TRPG General Chat

Aaron

2:02 PM

@JoshuaAslanSmith Not yet. I just finished building my map and am looking for monsters to add now.

Joshua Aslan Smith

cool, let me know

Aaron

@JoshuaAslanSmith Want to check out what I have so far? or can I do somethng like that without you actually joining the game?

@JoshuaAslanSmith Got one

Joshua Aslan Smith

I have an account

drop me a share link

Aaron

How do I use macros? It seems like they should make it so if I type a command it would do the saved command but the exampled doesn't seem to do it like that.

@JoshuaAslanSmith app.roll20.net/join/387245/jmGa7g

Joshua Aslan Smith

2:29 PM

hmmm so close to the front page I can taste it

Aaron

@JoshuaAslanSmith Thanks for the help. Mainly I was having an issue navigating the help pages but I figured it out.

@JoshuaAslanSmith Imgur?

Joshua Aslan Smith

Im glad and I have some experience so why not help you out

thats what we are here for

how is everyone today

lots of away users in chat

Inbar Rose

@JoshuaAslanSmith I am doing well.

I just backed Storium on Kickstarter and I am learning it as we speak.

Joshua Aslan Smith

firepits on the beach during golden hour

theres a story right there

Aaron

Dex mod is automatically applied to bows in pathfinder right?

Joshua Aslan Smith

2:35 PM

?

Aaron

Oh wait just the hit not damage.

Nevermind

Inbar Rose

@Aaron "automatically" ? What do you mean? Like a computer game?

Aaron

@InbarRose I meant like it is added to your attack roll without any feats and such.

Inbar Rose

Dexterity is the default attribute that you add to your base attack bonus to determine your ranged based attack modifier.

In some circumstances you can apply other attributes instead.

Aaron

Yea. It isn't added to damage though right?

Inbar Rose

2:40 PM

Not by default.

Whereas - in melee combat, Strength is added to damage by default.

Aaron

ok. That is what I was wondering. I thought it needed feats

Inbar Rose

If you have a mighty bow for instance, you can apply Strength to your ranged attack damage. (Up to the mighty level, and only within the range specified)

As an aside: The most you can get out of attributes as far as damage is concerned is when using a two-handed weapon and you apply your strength 1.5 times. So a standard melee character with say 18 Strength would get +6 damage on every attack with a two-handed weapon. (Barring special abilities/feats/etc...)

Joshua Aslan Smith

@inbar rose Storium looks interesting, but I have this strong aversion to listening to other people's work who don't have some kind of training/solid experience. They usually can't take legit criticism.

Inbar Rose

... What has this to do with Storium?

It's a platform.

D&D is a platform as well.

What you just wrote is like I were to write "I like pasta, but I hate when it rains"

One this has nothing to do with the other.

Joshua Aslan Smith

maybe I need to look at the kickstarter better, but its basically a story boardgame designed for the net (or like one)

in which people write stories that are shared with others

Inbar Rose

2:52 PM

It's a different take on the roll20 idea. In a more story or narrative driven way

A way to tell stories online.

With simple mechanics.

Joshua Aslan Smith

gotcha

@waxeagle Danke, I saw it end without being awarded and my first though was, "I was unworthy!"

wax eagle

@JoshuaAslanSmith nah, sorry I didn't get back to you, about possible changes, but I was already happy with it and our weekend was crazytown

Joshua Aslan Smith

thats fine

life happens etc. I just figured you werent directly talking to me so as to not sway answers one way or anothe ror somethign like that

wax eagle

@JoshuaAslanSmith nah, I'd rather give feedback and get one really good answers (and a couple of pretty good ones).

Joshua Aslan Smith

trying to get that newer user arp laszlo in chat

wax eagle

3:01 PM

but 2yr old b-day on Friday, Saturday spending the whole day on my mower, and Sunday with small group and aforementioned child's b-day party 'twas a crazy weekend

Joshua Aslan Smith

I feel like he just wants a bunch of dungeon world and FAE experience but is having issues with asking the question

but we here could readily supply what he needs outside the Q&A format

Joshua Aslan Smith

3:16 PM

hmm yeah that sounds crazy

downsides of atlanta yard work

also

kudzu

wax eagle

@JoshuaAslanSmith you likely won't have an acre and a half to deal with

@JoshuaAslanSmith generally not something you have to worry about in the city

Joshua Aslan Smith

might end up living in the suburbs but yeah not right away

I mean I own multiple machetes for no logical reason so they would definitely get tasked out

depending on if I owned enough land I could also possibly qualify for a flamethrower license for agricultural purposes

but that is only a possibility

Inbar Rose

@JoshuaAslanSmith That is ridiculous.

Joshua Aslan Smith

Kudzu's lack of a natural restrictions from herbivores, fungus or competing plants is whats ridiculous, I'm just proposing efficient solutions

wax eagle

@JoshuaAslanSmith don't need a license

@InbarRose it's a pretty common method of weed control

Joshua Aslan Smith

3:24 PM

hmm surprising about the license part

wax eagle

amazon.com/Ridge-Rock-Propane-Burner-Torch/dp/B001NDK8C8

Inbar Rose

What can't be found on Amazon?

Or more generally, The Internet?

Joshua Aslan Smith

firearms mostly

on the amazon side

Inbar Rose

Erm - not true.

wax eagle

was gonna say, amazon doesn't sell firearms directly some 3rd party sellers do ...the internet though

Inbar Rose

3:28 PM

gunbroker.com

Joshua Aslan Smith

surprised they havent gotten into that game actually, they could just setup a bunch of guys with federal FTLs

@inbarrose I was referring to amazon I bought my first Pistol over the internet

kygunco.com/springfield-xdm-45acp-pistol-high-capacity-35328

Inbar Rose

You can still buy wives online too. volgagirl.com

wax eagle

it only gets complicated if the sale is across state lines

Joshua Aslan Smith

which mine was but it was shipped to an FTL guy near me (who I gave his info up front to them)

Inbar Rose

@JoshuaAslanSmith Your wife or your gun?

Joshua Aslan Smith

3:30 PM

FTL guy holds the weapon is who runs the state background check when I go to pick it up

Inbar Rose

I guess my humor went unnoticed...

Joshua Aslan Smith

@inbarrose now you are just being silly

Inbar Rose

You can even buy airplanes online. findaircraft.com

wax eagle

@InbarRose I was amused that my response followed yours :)

Inbar Rose

:)

You can buy An Island

Joshua Aslan Smith

3:32 PM

amazon probably doesn't want to sell firearms though because its a contentious product

they probably don't want to become a political target and loose general business over it

wax eagle

@JoshuaAslanSmith yeah, and my guess is the margin isn't worth the hassle

Inbar Rose

Soon people will just be printing guns at home :P

Joshua Aslan Smith

meh

wax eagle

@InbarRose meh, even if I had the capability, I'd rather buy

Joshua Aslan Smith

A metallic printer is incredibly expensive

Inbar Rose

3:34 PM

Right now.

In 50 years.

Joshua Aslan Smith

and you'll still never get the metal quality you would with a solid forged block that was machined out

Eh itll probably still be really expensive in 50 years

Inbar Rose

Well, when we have perfect 3d replicators that work on an atomic level... we will :P

Joshua Aslan Smith

metalworking is an expensive hobby regardless of what you do with it

someones reading too much sci fi

Inbar Rose

meh

It is inevitable.

Joshua Aslan Smith

now polymer or other cheap, easily melted and molded materials, yeah they should really begin to drop in prices as people warm up tot he diea an they go mainstream

they basically can present the same kind of utility as a good woodshop could but in a quicker time and obviously less kill involved plus you can easily share designs to exact copies

@inbarrose it might be inevitable that it is scientifically doable but will it be economically feasible?

Inbar Rose

3:37 PM

Man - I was looking at those Private Islands ... Some of them aren't even that expensive!

$100k Can buy you a really large Private Island. Some are even as low as $35k!

Joshua Aslan Smith

probably a lot of hidden costs in owning a private island

wax eagle

@JoshuaAslanSmith transport to start with

Joshua Aslan Smith

yep

Inbar Rose

Who cares, you will own a private Island. Think about how much that's worth in the future as an investment!

I am not talking about some tiny little island in a lake. I am talking about an island in the Caribbeans or something.

Joshua Aslan Smith

risky investment

Inbar Rose

3:42 PM

Meh.

I am not seriously considering it or anything. I would require myself to do a lot more math and research before I started thinking about it. But just the idea is awesome.

Wouldn't you want to own your own island?

Build a castle on it.

Aaron

@JoshuaAslanSmith Is there a fast way to setup monster stats or do you have to do it all manually?

In roll20

Joshua Aslan Smith

you can copy tokens

and their stats copy

Inbar Rose

There were Templates right?

Joshua Aslan Smith

so if you have multiples you only have to do it once

Inbar Rose

That you could pregenerate?

Joshua Aslan Smith

3:44 PM

And you can save them for later I believe

Inbar Rose

Generally - think of the roll20 platform as the display element of the game. most of your data/information should still be somewhere else.

Aaron

@JoshuaAslanSmith Ok. So you have to manually enter them at first at least.

Inbar Rose

Like google docs, or on a notepad near your desk

Joshua Aslan Smith

yeah theres no fancy import tool if thats what you are asking

Aaron

@InbarRose Oh most of it is elsewhere but I was just testing what all roll20 can do.

Joshua Aslan Smith

3:46 PM

Roll20 exists because it avoids proprietary info in the platform, you can bring it in as a user, but its free and lawsuit free because they arent actively hosting Paizo or WOTC product data

actually you can stat up a full character sheet in roll20 save journal notes have hidden gm notes, players can write notes on their journal only gms can see etc

you could offload everything into the system

Inbar Rose

I don't recommend that.

That system is very fragmented, there is no way to retrieve your data in a meaningful way without way too much effort.

It is a "Display" mechanics for the game.

It's very easy to copy-paste your content into roll20, much harder to extract it.

Joshua Aslan Smith

4:33 PM

he's edited it, reopen votes if you feel it qualifies

1

Q: Should I choose FAE or Dungeon World for an easy to learn, first time RPG for smart 11yos and a GM who last played AD&D 30y ago?

I'm looking at FAE or Dungeon World for a first RPG for some ~11 year olds with me as a GM (who hasn't played anything but AD&D in nearly 30 years). The kids are interested in a D&D style setting, being fans of Skyrim & LOTR, so having a system of traditional classes & magic worked out is defini...

Arp Laszlo

Hello folks!

Joshua Aslan Smith

hello!

Arp Laszlo

I feel like an old fart with the questions I'm posting

Joshua Aslan Smith

So chat can be asynchronous when you "@username" someone it notifies them through the SE inbox so they can see chat texts directed at them at any point

I voted to reopen and hopefully others do as well

Arp Laszlo

excellent, that's good to know

i need to hit the storage facility & get my AD&D materials

Joshua Aslan Smith

4:38 PM

did you have any questions about Dungeon world in specific you needed answered? About the mechanics and/or the sort of meta approach the game has

Arp Laszlo

i recall way too much dice rolling as a kid and i'd like to avoid that.

DW's rules are much more than FAE so I've skimmed over them rather than read through them all, so it's a bit more mysterious. My main objective is something the kids can get hang of quick so they can play & have fun more than get stuck in the rules.

Joshua Aslan Smith

So as one of the commentators said basically the majority of Dungeon worlds rules are on the GM side

I should find some play examples (also if you watch that video someone linked on the original question where I first suggested it)

So everything on the character sheet and the basic & advanced moves are things players can do

but they never call out to those

You don't say I'm going to break bars and bend gates (fighter ability) to the GM

You say, I/character name is going to try to bash the door open

for any normal character you'd probably just have them roll a strength check saying "roll 2d6, add str mod" except knowing the character is a fighter and has bend bars and break gates that they would get to apply the roll to that instead of a basic check

classes with spells are more complicated, but the weapon focused classes like fighter or ranger are very straight forward

Arp Laszlo

4:59 PM

That sounds pretty good.

Joshua Aslan Smith

So thats why I was tryign to sell it over fate, in Fate your son would need to think about when and how to spend his fate points effectively

Arp Laszlo

Is that significantly different from FAE?

I see what you mean.

However, these kids are analytical nerds. They might like keeping track of points and such.

Joshua Aslan Smith

About self-compelling (Both the GM and the Player can compel the Character on a trait/whatever-the-term-is

I like Fate as well, its all about the rise and fall and heroic journey, that failure is never a waste but fuels future success

but while fate is narratively focused, you still use mechanical terms when playing "I spend a fate point to tag an enemy with "Lost in the dark"

Im going to roll my wits to try to outsmart this guy in the poker game

etc.

In dungeon world the players shouldnt really ever mention the mechanics

Fate is like you an author writing a story about your character, Dungeon world is like your an actor playing your character

theyre both great systems they just have different approaches to how they achieve their narrative focus

Dungeonworld was tough to wrap my head around when I first started playing because I came into it off of D&D 4e which is very mechanics heavy (In a good, rigorous and litigious way) so I was always telling my DM which move my character was making rather than what my character was doing which was wrong

Your son, being a new player shouldnt have that issue

Arp Laszlo

OK - I definitely like DW's approach there. I would like to make it seem more natural than mechanical.

Joshua Aslan Smith

Especially if you actually keep the moves sheets to your self

Arp Laszlo

5:05 PM

I think we may have a winner. That made a lot of sense to me.

Joshua Aslan Smith

glad you came to chat

its easier to dialog here

Im usually on between 9 and 5 US EST/ -5GMT so if you have other questions or concerns come back

And feel free to write questions too!

Arp Laszlo

thx!

Joshua Aslan Smith

direct mechanics questions are super easy on the site, your question that was on hold was simply because the Q&A format we have here is about creating questions that have definite answers so you have to frame recommendation questions in a way where instead of "which is better" it becomes "Which of these two well fit my requirements x y and z"

because the first is purely opinion whereas the second you can actually give mechanical rules and experience as examples

Arp Laszlo

it's interesting but sensible. The nerd in me digs the specificity needed.

i guess my next Q would be where to find a setting/campaign. Or can AD&D materials be easily converted?

Joshua Aslan Smith

Did you pick up Dungeon world? Theres a lot of enemies in the core book already that you could easily use and really good guidelines for making monsters. As far as the world and such theres also a good amount of GM guidance on how to incorporate people, places, and things.

Ill try to find any specific AD&D stuff

you might want to search in the codex

codex.dungeon-world.com

its a monster sharing database for custom (or imported) mosters

it has a search function

someone might have already gone to the trouble to convert AD&D monsters into dungeon world terms.

Arp Laszlo

5:15 PM

I did find the codex, that's pretty cool.

this is where I was reading the rules: dungeonworldsrd.com

Question: what's the difference between rpg.drivethrustuff.com/product/108028/Dungeon-World & dungeonworldsrd.com? I take it the latter is not the complete rules?

Aaron

So I am thinking of keeping a bestiary for my players because I am going to have reoccurring monsters so I thought I would give them a chance after each battle to investigate the monsters and learn things about them. Any suggestions on where I could keep this in a organized manner and have links to certain monsters on an index page of some sort?

Joshua Aslan Smith

@ArpLaszlo this is what you get if you buy the PDF

You Have Purchased This Product
(Compendium Classes Collection (1up))
(Compendium Classes Collection (spreads))
(The Barbarian)
(Character Sheets)
(Dungeon World (color, spreads))
(Dungeon World (color, 1up))
(Dungeon World (b&w, spreads))
(Dungeon World (epub))
(Dungeon World (mobi))
(Dungeon World (b&w, 1up))
(World of Dungeons (b&w))
(World of Dungeons (color))
(All Files (zip archive))

you get some bonus classes, some nice artwork, and other extras

Arp Laszlo

5:31 PM

Ooh - I was always partial to Barbarians, that was my favorite AD&D class.

Any suggestions on finding a prefab campaign or converting from AD&D?

Joshua Aslan Smith

yeah its total conan the barbarian stuff mixed with like Visigoths sacking rome

trying to look into that, basically any D&D module could be converted

@waxeagle that 4e dwarf question sounds like some 3.5isms imported into 4e

Arp Laszlo

I need to fish out my old mods. I'm intrigued by Freeport too, I like the idea of a setting within which to create a story.

wax eagle

@JoshuaAslanSmith to me its um...hey 4e doens't care how old you are, move on

@JoshuaAslanSmith there are a couple of traps in ToH that will zap your lifespan...what effect that has on a 4e campaign are essentially up to the DM

Joshua Aslan Smith

Toh?

oh tomb of horrors

Aaron

Hey @JoshuaAslanSmith Do you think the roll20 subscription is worth it?

SevenSidedDie

5:54 PM

@ArpLaszlo The text on dungeonworldsrd is the complete text from the book, so you're not missing any actual rules in using that. (The "SRD" part is misleading, because unlike actual SRDs, it's a perfect copy of the game text. I think the site owner [who isn't a DW author] stuck "SRD" on there because that's what people google for when they mean "free version of the game".)

The book is nicer to read though, and I personally enjoy supporting authors more when they bravely give their game away for free. :)

Arp Laszlo

I can't quibble over $10, I like supporting creators :)

SevenSidedDie

@JoshuaAslanSmith I just wanted to note that there aren't any "strength checks" in Dungeon World, that would have to be done with a basic move or no roll at all. We actually have a question precisely about what to do when you want to bust down a door without having the Fighter's Bend Bars/Lift Gates move:

17

Q: Is there the equivalent of a "Skill Check" in Dungeon World?

So in Dungeon World, everything breaks down to 'moves'. What about situations where a move is not available, but a check of some sort is called for, such as in the case of a non-fighter who wants to kick down the door? What mechanism do you use to resolve that situation?

dungeon-world

@ArpLaszlo I'm currently running Dungeon World using Waterdeep and Undermountain, from AD&D 2nd edition Forgotten Realms. You're welcome to pick my brains about converting!

And we've got this question about using existing settings in Dungeon World:

14

Q: Playing Dungeon World in an established setting

World creation in Dungeon World according to its principle is meant to be broad and keep some blanks for the players to fill. But what about an established setting like Forgotten Realm or Greyhawk? Famous settings like those leave little place for blanks to be filled. Am I wrong to think playing...

campaign-settings dungeon-world

Joshua Aslan Smith

@sevensideddie let me take a look

SevenSidedDie

@JoshuaAslanSmith Basically it boils down to "Is it dangerous? Defy Danger to do it. Is it safe? It just happens."

Joshua Aslan Smith

6:11 PM

thats a good point, I could see it coming up as a door you normally wouldnt be able to bash but your're doing some kind of leverage thing and using all of your strength, the kind of door that bend bars was made for. Theres a real possibility of real injury

@sevensideddie you are right though that it was a major flaw in my example

Bend bars and break gates was the only move I could think off the top of my head that really encapsulated the feel of dungeonworld and how classes differentiate from each other.

SevenSidedDie

@JoshuaAslanSmith Yeah. Or if your method of doing it is just really obviously going to work, like "Paladin, come with me and grab that statue we found, we're going to use it as a battering-ram," then it just works.

The move that does that for me is the wizard's Ritual. Anyone can do a ritual, if they can figure it out. It'll be dangerous for sure, and probably every step along the way of learning the ritual, finding its components, and actually performing it will be inviting danger to defy. Meanwhile, the Wizard just does it, and the GM says what the cost is.

For the Wizard, a ritual is a move. For every other class, a ritual is a whole damn adventure.

(Actually, not every step will be Defy Danger. Lots will probably be Spout Lore, Discern Realities, and such like that too, to research in libraries, remember bits of legends, decipher runes, etc. And if there are creatures in the way, there will be fights too, with their own moves.)

Arp Laszlo

@SevenSidedDie Ooh - Waterdeep rings a bell. I just googled it and the map looks familiar, I might have it!

SevenSidedDie

@ArpLaszlo I picked Waterdeep because it's where I'd run a lot of adventures back when 2nd edition was still the most recent edition, so I knew it well. I could run it in Dungeon World by memory. Using settings in DW works really well when you can do it just off remember bits and pieces on the fly. :)

Arp Laszlo

thx, I need to make a run to storage facility!

SevenSidedDie

A city is also just a great place to play DW, because a city presents an endless source of suddenly-there things for the PCs to interact with. A city meshes well with the msot free-wheeling end of the spectrum of GMing the game. I think Freeport is also an excellent starting place for that reason.

Joshua Aslan Smith

6:33 PM

nice yeah

@aaron Im not a subscriber so I wouldnt know, I dont even know whats offered

DuckTapeal

7:02 PM

The RAW is Raw-diculous!

Sorry, had to get that out of me before I exploded.

Joshua Aslan Smith

lol

Arp Laszlo

@SevenSidedDie is there any conversion needed for Freeport? I'm getting some good suggestions from the DW G+ group too.

SevenSidedDie

@ArpLaszlo There shouldn't be anything that needs straight converting; the DW-way to do things is to accurately reflect the fictional reality of a thing, and letting moves (player-side or GM-side) flow from that. For creatures, they're converted with a "20 questions"-style process: "Making Monsters" subsection in the Overview section of the Monsters chapter.

Arp Laszlo

ok, thx

SevenSidedDie

Monster stats can be created ahead of time for the eager GM, but they can also be done on-the-fly if you're OK asking the table for a short pause (like, bathroom-break or drink-fetching sized pause) during the game.

3

(Also, the DW G+ group is excellent. The authors hang out there, and it's very active.)

Oh, if you haven't already, bookmark the Dungeon World Guide to read after you get through the actual game text. It re-explains how the game ticks in a way that has helped it click for a lot of new GMs.

2

Aaron

7:18 PM

@JoshuaAslanSmith Ok.

Arp Laszlo

7:29 PM

@SevenSidedDie Much thanks, getting excited! Always fun to share stuff we love with the kids :)

Aha - I do have the guide, that was the pdf I referred to earlier.

SevenSidedDie

@ArpLaszlo I have my own 6yo, and when she's old enough for rules-based roleplaying, it's Dungeon World I'm planning on using. :)

Arp Laszlo

Well there you go! I do like Fate for offering more genre flexibility. otoh, my 9yo girl likes Skyrim along with mermaids and such. I can see switching to FAE or Fate they like rpgs a lot.

KRyan

8:36 PM

@DuckTapeal Ah, you're here

deleting extraneous comments now

DuckTapeal

Same.

KRyan

@DuckTapeal I wasn't disagreeing on the point that it's up to the DM (though actually, I do object to that on some level; it's a matter of group expectations, which may be up to the DM for some groups, but not all)

I was just objecting to your list of explicit examples, which is heavily following your own preferences

rather than leaving things open to be decided by the group in question

DuckTapeal

My list of examples ends with "However, you'll have to ask your GM for specifics." and is qualified by saying that those are things that "you probably want to steer clear of".

I'm not saying that those things will automatically revoke your druid powers.

Just that they are likely bad things to do.

KRyan

@DuckTapeal don't think those qualifications are strong enough

@DuckTapeal because I don't necessarily agree, and the list itself undermines the fundamental point that our opinions on what is damning don't actually matter

something like, "For example, in my games, you should probably steer clear of..." would work much better

IMO, anyway

DuckTapeal

I think that's clear enough when I say that you need to ask your GM for specifics.

KRyan

8:40 PM

not like I've downvoted you or anything; your answer's fine. I just think this would improve it, and I find that line's undermining enough that I haven't upvoted

DuckTapeal

Edited.

KRyan

awesome, that's perfect, IMO

well, aside from the enshrining of the DM, but that's part of the game

personally I'd consider something like this to be very much more to be the purview of the group's collective expectations, rather than DM fiat, but the rules do give the DM the "right" to make that fiat

Lord_Gareth

9:01 PM

And now I bring you, psionic dragon beta test

dreamscarredpress.com/dragonfly/ForumsPro/viewtopic/…

The Oracle

10:03 PM

0

Q: Why did the Community user delete one meta post by a deleted user, but not another?

The user lately known as xxx got their account-deletion request fulfilled earlier today. Shortly after, it appears that the meta post (10k users) at the centre of that event was deleted, while this related one by xxx wasn't. Why is that? I don't know that we really need the first meta post in a...

support

Metool

10:28 PM

Stars everywhere overnight.

(I suppose that's normal, strictly speaking.)

Metool

10:45 PM

Hmm, remind me how a deleted user needs to retain anonymity of votes?

[reads more] Ah.

doppelgreener

@Metool Stars everywhere, constantly, all around us, reminding us that beyond our small, small world is an eternal, unending and uncaring abyss. Welcome... to Night Vale.

Metool

@JonathanHobbs Heyo.

doppelgreener

@Metool Hi!

(what you said sounded like the beginning of something from Welcome to Night Vale so I had to write the rest, haha)

Metool

(I just realized I missed most of the day, not the night.)

doppelgreener

The company my current project is with just implemented Secret Questions & Answers in their login system... somewhere, somehow, I want to write a mini-rant and maxi-tear-apart of SQ&A and how they are one of the worst things you can do for someone's security.

user61230

10:59 PM

The secret is to give completely unrelated answers to security questions.

Metool

"What is your mother's maiden name?" "1590 Portage Avenue"

user61230

^ exactly - is actually much more secure than answering the questions

doppelgreener

@Emracool sure, that helps, but even if you answer them with unrelated or randomly-generated-character answers - they're the worst password recovery mechanism, and they probably do more to sabotage a user's security than aid it.

SevenSidedDie

@Metool Did you get a -X: user deleted reputation notice too? A bunch of us did. (Ironically, that makes the votes less anonymous, if you notice where the difference is. I know who downvoted a random older post of mine, now, and probably why...)

Metool

@SevenSidedDie Why yes, for -5.

user61230

11:07 PM

@Jonathan Huh, that's interesting. I agree there are certainly much better mechanisms out there, but in what way do they degrade security?

SevenSidedDie

@Emracool They're often the sort of thing that can be easily got from a victim by social engineering, or easily researched.

Mother's maiden name? How hard is that, if you're personally targetting someone?

user61230

@SevenSidedDie See above - even with randomly generated characters?

user61230

Answering with unrelated responses

SevenSidedDie

@Emracool In that case it's fine, but as a security designer, it's a bad idea because your random-answer method is statistically irrelevant. Most people will be vulnerable.

user61230

Ah, sure, makes sense, thanks!

SevenSidedDie

11:11 PM

I suspect that's why two-factor authentication is becoming more common. Also, for why most sites don't bother with using such questions anymore, and instead just assume your email is a secured channel.

Zachiel

I got the... Pundit silver badge

what's a pundit?

doppelgreener

@Emracool (a) A user with poor sense of security may not know to do anything other than answer the question. So they'll answer it, and as SSD pointed out, that makes their account easy to steal. (b) If they're going to give away their password in a scam email, they'll probably give away their secret Q&A's too. Meaning even if they change their password, the scammer can just keep getting their account back, forever, for all eternity.

Metool

@Zachiel A person who makes comments, a critic or commentator.

user61230

Sense.

doppelgreener

(c) You can't change your Secret Q&A's, enabling #2. If you could, the same scammer/hacker who dives into your account and changes your password could also just change your Secret Q&A's, thus rendering it pointless as a reliable password retrieval mechanism upon losing control of an account.

Metool

11:15 PM

@Zachiel What's it for?

Zachiel

@Metool high voted comments

@Metool makes sense

doppelgreener

So the users who are likely to have their accounts compromised anyway are now more vulnerable with secret Q&A's than without them.

user61230

Yeah, that makes sense.

doppelgreener

The others, like us, picking unrelated answers or randomly generating arbitrary-length strings, aren't impacted anyway. I have two-factor Google authentication enabled, so people can't log into my Google account without also physically stealing my phone. The most secure thing for me is to just get an email reminder.

Zachiel

11:32 PM

Who wants to help with this D&D 4e artifact I need to customize to my party and bend into legal mechanical shape?

@BESW, if you're not fighting against time with that job you mentioned, maybe? @waxeagle? I see Joshua is not online and my "who plays 4e" memory is really short tonight.

I'll be in the Statblock Forge detailing the thing, so people can chime in all night long and maybe I'm gonna find some ideas tomorrow. Yay time-skips.

doppelgreener

(actually, I say we're not affected, but we are, because there's now extra points of weakness or access to our account)

Alex P

The best is when you hit "recover password" and you get an e-mail with your password. Rather than a new temporary garbage password.

Like, don't you have to actively work to make a system do that, in 2014? Because the off-the-shelf tools are all saving hashes, not passwords?

doppelgreener

@AlexP [shriek]

I haven't experienced that one before thankfully

user61230

There's one that's even worse. At a college I was applying to, they give you this code called a RedID

user61230

One of my friends looked at it, and went "that's just my social security number with the numbers moved around."

doppelgreener

11:44 PM

Still the best approach is probably: "here, click this link and reset your password on our site", for three reasons: (a) it skips the intermediate step and doesn't waste my time. (b) nobody gets tempted to take the temporary(!!) password and keep it. (c) the most important one: I won't be able to actively reset your password and mess with your access to your account using only public information.

user61230

RedIDs are attached to personal information and are not secured.

doppelgreener

If I know you have an account on that site and I know your email address, I can go to the "I forgot my password!" link, and get the site to change your password for you and screw with you.

@Emracool How would someone exploit them?

user61230

How would someone exploit knowing your social security number and personally identifying information?

Alex P

Though, honestly, all this pales in comparison to how hard your immediate relatives could screw you even without knowing any personal information.

Is your target 18 years old? Call and say you're their dad.

Maybe know their birth date just as a backup.

Many companies will just let you do whatever over the phone.

Zachiel

@Lord_Gareth I think you might be interested in rpg.stackexchange.com/questions/36884/…

doppelgreener

11:57 PM

@Emracool I dunno, I'm not actually familiar with what the social security number is.

We have tax file numbers which identify us as an individual in the tax system, and some other numbers, but I guess it'd be like someone using my driver's license number for identity theft?

user61230

@JonathanHobbs Ahhh, that makes sense. A social security number is, in essence, a personally identifying number which is used for security in a lot of places.

user61230

Sorry, I assumed :/

doppelgreener

@Emracool Oh dang, okay. So it's relevant to a lot of services... I see how that'd be a problem.

user61230

It comes from the Social Security Act, which you pay into over the course of your life, but because it gives each person an individually unique identifying number, it's been used for security ever since.

user61230

For instance, if you want to call Verizon for support, you have to verify the last four digits of your SSN - otherwise they'll just dismiss your call.

Alex P

11:59 PM

Opening a bank account, applying for a credit card, &c.

Transcript for