As Splinterlands continues to grow, unfortunately there are also an increased number of cases of players' accounts being compromised and assets being stolen. The Splinterlands team is working as a top priority to identify and close any security loopholes and ensure that players are aware of and follow the best practices in order to secure their accounts and their assets.
Requiring Active Auth for ALL Accounts
In the past we have made it so that all new accounts will require their active key to perform any transactions that would move assets or funds out of their Splinterlands game account, and we no longer let anyone turn that setting off once it is enabled, but there are still a large number of accounts that were created before that change and have the setting still turned off and are therefore at a higher risk of having their accounts compromised.
In 7 days from today, on Thursday, November 4th, we will be making it so that ALL accounts require the active key for these transactions, regardless of the status of the "require active key" setting. The reason for waiting 7 days to make this change is that there may be 3rd party services that are still using the posting key for these transactions and we need to give them time to update to use the active key going forward.
Link External Wallets to Require Active Key
Another security-focused change which will go into effect immediately is that the add_wallet operation which allows players to link an external blockchain wallet to their Splinterlands account will require the active key to be used going forward.
This will prevent hackers from being able to update the linked wallets for compromised accounts and tricking users into sending their assets to the wrong place.
Don't Allow Login With Master Password
In the near future it will no longer be possible to log in to the Splinterlands game website and mobile app with the master password for your Hive account. Instead, players should always use only their private posting key to log in as this is much more secure. The master password should be stored securely, preferably offline, and only the appropriate private keys should be used to log in and perform transactions.
Once this change is made, if a player attempts to log in using their master password they will receive a message explaining that the private posting keys must be used instead as well as an option to obtain the private keys for the account if they do not have them.
We hope that this will go a long way to help prevent player's master passwords from being compromised and allow their accounts to be much more secure.
Please note that this change will not affect players that log in using their email address or 3rd party services like Metamask as those login methods only provide access to the posting key.
Updated Password Policy
In the near future we will also be updating the password policy for new accounts that are created through the game website or mobile app to ensure that players use strong passwords that are more difficult to compromise, and we will also provide additional messaging and warnings to players about not re-using passwords from other websites.
Update on DEC Reward Changes
We also wanted to take this opportunity to provide a quick update on the DEC ranked battle reward changes announced in this post:Splinterlands Updates - October, 2021.
The change to remove DEC rewards for ranked battles in Bronze III and Novice leagues has been released, however due to some technical issues the change to the DEC reward curve has not been released yet. At this time we are planning to release that change on Monday, November 1st, shortly after the beginning of the next ranked play season.
As mentioned in the announcement post, this change is intended to help incentivize players to move up through the leagues rather than stay at lower leagues and farm rewards, and we hope that with the rental market and the upcoming launch of Chaos Legion it will be much easier and more cost effective for players to expand their card collection and move up to higher leagues for significantly increased rewards.
Upcoming Chaos Legion Announcements
Finally, we wanted to let everyone know that we are in the process of finalizing many of the details of the Chaos Legion launch, including the plans for VOUCHER tokens after the presale and the stats for the limited edition promo card - Doctor Blight!
Please make sure to follow our blog here and follow us on social media to get the latest updates, and we also highly encourage anyone that can make it to join our AMA tomorrow, Friday, October 29th, at 2 PM ET / 18:00 UTC in the Splinterlands Discord server.
Stay tuned for more updates from the Splinterlands!
Website | Blog | Discord | Telegram | Shop
NOTE: All rewards from this post will be burned.