Discussion Forum: Suggestions(Post New Message)
Redisplay Messages: Compact | Brief | All | Full      Show Messages: All | Without Replies

 Author: calsbricks View Messages Posted By calsbricks
 Posted: Jan 24, 2020 12:23
 Subject: Re: 2FA or some other additional login security
 Viewed: 39 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

calsbricks (8504)

Location:  United Kingdom, England
Member Since Contact Type Status
Aug 12, 2008 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: CalsBricks
In Suggestions, Yo_Yo_Flamingo writes:
  In Suggestions, patpendlego writes:
  Admin,

Please implement 2FA or some other additional login security to BrickLink account.

2FA = 2-Factor-Authentication

It could help prevent hacking or stealing of accounts and account & inventory
information.

Of course this could be set as optional on the account.

Thank you.

I could not be any more opposed to this.

+10000000000000000000000000000000000000000000000000000000000000000000000000000000

Just adds more clumsiness to the site. The UK has recently adopted a multi authentication
system for online banking and shopping and to say the least it is a pain the
...., and as mobile phones are one of the most insecure devices on the planet
we simply do not understand how they can believe it is more secure. Far less
in reality/

This, perhaps, is what we see when an intellectual who sits behind a desk all
day comes up with ideas which bear no relationship to reality.
 Author: Yo_Yo_Flamingo View Messages Posted By Yo_Yo_Flamingo
 Posted: Jan 24, 2020 12:16
 Subject: Re: 2FA or some other additional login security
 Viewed: 29 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

Yo_Yo_Flamingo (4537)

Location:  USA, New York
Member Since Contact Type Status
Jan 9, 2016 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Set You Up
In Suggestions, patpendlego writes:
  Admin,

Please implement 2FA or some other additional login security to BrickLink account.

2FA = 2-Factor-Authentication

It could help prevent hacking or stealing of accounts and account & inventory
information.

Of course this could be set as optional on the account.

Thank you.

I could not be any more opposed to this.
 Author: qwertyboy View Messages Posted By qwertyboy
 Posted: Jan 24, 2020 11:45
 Subject: Re: 2FA or some other additional login security
 Viewed: 27 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

qwertyboy (7851)

Location:  Canada, Alberta
Member Since Contact Type Status
Apr 9, 2013 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Maple Bricks
In Suggestions, SylvainLS writes:
  The HAVE is not the phone, it’s the phone number, and that’s a KNOW. SMS can
be intercepted (both locally and remotely) and SIM cards can be duplicated.

As I said, it’s more difficult than just what script kiddies do nowadays, but
it’s only a 1k$ investment to intercept SMS remotely because the SMS protocole
is not secure. It might even already cost less.
And a malware that can intercept the SMS on the phone costs even less but you
need to put it on the phone but that is not that difficult.

So, again, yes, 2FA adds hurdles but the SMS hurdles are lower than you think
they are.

(I should know better than to argue with you - you always spin it around so you
are not wrong.)

I would love to see you, being in France, with any "1k$ investment" intercepting
a cell TXT message sent from BrickLink to my Canadian cell phone.

Niek.
 Author: popsicle View Messages Posted By popsicle
 Posted: Jan 24, 2020 11:12
 Subject: Re: Persistent issues…
 Viewed: 57 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

popsicle (6656)

Location:  USA, Washington
Member Since Contact Type Status
Feb 21, 2006 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: ConstrucToys
In Suggestions, popsicle writes:
  agulus’s input in this thread has reignited a persistent and nagging thought
of mine: https://www.bricklink.com/message.asp?ID=1176265

It’s a valid point made by member agulus, that has unfortunately been ongoing
as an issue, in the face of contrary input towards the feedback policy.

I’ve brought it up in the past, that a neutral should be just that, neutral,
and not effect your feedback percentage number displayed, up or down.

Beyond the obvious reasons, is the fact that there are many newish buyers that
mistakenly see BL’s neutral, as neutral. Silly people Meanwhile, it continues
to result in an amount of havoc in that arena of BrickLink.

I look forward to reading your honest thoughts

The thinking on this has been brought up from time to time, going back a while.
This member stated his case well, two years ago: https://www.bricklink.com/message.asp?ID=1081558
 Author: SylvainLS View Messages Posted By SylvainLS
 Posted: Jan 24, 2020 11:00
 Subject: Re: 2FA or some other additional login security
 Viewed: 42 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

SylvainLS (46)

Location:  France, Nouvelle-Aquitaine
Member Since Contact Type Status
Apr 25, 2014 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store Closed Store: BuyerOnly
BrickLink Discussions Moderator (?)
In Suggestions, qwertyboy writes:
  […]
  Remote: someone copies your credentials (login+password), your KNOW.
Oh, it’s okay, they don’t have the HAVE!
But of course they do! Because your HAVE is only a phone number, which is actually
a KNOW.

No, you don't understand. In the case OP described, the HAVE is implemented
by a TXT message to a registered cell phone number.

- The site registers a login with username/password (the KNOW);
- It sends a TXT message to a registered cell number (the HAVE);
- User needs to type that TXT message in a separate box on the login page.

You (as a hacker) won't be able to see that TXT message because you don't
HAVE that cell phone, so you can't type that message in, and hence you can't
complete the authentication process.

Please let me know how "SylvainLS" in France can type in the secret code that
was sent to my cell phone in Canada.

The HAVE is not the phone, it’s the phone number, and that’s a KNOW. SMS can
be intercepted (both locally and remotely) and SIM cards can be duplicated.

As I said, it’s more difficult than just what script kiddies do nowadays, but
it’s only a 1k$ investment to intercept SMS remotely because the SMS protocole
is not secure. It might even already cost less.
And a malware that can intercept the SMS on the phone costs even less but you
need to put it on the phone but that is not that difficult.

So, again, yes, 2FA adds hurdles but the SMS hurdles are lower than you think
they are.
 Author: qwertyboy View Messages Posted By qwertyboy
 Posted: Jan 24, 2020 10:35
 Subject: Re: 2FA or some other additional login security
 Viewed: 33 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

qwertyboy (7851)

Location:  Canada, Alberta
Member Since Contact Type Status
Apr 9, 2013 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Maple Bricks
In Suggestions, SylvainLS writes:
  In Suggestions, qwertyboy writes:
  […]
2FA is also referred to "something you know, and something you have". 2FA is
not meant to make sure it is you that is using your phone. Rather, it is meant
to do a second check after "someone" logged in (and used the "something you know")
by making sure that person also clears the "something you have" hurdle.

Saying 2FA implementations are generally flawed because they don't check
you are using the same device makes no sense. It is not meant to do that check.

It is meant to prevent "SylvainLS" in France to log into account "qwertyboy".
Good luck doing that if 2FA sends my Canadian phone a txt.

Let me be clearer. There are two types of attack: remote and local.

Local: someone steals or hacks your device, your HAVE.
Oh, it’s okay, they don’t have the KNOW!
But of course they do! Because everything is stored on your phone, including
the KNOW.


Remote: someone copies your credentials (login+password), your KNOW.
Oh, it’s okay, they don’t have the HAVE!
But of course they do! Because your HAVE is only a phone number, which is actually
a KNOW.

No, you don't understand. In the case OP described, the HAVE is implemented
by a TXT message to a registered cell phone number.

- The site registers a login with username/password (the KNOW);
- It sends a TXT message to a registered cell number (the HAVE);
- User needs to type that TXT message in a separate box on the login page.

You (as a hacker) won't be able to see that TXT message because you don't
HAVE that cell phone, so you can't type that message in, and hence you can't
complete the authentication process.

Please let me know how "SylvainLS" in France can type in the secret code that
was sent to my cell phone in Canada.

Niek.
 Author: popsicle View Messages Posted By popsicle
 Posted: Jan 24, 2020 09:40
 Subject: Re: Persistent issues…
 Viewed: 46 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

popsicle (6656)

Location:  USA, Washington
Member Since Contact Type Status
Feb 21, 2006 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: ConstrucToys
In Suggestions, Pippyblocks writes:
  I say yes to this too, I had my first neutral quite early on and it killed my
100% there and then. It was a positive too and the customer wasn't sure how
to change it. On the flip side it means you don't ever have to worry about
maintaining 100% anymore But yeah feedback I believe has become more and
more dated across platforms. I only ever bother to look at feedback if it's
a significant amount I'm spending.

Fantastic input!

Thanks
 Author: SylvainLS View Messages Posted By SylvainLS
 Posted: Jan 24, 2020 09:29
 Subject: Re: 2FA or some other additional login security
 Viewed: 35 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

SylvainLS (46)

Location:  France, Nouvelle-Aquitaine
Member Since Contact Type Status
Apr 25, 2014 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store Closed Store: BuyerOnly
BrickLink Discussions Moderator (?)
In Suggestions, qwertyboy writes:
  […]
2FA is also referred to "something you know, and something you have". 2FA is
not meant to make sure it is you that is using your phone. Rather, it is meant
to do a second check after "someone" logged in (and used the "something you know")
by making sure that person also clears the "something you have" hurdle.

Saying 2FA implementations are generally flawed because they don't check
you are using the same device makes no sense. It is not meant to do that check.

It is meant to prevent "SylvainLS" in France to log into account "qwertyboy".
Good luck doing that if 2FA sends my Canadian phone a txt.

Let me be clearer. There are two types of attack: remote and local.

Local: someone steals or hacks your device, your HAVE.
Oh, it’s okay, they don’t have the KNOW!
But of course they do! Because everything is stored on your phone, including
the KNOW.


Remote: someone copies your credentials (login+password), your KNOW.
Oh, it’s okay, they don’t have the HAVE!
But of course they do! Because your HAVE is only a phone number, which is actually
a KNOW.
Granted, a KNOW a bit more difficult to use than login+password, but still very
usable.


I’m not saying 2FA is bad. I’m saying 2FA isn’t a panacea, one-device 2FAs less
of one, and SMS-2FA even less of one.
I’m not advocating not to add 2FA, I’m just saying “careful with SMS-2FA.”

Anyway, all this is moot because BrickLink, and BrickLink and phones….
 Author: SylvainLS View Messages Posted By SylvainLS
 Posted: Jan 24, 2020 09:28
 Subject: Re: 2FA or some other additional login security
 Viewed: 33 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

SylvainLS (46)

Location:  France, Nouvelle-Aquitaine
Member Since Contact Type Status
Apr 25, 2014 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store Closed Store: BuyerOnly
BrickLink Discussions Moderator (?)
In Suggestions, patpendlego writes:
  In Suggestions, patpendlego writes:
  In Suggestions, SylvainLS writes:
  In Suggestions, patpendlego writes:
  […]
Obviously the idea behind 2FA is that you're NOT using the same device.

Yeah, that’s the idea but unfortunately, that’s not the common practice.

Apparently it is not YOUR practice. Don't generalize what you don't know.

Apparently nothing, because it’s not my practice.

I’m talking about what I see people do while you’re assuming your case is the
general one.


  
  
  
   I
personally never use the same device. Also, besides SMS there are authentication
apps which are secured by a pincode. In general, 2FA is regarded as the standard
safe login method today whereas 1FA is considered not safe enough anymore. Hence
the suggestion.

I understand the suggestion. I’m just pointing one pitfall.

“Regarded” is the problem here: people feel confident when in reality the implementation
is generally flawed.
How many websites check you’re not using the same device?
None, because it can’t be done.

2FA is not meant to be 100% safe,

Nothing is 100% safe, that’s not my point.
My point is things being presented as safer than they are.


  
   just SAFER than 1FA. You do not have to use
it if you don't want to. But, if the passwords were stolen, they can login
with 1FA but not with 2FA.

Except that, if they have your phone number, — and they will get it when they
get your passwords —, they can intercept your SMS.
Granted, it demands a little bit more investment than what script kiddies are
used to _now_, but SMS-2FA is less safe than other 2FAs.

And what one-device 2FAs do is actually replace a KNOW, your login+password,
with a HAVE, your device, because the device already KNOWS everything.


  Even if you have just one device only, as you have Sylvain

Assume, assume….
 Author: Pippysblocks View Messages Posted By Pippysblocks
 Posted: Jan 24, 2020 08:57
 Subject: Re: Persistent issues…
 Viewed: 48 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

Pippysblocks (4750)

Location:  United Kingdom, England
Member Since Contact Type Status
May 20, 2017 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Pippys Blocks
I say yes to this too, I had my first neutral quite early on and it killed my
100% there and then. It was a positive too and the customer wasn't sure how
to change it. On the flip side it means you don't ever have to worry about
maintaining 100% anymore But yeah feedback I believe has become more and
more dated across platforms. I only ever bother to look at feedback if it's
a significant amount I'm spending.

In Suggestions, popsicle writes:
  agulus’s input in this thread has reignited a persistent and nagging thought
of mine: https://www.bricklink.com/message.asp?ID=1176265

It’s a valid point made by member agulus, that has unfortunately been ongoing
as an issue, in the face of contrary input towards the feedback policy.

I’ve brought it up in the past, that a neutral should be just that, neutral,
and not effect your feedback percentage number displayed, up or down.

Beyond the obvious reasons, is the fact that there are many newish buyers that
mistakenly see BL’s neutral, as neutral. Silly people Meanwhile, it continues
to result in an amount of havoc in that arena of BrickLink.

I look forward to reading your honest thoughts

-Cory
 Author: agulus View Messages Posted By agulus
 Posted: Jan 24, 2020 08:56
 Subject: Re: Persistent issues…
 Viewed: 29 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

agulus (1571)

Location:  USA, Illinois
Member Since Contact Type Status
Sep 27, 2013 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Stefan Bricker
In Suggestions, crxefx writes:
  Same feeling exactly. As much as I love the 100% feedback score our store has,
I will admit that we have made mistakes that should have received neutral feedback
at some point. On the other hand, If you have 1000 positives and 10 neutrals.
Should you still have 100% feedback score? I'm not sure myself how to approach
the feedback system. To compound on that thought, When ordering I never bother
to check a sellers feedback rating so... Does it matter? Does everyone take the
time to check? I don't know.

-Andy

For me as a seller the best meaning for neutral would be for example
that in worst scenario there were problems with order but
it was easy to work on the issue with seller but the buyer
is not 100% satisfied because he/she got only a refund not the part
he/she needed. I wouldn't mind to get a neutral in those
situations if this feedback wouldn't change the percentage.

Sometimes I buy parts on BL and I always look at feedback.
It gives you a lot of information about the seller.

-Agnes
 Author: popsicle View Messages Posted By popsicle
 Posted: Jan 24, 2020 08:36
 Subject: Re: Persistent issues…
 Viewed: 35 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

popsicle (6656)

Location:  USA, Washington
Member Since Contact Type Status
Feb 21, 2006 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: ConstrucToys
In Suggestions, crxefx writes:
  Same feeling exactly. As much as I love the 100% feedback score our store has,
I will admit that we have made mistakes that should have received neutral feedback
at some point. On the other hand, If you have 1000 positives and 10 neutrals.
Should you still have 100% feedback score? I'm not sure myself how to approach
the feedback system. To compound on that thought, When ordering I never bother
to check a sellers feedback rating so... Does it matter? Does everyone take the
time to check? I don't know.

-Andy

Valid thoughts. Good input.

Thanks
 Author: popsicle View Messages Posted By popsicle
 Posted: Jan 24, 2020 08:30
 Subject: Re: Persistent issues…
 Viewed: 37 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

popsicle (6656)

Location:  USA, Washington
Member Since Contact Type Status
Feb 21, 2006 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: ConstrucToys
In Suggestions, leopard37 writes:
  In Suggestions, infinibrix writes:
  In an ideal world if the feedback system was worded a little differently we'd
see a more meaningful feedback system perhaps where sellers could actually get
better recognition when they go above and beyond the norm! i.e If it was worded
something like this:-

Please rate this transaction:-

Bad - (Problems with the transaction)
Good - (Smooth transaction)
Outstanding - (Seller went beyond expectations!)

Imagine you have two sellers with 500 feedback where one has 492 Good and 8 Outstanding
the other has 425 Good and 75 Outstanding this would give a whole new meaning
to the feedback system and how we see sellers overall rather than the somewhat
redundant Neutral which seems to be seen as a minor negative!

How many new users rate the postal system not the order. This is also a flaw.
Especially if the seller doesn't accurately say when the package was shipped.

Tyson.

Good point!

Thanks
 Author: popsicle View Messages Posted By popsicle
 Posted: Jan 24, 2020 08:29
 Subject: Re: Persistent issues…
 Viewed: 54 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

popsicle (6656)

Location:  USA, Washington
Member Since Contact Type Status
Feb 21, 2006 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: ConstrucToys
In Suggestions, infinibrix writes:
  In an ideal world if the feedback system was worded a little differently we'd
see a more meaningful feedback system perhaps where sellers could actually get
better recognition when they go above and beyond the norm! i.e If it was worded
something like this:-

Please rate this transaction:-

Bad - (Problems with the transaction)
Good - (Smooth transaction)
Outstanding - (Seller went beyond expectations!)

Imagine you have two sellers with 500 feedback where one has 492 Good and 8 Outstanding
the other has 425 Good and 75 Outstanding this would give a whole new meaning
to the feedback system and how we see sellers overall rather than the somewhat
redundant Neutral which seems to be seen as a minor negative!

What a novel idea. I like it. A seller can better work at negating the effects
of mistakes or unjust feedback

Thanks
 Author: BrickCompulsion View Messages Posted By BrickCompulsion
 Posted: Jan 24, 2020 06:11
 Subject: Re: 2FA or some other additional login security
 Viewed: 35 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

BrickCompulsion (2975)

Location:  United Kingdom, England
Member Since Contact Type Status
Mar 16, 2016 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Brick Compulsion
In Suggestions, patpendlego writes:
  Admin,

Please implement 2FA or some other additional login security to BrickLink account.

2FA = 2-Factor-Authentication

It could help prevent hacking or stealing of accounts and account & inventory
information.

Of course this could be set as optional on the account.

Thank you.

I would fully support and do fully encourage this to happen
 Author: infinibrix View Messages Posted By infinibrix
 Posted: Jan 24, 2020 05:36
 Subject: Re: Persistent issues…
 Viewed: 48 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

infinibrix (4983)

Location:  United Kingdom, England
Member Since Contact Type Status
Jul 1, 2013 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: infinibrix
In Suggestions, leopard37 writes:
  In Suggestions, infinibrix writes:
  In an ideal world if the feedback system was worded a little differently we'd
see a more meaningful feedback system perhaps where sellers could actually get
better recognition when they go above and beyond the norm! i.e If it was worded
something like this:-

Please rate this transaction:-

Bad - (Problems with the transaction)
Good - (Smooth transaction)
Outstanding - (Seller went beyond expectations!)

Imagine you have two sellers with 500 feedback where one has 492 Good and 8 Outstanding
the other has 425 Good and 75 Outstanding this would give a whole new meaning
to the feedback system and how we see sellers overall rather than the somewhat
redundant Neutral which seems to be seen as a minor negative!

How many new users rate the postal system not the order. This is also a flaw.
Especially if the seller doesn't accurately say when the package was shipped.

Tyson.

But if you let the buyer know when the goods were or will be shipped most buyers
will be understanding and take that into consideration. Sometimes you may be
penalised because of the fault of the courier but as sellers we are all in the
same boat and if you nearly always ship same day or next business day this in
the long term will be reflected overall in your feedback rating whereas if a
seller usually ships within 3-4 days it stands to reason that their rating might
not be so good for instance an 'Outstanding' rating might be given where
a buyer pays for their order right at the end of the day 4-5pm and is surprised
and overwhelmed to get their goods next day therefore they might decide leave
an oustanding instead of Good.
 Author: crxefx View Messages Posted By crxefx
 Posted: Jan 24, 2020 01:44
 Subject: Re: 2FA or some other additional login security
 Viewed: 46 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

crxefx (2572)

Location:  USA, Wisconsin
Member Since Contact Type Status
Jan 28, 2017 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: A and R Brick
Lol! what if you only have one device thought
 Author: leggodtshop View Messages Posted By leggodtshop
 Posted: Jan 24, 2020 01:28
 Subject: Re: 2FA or some other additional login security
 Viewed: 37 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

leggodtshop (3861)

Location:  Netherlands, Overijssel
Member Since Contact Type Status
Aug 11, 2006 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Leggodt.nl
In Suggestions, patpendlego writes:
  Admin,

Please implement 2FA or some other additional login security to BrickLink account.

2FA = 2-Factor-Authentication

It could help prevent hacking or stealing of accounts and account & inventory
information.

Of course this could be set as optional on the account.

Thank you.

To clarify: with the current 1FA if Bricklink accounts were stolen all accounts
can be logged on to, with 2FA that can't.
 Author: leggodtshop View Messages Posted By leggodtshop
 Posted: Jan 24, 2020 01:23
 Subject: Re: 2FA or some other additional login security
 Viewed: 42 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

leggodtshop (3861)

Location:  Netherlands, Overijssel
Member Since Contact Type Status
Aug 11, 2006 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Leggodt.nl
In Suggestions, patpendlego writes:
  In Suggestions, SylvainLS writes:
  In Suggestions, patpendlego writes:
  […]
Obviously the idea behind 2FA is that you're NOT using the same device.

Yeah, that’s the idea but unfortunately, that’s not the common practice.

Apparently it is not YOUR practice. Don't generalize what you don't know.
  

   I
personally never use the same device. Also, besides SMS there are authentication
apps which are secured by a pincode. In general, 2FA is regarded as the standard
safe login method today whereas 1FA is considered not safe enough anymore. Hence
the suggestion.

I understand the suggestion. I’m just pointing one pitfall.

“Regarded” is the problem here: people feel confident when in reality the implementation
is generally flawed.
How many websites check you’re not using the same device?
None, because it can’t be done.

2FA is not meant to be 100% safe, just SAFER than 1FA. You do not have to use
it if you don't want to. But, if the passwords were stolen, they can login
with 1FA but not with 2FA.

Even if you have just one device only, as you have Sylvain
 Author: leggodtshop View Messages Posted By leggodtshop
 Posted: Jan 24, 2020 01:19
 Subject: Re: 2FA or some other additional login security
 Viewed: 54 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

leggodtshop (3861)

Location:  Netherlands, Overijssel
Member Since Contact Type Status
Aug 11, 2006 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Leggodt.nl
In Suggestions, SylvainLS writes:
  In Suggestions, patpendlego writes:
  […]
Obviously the idea behind 2FA is that you're NOT using the same device.

Yeah, that’s the idea but unfortunately, that’s not the common practice.

Apparently it is not YOUR practice. Don't generalize what you don't know.
  

   I
personally never use the same device. Also, besides SMS there are authentication
apps which are secured by a pincode. In general, 2FA is regarded as the standard
safe login method today whereas 1FA is considered not safe enough anymore. Hence
the suggestion.

I understand the suggestion. I’m just pointing one pitfall.

“Regarded” is the problem here: people feel confident when in reality the implementation
is generally flawed.
How many websites check you’re not using the same device?
None, because it can’t be done.

2FA is not meant to be 100% safe, just SAFER than 1FA. You do not have to use
it if you don't want to. But, if the passwords were stolen, they can login
with 1FA but not with 2FA.
 Author: crxefx View Messages Posted By crxefx
 Posted: Jan 24, 2020 01:10
 Subject: Re: Persistent issues…
 Viewed: 53 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

crxefx (2572)

Location:  USA, Wisconsin
Member Since Contact Type Status
Jan 28, 2017 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: A and R Brick
Same feeling exactly. As much as I love the 100% feedback score our store has,
I will admit that we have made mistakes that should have received neutral feedback
at some point. On the other hand, If you have 1000 positives and 10 neutrals.
Should you still have 100% feedback score? I'm not sure myself how to approach
the feedback system. To compound on that thought, When ordering I never bother
to check a sellers feedback rating so... Does it matter? Does everyone take the
time to check? I don't know.

-Andy
 Author: leopard37 View Messages Posted By leopard37
 Posted: Jan 23, 2020 23:04
 Subject: Re: Persistent issues…
 Viewed: 45 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

leopard37 (4525)

Location:  Canada, Alberta
Member Since Contact Type Status
Jul 15, 2015 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Leopard37
In Suggestions, infinibrix writes:
  In an ideal world if the feedback system was worded a little differently we'd
see a more meaningful feedback system perhaps where sellers could actually get
better recognition when they go above and beyond the norm! i.e If it was worded
something like this:-

Please rate this transaction:-

Bad - (Problems with the transaction)
Good - (Smooth transaction)
Outstanding - (Seller went beyond expectations!)

Imagine you have two sellers with 500 feedback where one has 492 Good and 8 Outstanding
the other has 425 Good and 75 Outstanding this would give a whole new meaning
to the feedback system and how we see sellers overall rather than the somewhat
redundant Neutral which seems to be seen as a minor negative!

How many new users rate the postal system not the order. This is also a flaw.
Especially if the seller doesn't accurately say when the package was shipped.

Tyson.
 Author: infinibrix View Messages Posted By infinibrix
 Posted: Jan 23, 2020 22:47
 Subject: Re: Persistent issues…
 Viewed: 53 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

infinibrix (4983)

Location:  United Kingdom, England
Member Since Contact Type Status
Jul 1, 2013 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: infinibrix
In an ideal world if the feedback system was worded a little differently we'd
see a more meaningful feedback system perhaps where sellers could actually get
better recognition when they go above and beyond the norm! i.e If it was worded
something like this:-

Please rate this transaction:-

Bad - (Problems with the transaction)
Good - (Smooth transaction)
Outstanding - (Seller went beyond expectations!)

Imagine you have two sellers with 500 feedback where one has 492 Good and 8 Outstanding
the other has 425 Good and 75 Outstanding this would give a whole new meaning
to the feedback system and how we see sellers overall rather than the somewhat
redundant Neutral which seems to be seen as a minor negative!
 Author: popsicle View Messages Posted By popsicle
 Posted: Jan 23, 2020 21:32
 Subject: Re: Persistent issues…
 Viewed: 64 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

popsicle (6656)

Location:  USA, Washington
Member Since Contact Type Status
Feb 21, 2006 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: ConstrucToys
In Suggestions, Captain_Q writes:
  In Suggestions, popsicle writes:
  agulus’s input in this thread has reignited a persistent and nagging thought
of mine: https://www.bricklink.com/message.asp?ID=1176265

It’s a valid point made by member agulus, that has unfortunately been ongoing
as an issue, in the face of contrary input towards the feedback policy.

I’ve brought it up in the past, that a neutral should be just that, neutral,
and not effect your feedback percentage number displayed, up or down.

Beyond the obvious reasons, is the fact that there are many newish buyers that
mistakenly see BL’s neutral, as neutral. Silly people Meanwhile, it continues
to result in an amount of havoc in that arena of BrickLink.

I look forward to reading your honest thoughts

-Cory


I think Bl's feedback system is somewhat dated. Neutral's should be
more benign rather then similar to negatives.

CURRENT BL FEEDBACK SYSTEM
Positive: accurate
Neutral: overly harsh / may encourage retaliation
Negative: accurate yet may encourage retaliation




I think emulating the eBay model would be a good adaptation. The feedback percentage
is more reflective of a seller's current feedback reputation of the last
12 months vs lifetime like on Bricklink. Meaning a single negative from 6 years
ago doesn't hold the overall feedback percentage down beyond a year, that
is if the seller has cleaned up their act and do no accrue any more negatives/neutrals.


I see frequent enough comment threads here on Bricklink that have complaints
about a seller or buyer receiving retaliation feedback or expressing fear that
they may receive one if they leave accurate feedback. Negatives are warning signs
for sellers to work harder and make improvements. But if the punishment is too
harsh then message may not be received properly.
This mindset has potential to create a retaliatory like atmosphere.

- Captain Q

Interesting thoughts and great input, as usual. Thanks!
 Author: Captain_Q View Messages Posted By Captain_Q
 Posted: Jan 23, 2020 21:20
 Subject: Re: Persistent issues…
 Viewed: 61 times
 Topic: Suggestions
View Message
View
Cancel Message
Cancel
Reply to Message
Reply
BrickLink
ID Card

Captain_Q (7853)

Location:  USA, Oregon
Member Since Contact Type Status
Aug 6, 2005 Contact Member Seller
Buying Privileges - OKSelling Privileges - OK
Store: Captain Q Bazaar
In Suggestions, popsicle writes:
  agulus’s input in this thread has reignited a persistent and nagging thought
of mine: https://www.bricklink.com/message.asp?ID=1176265

It’s a valid point made by member agulus, that has unfortunately been ongoing
as an issue, in the face of contrary input towards the feedback policy.

I’ve brought it up in the past, that a neutral should be just that, neutral,
and not effect your feedback percentage number displayed, up or down.

Beyond the obvious reasons, is the fact that there are many newish buyers that
mistakenly see BL’s neutral, as neutral. Silly people Meanwhile, it continues
to result in an amount of havoc in that arena of BrickLink.

I look forward to reading your honest thoughts

-Cory


I think Bl's feedback system is somewhat dated. Neutral's should be
more benign rather then similar to negatives.

CURRENT BL FEEDBACK SYSTEM
Positive: accurate
Neutral: overly harsh / may encourage retaliation
Negative: accurate yet may encourage retaliation




I think emulating the eBay model would be a good adaptation. The feedback percentage
is more reflective of a seller's current feedback reputation of the last
12 months vs lifetime like on Bricklink. Meaning a single negative from 6 years
ago doesn't hold the overall feedback percentage down beyond a year, that
is if the seller has cleaned up their act and do no accrue any more negatives/neutrals.


I see frequent enough comment threads here on Bricklink that have complaints
about a seller or buyer receiving retaliation feedback or expressing fear that
they may receive one if they leave accurate feedback. Negatives are warning signs
for sellers to work harder and make improvements. But if the punishment is too
harsh then message may not be received properly.
This mindset has potential to create a retaliatory like atmosphere.

- Captain Q

Next Page: 5 More | 10 More | 25 More | 50 More | 100 More