In order to limit (let's not dream) the creation of "bogus" clubs to take advantage of the benefits granted to level 1 clubs, in particular through dubious transfers, I propose the introduction of a double authentication system (sending an SMS, for example) to :

• create a new club
  but also
• put a player on the transfer list
• buy a player from the transfer list
• possibly also to carry out certain operations such as launching a build or loaning a player

Even if some clever people use a 'friendly' phone number to create a bogus club, they'll no doubt find it difficult to keep the club going in the long term and even in the short term, as I think the admins could have a database that would allow them to see the phone number associated with the club and identify duplicates.

I'm curious to know if there are any technical obstacles to setting this up. In any case, my bank knows how to do it, my tax office knows how to do it, almost all the service providers I use with a login know how to do it, etc...

Unfortunately, I think this goes completely against the direction the game seems to have taken.
I get the feeling that a lot of changes have been made to appeal to an 'easier' audience.
You see, the manager who downloads the game, tries it out very quickly, is quickly helped (dynamically) with aids, doped-up mentoring and so on.
And then, they don't have to think too hard (training sessions simplified to the max, simple tactics), and they don't need to be on the game a lot (logging on once in the morning on the metro, and once in the evening during a break).
So if I've got my facts right, I think that setting up this verification system makes it much more difficult to catch consumers. And so I think it goes against the current policy (I'm afraid it's "more managers = better business for the Store", which is understandable, and can be defended, to be honest).

That said, you're absolutely right to point out a real concern about security in the game. By that I mean the fight against cheating.
But when A45 says in full audio that "we can now detect multiplayers very easily", I think we've all understood where we stand.... :/

When he sees that the admins are all going to give up their jobs, he'll back down.
Otherwise he'll have to get used to the idea that cheating is part of the game.

Double authentication when creating an account once and for all by registering a telephone number and then having to validate the code received by SMS only when making a transfer makes life infinitesimally more complex for the 'normal' player but enormously more complex for the 'cheating' player.
So as far as I'm concerned, there's no point in debating whether or not to introduce such a system.
..unless the aim is to make people believe that there are dozens of new players every day (at the risk that 90% of these new players are multi-accounts).

Rather than sending a code by sms for each action, a multi-account player often has to log out, so the code for each connection seems better. I do agree, however, that double authentication is needed.

Perhaps we could have a clear and honest communication from Aymeric on this subject?
Because he really did say in his voice that it was now very easy to detect multiple accounts...

But when you dig a bit, you quickly realise that there are a lot of them (plus those with wives, cats and so on...).

I think the majority of the community is very worried about what's planned for next season!

Personally, I wouldn't mind every time you log in, but you're going to get a lot of moaners whining that it's too much.
I think that at creation to register the phone and then only occasionally to validate 2 or 3 sensitive operations such as transfers (not auctions), choosing a sponsor, launching a build, would be enough for now and would reduce fraud considerably and simplify the work of the admins by also considerably limiting the time of an investigation for multiple accounts.

The simplest solution is to stop all aid at level 1, as is the case now, and that would solve a lot of problems.

Well, if I tell you (or VF) that my phone number is 06 11 71 45 64 what difference does it make to me?
What exactly am I risking? Canvassing?

Against
Not everyone has a telephone number (I don't have one myself)
Or an alternative to SMS verification

Many of us avoid talking to some of you, it's not to give you our 06!

Apart from this double authentication when creating an account, it will simplify life for admins and give them access to a panel of logs in terminal format that logs the IP of each connection, which will make life a little easier for the IP addresses.

Or mm crazier a script or bot that scrapes accounts with the same IP or devices or further added a few suspicious parameters to identify duplicates and automatically alerts the admins for manual verification.

You don't need a script or bot to scrape because you have server-side logs with this information.

OAuth is just a protocol for connecting with another account, like "connecting with google", it's not this protocol in itself that will restrict accounts.

I don't think there are any solutions that are at once simple, not costly in terms of time/money or RGPD-friendly for this subject, or even that our opinion will matter.

Even if you can have several phones (personal + business), not to mention your spouse's, your children's, your neighbour's etc... It's still less comfortable for a cheat to manage his multiple accounts than with his ten or fifteen email addresses that he can create for himself at any time in a matter of seconds.

PS: I get PMs from people telling me that those who are against double authentication are doing so because they have multiple accounts :) :) :)
Personally I don't think that's why, but there's just a bit too much paranoia on their part because they should be thinking about the countless people they've already given their number to without even thinking about the illusory consequences they're claiming.

That's your point of view.
On the other hand, you might think that people who are prepared to give out their number everywhere, without knowing where they put it (as in the case of a newcomer who doesn't know the game) are being stupidly careless.
Personally, I don't think that's it, but there's simply too much recklessness on their part, because they should think about the countless people who have suffered major mishaps as a result (phishing, smishing, identity theft, etc). Having investigated a case on this (a long time ago, I admit), it often starts from nothing and can go a long way.
So you can limit the amount of information that's released to protect yourself. In any case, it has to remain a choice. But for those who don't care, frankly, knock yourself out ;)

Oh dear, I've just left my phone number with the secretary at the garage where I've left my car for servicing so that she can call me when it's ready. .... I shouldn't have done that, I'm already freaking out!

Myforsans, evolve a little; as soon as someone disagrees with you, you either imply something or take the piss out of them. It won't help your argument, quite the opposite.

The initial idea isn't bad, although I'd limit it to creating an account. But the security on this game is literally shoddy.

Can you understand why people don't want to leave private data for a game that can't protect itself? Unless they're cheaters, idiots and/or conspiracy theorists?
Personally, I trust my mechanic's secretary more than VF to keep my phone safe.

On the other hand, good news: I've just found out that you're eligible for the renovation bonus to help you change your woodwork. You'll have to pay in advance, of course.

The game is certainly more protected than you think.
Just because there have been two or 3 occasional intrusions (to cheat and not to retrieve contact details), which were ultimately of no consequence, doesn't mean that the game isn't protected. It is, and to a greater extent than you think, otherwise there would have been more attacks.

But above all, recent history shows that cyber-attacks affect all sites, even the most reputed for their security (Public Assistance, NATO, Amazon, etc.). So yes, VF is one of the 3 or 10 million potential targets for a hacker, but given the extremely limited interest for a hacker in knowing the telephones of VF members, I doubt that the VF database would be a priority target for him.

NB: Apart from that, when it comes to saying: Myforsans, you need to evolve a bit; as soon as someone disagrees with you you either imply something or you make fun of them.
I know that the best defence is a good offence, but coming from you and given your reputation, wouldn't that be a bit (a lot) like the pot calling the kettle black? :) :) :)

As far as creating an account is concerned, I can see the point, and I quite agree.

For transfers, no. It has to be flexible enough. I can't imagine how cumbersome it would be for someone who buys and sells.

The initial concern with this subject is a misunderstanding between two terms, which does not make the form any easier:

• Double authentication, the aim of which is to SECURE the user's account from potential hackers who might try to connect to it (hence its presence in banks, health services, suppliers, which contain PRIVATE information such as bank details, addresses, etc.). The idea is simply to trap the hacker a little more if he finds the CDM for the account.

• Digital identity, which is very present in some countries such as China, the aim of which is to control each individual's account, in order to track everything they do (particularly on social networks and individual behaviour). This is also one of the objectives of 'France Identité', where your identity card can be used at any time to connect you to various services (mainly government services, at least at the moment).

What you're proposing here is a digital identity system, to detect multiple accounts, rather than double authentication to provide the best possible security for your personal data that a hacker could find when accessing your account.

Now to the substance:

• The idea is not particularly bad, but it will solve any concerns about multi-accounts in the legal and juridical aspects currently available?
• Is it possible and feasible for the MDJ to create such a system?
• The introduction of ultra-sensitive data (telephone numbers and more) inevitably means that all this has to be made secure. And when you see all the data leaks all over the place on ONLINE sites (and your example of the garage is totally out of context), and the consequences for the user (phone spam, mailbox spam, even harassment and suicide...) following the resale of your data by hackers on canvassing markets, it doesn't look particularly appealing. What's worse, when you consider the mentality and tensions in certain discussions, and the current world where harassment is rife, I don't particularly want someone to be able to access my information (normally, this information is private, so no-one should have access to it except an approved admin and the MDJ), which could allow them to identify me and cause harm IRL. And above all, for the MDJ, it's an investment to secure this system, because in the event of a data leak and subsequent complaints, he'd be risking a lot with the CNIL.

To sum up, what you're asking for is a digital identity rather than dual authentication, it exists, it's possible to put in place, but is it proportionate and appropriate to the situation to take such a measure? Everyone will have their own opinion, but I don't think there's really any firm answer possible at the moment. (This issue has been the subject of debate in France and the EU for several months now, particularly with a view to better identifying the accounts of people who harass or defraud online sites, especially social networks).

VF is a mill. What saves it is that it is known by only 3 peeled and one shorn, that's all.

NB : No.

Yes, Brewen, very well explained.
There's no need, however, in my proposal to move towards digital identification.
Simply
With double authentication,

1. In principle, no more hacking (so that will reassure our friends who spoke earlier)
2. And on the other hand: not more multi-accounts but much less comfort in managing them.

As for the supposed inconvenience for those who buy and sell, I don't think they do 100 a day and validating a 6-digit code received by SMS should take around 5 to 10 seconds :)

OK, but that doesn't change the fact that this is dual authentication, not a digital identity. Even if it's not exactly for the security of our own accounts.

With double authentication, the creator of this club would have had more difficulty doing it.
Deleted club
(even if he could have done it with his neighbour's phone).

Apart from that, everyone is entitled to their own opinion without insulting the other, aren't they? I didn't say that your position was ridiculous, but to say that people who don't want to give their phone number are a bit paranoid, I don't think that's insulting.

For your information, I've just done a test.
I created this club: Deleted club
(admins, if you could please delete it).

I was able to create it between its 2 messages, 15 seconds. I used an email address that doesn't exist.
Maybe that's the first thing to do if you want to start making things more complex.

I suspected that you were at least aware of that, to go so far in your proposals ...
Before looking for solutions to a problem, you need to know where it starts. And here it starts at the very basis that a series of letters or numbers where you include @ and .com or .fr is enough to start the VF adventure ...

Except that creating a real 2nd, 3rd xth mailbox is still more simp'e than taking out a second, third xth telephone subscription to validate the link to validate your registration.

Hello.

Personally, ever since some clever chap wrote to me when I was administrator and said "we know who you are First Name Last Name", without any mistake of course, I've not been keen on leaving my real details on VF.

I wasn't paranoid enough. But since then it's been dedicated mail, and crazy information, because it's not very nice to receive that kind of message.

Personally, I'm always reluctant to give my phone over the net and I immediately leave sites that ask for it when I register.
I like VF and I know it, so I might make the effort, but if I were a newcomer, I wouldn't go through with registration, that's for sure.

I think it's great that after 2 days of discussions, nobody has realised that an automatic SMS system costs an arm and a leg. And there are no limits: I read that we should have two-factor authentication for EVERY connection! Oléééé 😆

I'll give you a quote (because my company sells 2FA or PCI-DSS-compliant SSO), it's 500 francs per month + €0.01 per connection + €0.08 per SMS. Imagine 1,000 players logging on 5 times a day. That's €3,000 a month. And if you want us to integrate it into your app or website, add another 30,000. I hope the Vfstore finally takes off! :D

No kidding, VF isn't Microsoft or Tinder. You really have to think small. It's commendable that you want to have your identity confirmed, but unfortunately the most you can do is send a confirmation e-mail.

The art and manner of making figures say what you want them to say.
You'd think you were at the National Assembly!
1°) There are much cheaper SMS APIs than the one you're selling!
2°) Why calculate the cost of authentication for each connection?
That's not what's being proposed at all.
What's being proposed is authentication when the account is created and authentication from time to time for certain live transfers (not auctions, obviously).
Of course, it would be completely inappropriate to ask for authentication if you log in to change players during a match!
So security doesn't come into play when you log on, but when you want to validate an operation deemed sensitive by the organiser (e.g. a transfer).
But it's true that it's better to let anyone spoil the game at any time.

If you're looking for a laugh, RECORD_AUDIO and READ_EXTERNAL_STORAGE have been added to the Android app's permissions manifest, as has access to your location ('at a glance' and 'fine' versions).

Deactivated by default on your mobile since Android version 6, rest assured.

There are also trackers, which are very common these days: Facebook Analytics, Facebook Login, Facebook Places, Facebook Share, Google Analytics, Google CrashLytics, Google Firebase Analytics, Google Tag Manager.

It's still peanuts compared to horrible apps like Pokemon Go, but it's there.

Of course, MDJ hasn't set this up to listen in on your toilet break and pinpoint your toilet on Google Maps. But these forgotten permissions are all possible vectors for a gifted and malicious individual/group.

(Yes, I'm team paranoid)

Hello commu,

I've been closely following the debates around making VF more secure, and I think the first thing to note and praise is the determination that each and every one of us is expressing to combat cheating in the game in general. Beyond the differences on the method to adopt, the capacities and means available, and even ego squabbles, I believe we are all dismayed and determined to tackle the problem head on. Let's not forget what unites us, and let's not let this burning issue divide and weaken us.

I'm what the commu calls a 'real new manager': I discovered VF between 10 and 15 years ago (gasp) and played it for a few months from memory. I loved it, but life took me away from the game. I came back recently to get involved and, naturally, to play according to my convictions: honesty, investment, merit. So it's sad to (re)discover a VF plagued by scheming and trolling, admins who are brave but have to gnaw their cuticles, distraught managers looking for answers from Aymeric, and an overall cacophony that ultimately serves the interests of the game and strengthens the cavalry of a few discord-bearing gargoyles who thrive on this chaos.

Getting back to the point, I understand that some online betting sites (poker for example) can detect the presence of multiple accounts via the means of settlement used during transactions (cash-ins, cash-outs in particular). This enables them to intervene to ensure that a multi-account player does not end up with 7 different accounts at the same table as another player and deplores him in good standing. What do we know about the verification methods used by VF in this respect?

Could you identify yourself with franceconnect? Ok I'm out

Good evening, if someone is playing with one or more false telephone numbers (there are sites that offer this service free of charge for receiving and sending e-mails), what should you do in this case?...

I'm taking the liberty of raising the subject again when I see the proliferation of multi-accounts :

• to make dubious transfers
• to create ephemeral accounts to hurl insults at the forum or make threats
• to create ephemeral multi-accounts to spill insults or threats on the mini-chat

It's certain that a future (real) new player logging in for the first time will be very keen to sign up to the game if they come across this when they first log in!

All those who supposedly fear for their privacy should open their eyes, they remind me of those who are against CCTV cameras in their local authority but deplore the increase in crime.

Asking for double authentication when creating an account (+ possibly when validating a transfer other than at auction) doesn't seem extravagant to me in terms of constraints and the supposed invasion of privacy, especially when it's the same grumpy people who don't hesitate to do it to make any online purchase.

These proliferating multi-accounts (no pun intended) are going to end up killing the game (and that's the aim of this or these 'creators').

Why not authorize the Multi account ....the game is already rotten by interior, then with the free transfers, one does not care any more....the people eat aloe that it cried with scandal

In fact, double authentication would work in the opposite direction and would be a huge deterrent to managing multiple accounts, even if some people have a personal phone and a business phone.
As I said, it's not an unstoppable trick against multiple accounts, but it will limit the risks and it will be unstoppable in preventing the chain of accounts being created, as is currently the case, by the lizards who pollute the mini chat.

In itself, I wouldn't say no to creating an account, but everything else seems too much for a game like VF.