Enzoic Navigation
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP

Are gaming companies and forums taking security seriously?

Many gaming companies and gaming-related websites prioritize user experience and easy access above security and strong authentication.  They have found that increasing friction at login can drive customer attrition… which then translates into decreased revenue. But are they taking security seriously enough? 

This is a theme Enzoic’s CTO, Mike Wilson, recently explored in a conversation with Threatpost’s Tom Spring. The resulting article, “Gamers Are Easy Prey for Credential Thieves,” highlights the gaming industry’s security conundrum and outlines why someone would pay a criminal for stolen gaming accounts in the first place. 

Why would a criminal even want to access your gaming account? 

Gaming credentials are lucrative, especially in larger numbers.Gaming credentials can be worth a surprising amount depending on the type of game, the hashing algorithm they are stored in and what is on the account. Here is a sampling of how much some gaming accounts are sold for on the dark web:

  • Fortnite combolists: 100K credentials for $5
  • Fortnite accounts: 6.50-900.00 eur (depending on skins on account)
  • Minecraft accounts: $0.10-40.00
  • League of Legends accounts: $4-115 (depending on skins and level on account)
  • Apex Legends accounts: $2
  • The Sims accounts: $3-4
  • Origin accounts: $1.50-6 (depending on games available on account)
  • Uplay accounts: $1
  • Grand Theft Auto accounts: $8.50-12.50
  • PlayerUnknown’s Battlegrounds accounts: $15-28
  • ARK: Survival Evolved accounts: $20
  • Call of Duty accounts: $15-26
  • Steam product keys: $6

By comparison, here is a sampling of other types of accounts:

  • Google Cloud accounts with $100+ credit – $6
  • PayPal Account with $100 balance – 13 eur
  • PayPal Account with $500 balance – 80 eur
  • cryptocurrency accounts – 94 eur
  • Western Union account – 30 eur
  • Netflix account: $3.00-4.00
  • Hulu account: $0.50-10.00
  • Sling accounts: $5.00-15.00 (depending on lineup)
  • HBO accounts: $3.00
  • Creative Cloud account: $10.00
  • Porn accounts: $3-10
  • VPN accounts: $1-5
  • Streaming video accounts: $3-7
  • Streaming music accounts: $0.50-3
  • Spotify accounts: 1-2 eur
  • Pizza accounts with reward points: $.50-18.00 (depending on points on account)
  • AT&T Uverse – 10-12 eur (depending on lineup)
  • DirecTV Now – 8-15 eur (depending on lineup)
  • Grubhub with CC – 4 eur
  • Fandango with CC – 2 eur
  • Starbucks accounts with $100 – $25

Why is the Gaming Industry at Risk?

Another recent piece of Enzoic media coverage analyzes the key factors that make the gaming industry so vulnerable. As our CEO, Michael Greene, wrote in an opinion piece for VentureBeat gaming is particularly susceptible for 2 main reasons:

  1. Gaming sites use weak authentication security measures during login and since so many users re-use passwords, criminals can easily access their accounts using stolen credentials.
  2. Many gamers use weak passwords on gaming sites because they are young and don’t know better, or because they feel there is really nothing of value in their account.

The good news is that Akamai saw a slight decline in gaming accounts for sale on the dark web between 2017 and 2018, which could indicate that the gaming industry is starting to take security more seriously.  By hashing their passwords in more complex algorithms, they are worth less on the dark web, which makes it less lucrative for criminals.  

How can gaming sites improve security at login without creating user friction?

Besides using more complex hashing algorithms, the gaming industry can adopt newer low user-friction authentication methods. 

Because most people reuse passwords across multiple sites, credentials for non-gaming sites can be used in credential stuffing attacks against gaming sites and vice-versa. Increasingly, gaming sites are quietly screening user accounts for compromised credentials.  When an account is found to be using compromised credentials, the gaming site can either make the user reset their password or they can limit access within the account (like hiding credit card data) to reduce the threat. 

For more on security in the gaming sector, you can read more about it in the following articles:

Threatpost: Gamers Are Easy Prey for Credential Thieve

VentureBeat: The Video Game Industry is a Black Hole for Cybersecurity

Learn more about how your site can screen for compromised credentials or passwords.

acccount takeover protectionFraudGaming Security

Search

Assess your cyber vulnerabilities with a free password audit tool
Start Now

Browse blog categories

  • Account Takeover (28)
  • Active Directory (44)
  • all posts (152)
  • Continuous Password Protection (24)
  • COVID-19 (7)
  • Cracking Dictionaries (6)
  • Credential Screening (21)
  • Cybersecurity (66)
  • Data Breaches (31)
  • EdTech (3)
  • Enzoic News (18)
  • Financial Services Cybersecurity (5)
  • GovTech (4)
  • Healthcare Cybersecurity (15)
  • Law Firm Cybersecurity (2)
  • NIST 800-63 (28)
  • Password Security (30)
  • Password Tips (51)
  • Regulation and Compliance (11)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Developer Documentation (APIs)

Recent blog posts

  • CISA: The Risk of MFA Without Improving Password Security
  • It’s W0rld P@ssw0rd D@y!
  • Tackling Cybersecurity Vulnerabilities in School Systems  
  • [ Sign Up for a Free Account ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2022 | Privacy Policy | Acceptable Use

3800 Arapahoe Avenue, Ste 250 l Boulder, CO 80303

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website