SmallBall Sports Forums Archives

TAZ · Member Joined: 27 Oct 2002 Forum ID: 108

I learned about SmallBall from a coworker. Since he turned me on to the game, he has lost interest and dropped out. I have been pestering him to give me his DT team because he is no longer interested in training them. After his repeated refusals to turn them over, I have to admit that I have spent some time thinking about how I could get them over his objections. Of course I haven't done anything (because that would be wrong), but I think I figured out how I could do it. Then I realized: there is nothing to stop him--or anyone else in my office--from doing the same thing to me!

I realized that since I started playing, I have never logged out of SmallBall. The login button is there on the splash screen, but I have access to the team without using it. I just hit the DT button and I'm in. As a result, anyone with access to my computer (ie any of my coworkers) could do the same thing. I realized that they could seize temporary control of my team and train them/change their names/change their positions without my permission.

Then a bigger problem occured to me: in order to change the team password, you do not need to enter the current team password. As a result, anyone with access to my computer could change my password and seize PERMANENT control of my team!

Am I off base here, or is this a legitimate concern? It seems to me that this forum is more secure than my team: I have to login every time I check in and I can logout when I leave. In addition, in order to change the password in my profile, I have to provide the current password. I doubt that there have been any problems based on this in the past because 1) physical access to an owner's computer is required, and 2) you have to have a pretty sick mind to think of stuff that, but I am sure that I am not the only owner who has the program installed on a work machine that others could access.

I think that at a minimum, the profile screen needs to be modified to require the old team password to enter a new one. In addition, I think that we need to have the ability to log out after training so that a password is required to access the team.

Are you scared yet?

Commissioner · Posted: Mon Oct 28, 2002 11:47 am Post subject: Hmmm

good points!

We will look at some ways to make your teams more secure. That was well said, espicially about how the forum is more secure than the teams.

Thanks for your suggestions and ideas
_________________
For Customer Care please email: Support@SmallBall.org

eagle0468 · Guest Forum ID: -1

As far as changing the password is concerned, it should require the entry of the old password before a new one can be administered. As far as logging off your current team after training, just click on the exit button.

nmshooter · Posted: Mon Oct 28, 2002 3:46 pm Post subject: Re: use the exit button

Chawag86 · Posted: Mon Oct 28, 2002 3:48 pm Post subject: Re: use the exit button

nmshooter · Posted: Mon Oct 28, 2002 3:52 pm Post subject:

Well I had smallball loaded at work once before and I never had to worry about others but If I did feel threatened then I would create a dummy team and log into them. Your real team would be secure, they could get the dummy team but oh well. At least until they get better security, this is an option.
_________________
"Oderint dum metuant"

Gamer · Posted: Tue Oct 29, 2002 7:27 pm Post subject:

great idea...i think this is a MUST to be implicated into SBBB and SBFB!!