take advantage of things, its also about security, if you spent 1000 on DCS modules on the E-shop, then that is a huge investment that you should have extra protection on. I use 2FA on almost everything if it's available. 

I did not want to say ED does not trust long-term customers but it would be cool if there was an exception to the 2FA rule for long-term customers with a certain amount of modules.

Don't get me wrong, I'm o.k. with ED's decision to protect their business.

[Beirut]

3 hours ago, NineLine said:

It's not about a lack of trust, it's about the world we live in where people will try and take advantage of things, its also about security, if you spent 1000 on DCS modules on the E-shop, then that is a huge investment that you should have extra protection on. I use 2FA on almost everything if it's available. 

 

I hear ya. I just hope you see the customer's point of view regarding hoops to jump through after already establishing ourselves as good clients. 

 

And for the umpteenth time, this is not a subject to be looked at in a vacuum. We can't legitimately discuss a new "problem" with the free trial system without also acknowledging that the free trials themselves have been a really great thing, especially the manner is which they were rolled out at the start of The Plague. 

 

No kidding. Five-Star! Round of applause! 

 

 

[Gianky]

6 hours ago, Beirut said:

 

On one hand I don't like it and I'm pretty sure it kills the free trials for me.

 

On the other hand the free trials themselves are very generous and I have enjoyed them a great deal while I was able to use them.

Well, Beirut, the free trial has been... sorry, is a good thing, but not only for the customers, even for ED.

I bought at least three modules because I was able to try them and I'm gonna add The Channel map (sadly, not the Apache, my system is not good enough to run it in VR... another time!), and if I wasn't able to try them, I'd probably never have bought them, since watching reviews and reading opinions on the forums is never going to be equal to the possibility of testing how that module actually runs on your system and if it get you excited or not.

If you think about it, it's nothing really new, there were plenty of demos years, decades ago; heck, Doom was a shareware, you could play, IIRC, the whole first episode for free and if you liked it, you just had to buy the rest of the game.

So, putting an added layer to the free trial is a pity for everyone involved, even for ED, which will probably loose some sale because of this.

All of this IMHO, of course.

[freehand]

Not read all the posts do I need an app on my phone ?

[Beirut]

15 minutes ago, Gianky said:

Well, Beirut, the free trial has been... sorry, is a good thing, but not only for the customers, even for ED.

I bought at least three modules because I was able to try them and I'm gonna add The Channel map (sadly, not the Apache, my system is not good enough to run it in VR... another time!), and if I wasn't able to try them, I'd probably never have bought them, since watching reviews and reading opinions on the forums is never going to be equal to the possibility of testing how that module actually runs on your system and if it get you excited or not.

If you think about it, it's nothing really new, there were plenty of demos years, decades ago; heck, Doom was a shareware, you could play, IIRC, the whole first episode for free and if you liked it, you just had to buy the rest of the game.

So, putting an added layer to the free trial is a pity for everyone involved, even for ED, which will probably loose some sale because of this.

All of this IMHO, of course.

 

Agreed. But if someone gives me a free cookie so I can decide if I want to buy a bag of them, that person is my new best friend. I like cookies, you see. 

 

I won't say the free trials are/were 100% altruistic, but I also don't care that they weren't. Having the free trials roll out as they did, just as The Plague was freaking everyone out and we were all hiding in the basements, was pure gold. You can call it this or that, but it was still pretty freaking cool. 

 

I don't like the new 2FA, but that doesn't take away from the past few years.

[Exorcet]

Just wanted to give some feedback as I am not a fan of needing a phone to do a simple task. If there is a chance for an alternative method for controlling the use of free trials I highly support ED in developing that alternative. Tying everything to a phone is a hassle and a security risk.

[Beirut]

11 minutes ago, Exorcet said:

Just wanted to give some feedback as I am not a fan of needing a phone to do a simple task. If there is a chance for an alternative method for controlling the use of free trials I highly support ED in developing that alternative. Tying everything to a phone is a hassle and a security risk.

 

The civvy sim locked my account for some god unknown/fabricated reason and said they needed my phone number for me to get back in. Much swearing followed. Very very much swearing. Great big steaming ******* clouds of it. 

 

This isn't for previously purchased products at least. That's a yuuuuge difference. 

[freehand]

lol Just another excuse to spread your digital foot print all over the place.

[NineLine]

6 hours ago, Beirut said:

I hear ya. I just hope you see the customer's point of view regarding hoops to jump through after already establishing ourselves as good clients. 

Once again, its more about security for all concerned rather than any sort of trust issue. 

[Gianky]

8 hours ago, Beirut said:

 

Agreed. But if someone gives me a free cookie so I can decide if I want to buy a bag of them, that person is my new best friend. I like cookies, you see. 

 

I won't say the free trials are/were 100% altruistic, but I also don't care that they weren't. Having the free trials roll out as they did, just as The Plague was freaking everyone out and we were all hiding in the basements, was pure gold. You can call it this or that, but it was still pretty freaking cool. 

 

I don't like the new 2FA, but that doesn't take away from the past few years.

Don't get me wrong, I appreciate the free trial and its first edition was a balsam, during lockdown (plus, the Harrier found home in my virtual hangar). I just pointed out that it was good for ED, too.

I'd love to keep using it, but the 2FA is a dealbreaker for me.

[actually_fred]

This 2FA does not require an external service; it just requires an app that can understand the QR codes. Some of the apps do have a service for backups etc, but some are entirely offline, with no communication between the app, ED, or anything else on the internet.

It's basically doing:

- QR code contains some random data that ED save, and is unique to you
- app also saves that
- when you use the app, the app combines the current time with that random data, does a checksum, and shows you the last 6 digits of the checksum. ED do the same math and check they get the same result

No service or communication required except for exchanging that random data in the QR code once, just that two things doing the same math get the same result.

[Gianky]

3 minutes ago, actually_fred said:

This 2FA does not require an external service; it just requires an app that can understand the QR codes. Some of the apps do have a service for backups etc, but some are entirely offline, with no communication between the app, ED, or anything else on the internet.

Are you saying that I can just scan the QR code with my phone camera (that "understands" them)? Then what? It'll open a link to click?

[actually_fred]

You need an app that understands the specific form of QR code; there are many options.

The app will show a 6 digit number when you open the app, which you type into ED login.

ED are using an open industry standard, which is widely recognized by security experts as much better than email or SMS. It's a slightly outdated standard (webauthn would be good), but it's still a big step up over email/SMS. If you want a long boring read, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf explicitly states that email 'SHALL NOT' be considered 2FA.

[Gianky]

Thanks for the explanation, @actually_fred. You said there are apps that work entirely offline, could you name some of them, please?