test content
  • Games
  • Social
  • Arc News
  • Support
  • Zen
What is the Arc Client?
Install Arc
Forums > Home› Neverwinter Discussion › General Discussion (PC)

Neverwinter Gateway Issues 2/19

akromatikakromatik Member Posts: 1
edited February 2015 in General Discussion (PC)
We are currently investigating the issues with the Neverwinter Gateway page and will resolve them as soon as we can. Thank you for your patience.
Post edited by Unknown User on
«1

Comments

  • onecoolscatcatonecoolscatcat Member, Neverwinter Beta Users, Neverwinter Hero Users, Neverwinter Knight of the Feywild Users Posts: 575 Arc User
    edited February 2015
    Screenshot77_zpsb5fc0b6d.png
  • tripsofthrymrtripsofthrymr Member, Neverwinter Moderator, NW M9 Playtest Posts: 1,624 Community Moderator
    edited February 2015
    akromatik wrote: »
    We are currently investigating the issues with the Neverwinter Gateway page and will resolve them as soon as we can. Thank you for your patience.

    Not much to investigate... The SSL certificate expired today and should have been replaced before it expired.
    Caritas Guild Founder (Greycloak Alliance)

    Sci-fi author: The Gods We Make, The Gods We Seek, and Ji-min
  • katamaster81899katamaster81899 Member Posts: 1,157 Arc User
    edited February 2015
    tripsofthrymr wrote: »
    Not much to investigate... The SSL certificate expired today and should have been replaced before it expired.

    Pretty much. You might be able to get it to work by disabling a bunch of security stuff in your browser... but I wouldn't recommend that :P
    dulopa4e1d9.png
    || Axios Guild Leader || Neverwinter Trade Forum Moderator || Infernal Paragons ||
    Check out my foundry, titled "Akro's Gone Wacko", featuring our ex-CM Akromatik!: NW-DL8J7BY5T
    Erza Moonstalker | Lara Moonstalker | Julie Marvell | Erza Moonhunter | Annie Hellangel | Jenn Moonstalker

    Thaumaturge's Time To Shine: A Complete Guide
  • charononuscharononus Member Posts: 5,715 Arc User
    edited February 2015
    akromatik wrote: »
    We are currently investigating the issues with the Neverwinter Gateway page and will resolve them as soon as we can. Thank you for your patience.

    Guesstimate ETA Akro? Doing all my professions in the game would be a horrible pain with the anti-bot finishing delay.
  • lortechlortech Member, Neverwinter Beta Users Posts: 51
    edited February 2015
    *whew* Thought it was my computer there for a minute.
    "One day I will leave this world and dream myself to reality"--Chief Crazy Horse

    "Do what thou Whilt shall be the whole of the Law. Love is the Law, Love under Will."--Aleister Crowley
  • mh0rammh0ram Member Posts: 310 Arc User
    edited February 2015
    Valid from 8/24/2010 4:00:00 to 2/19/2015 3:59:59

    Somebody missed the boat, no biggie.
  • katamaster81899katamaster81899 Member Posts: 1,157 Arc User
    edited February 2015
    Use I.e. and just click on the ignore certificate error, then it works
    dulopa4e1d9.png
    || Axios Guild Leader || Neverwinter Trade Forum Moderator || Infernal Paragons ||
    Check out my foundry, titled "Akro's Gone Wacko", featuring our ex-CM Akromatik!: NW-DL8J7BY5T
    Erza Moonstalker | Lara Moonstalker | Julie Marvell | Erza Moonhunter | Annie Hellangel | Jenn Moonstalker

    Thaumaturge's Time To Shine: A Complete Guide
  • vulpixy01vulpixy01 Member Posts: 8 Arc User
    edited February 2015
    Glad it's not just me then o.o
  • leihngweileihngwei Member, NW M9 Playtest Posts: 164 Arc User
    edited February 2015
    Have to do it the old fashion way and log into the game.
  • silence1xsilence1x Member Posts: 1,503 Arc User
    edited February 2015
    Cert warning is still there. I just renewed a cert for one of our sites and it took less than three hours to get they crt files back. Just saying . . .
    I aim to misbehave
  • tuncdragomirtuncdragomir Member Posts: 39
    edited February 2015
    Same problem here.Lettin the cert to expire is a non-professional and unexpected behaviour from a company such as this.Fix it asap.SSL cert expired we ve investigated for u no need for further investigation.
  • rabbinicusrabbinicus Member Posts: 1,822 Arc User
    edited February 2015
    akromatik wrote: »
    We are currently investigating the issues with the Neverwinter Gateway page and will resolve them as soon as we can. Thank you for your patience.

    Please immediately remove the professions delay, as without Gateway to complete professions it represents a significant barrier to those of us with many professions to collect.

    Thank you.
    The right to command is earned through duty, the privilege of rank is service.


  • voidkvltvoidkvlt Member, NW M9 Playtest Posts: 5 Arc User
    edited February 2015
    rabbinicus wrote: »
    Please immediately remove the professions delay, as without Gateway to complete professions it represents a significant barrier to those of us with many professions to collect.
    Thank you.
    finally somebody who speaks the truth!
    remove that extremely annoying delay, pls!!!
    [SIGPIC]http://image.forumfree.it/1/0/5/5/1/4/4/9/1401264432.png[/SIGPIC]
  • zundak2000zundak2000 Member Posts: 10 Arc User
    edited February 2015
    Workaround: set your system date to yesterday
  • bajornorbertbajornorbert Member, NW M9 Playtest Posts: 272 Arc User
    edited February 2015
    You can still access the Gateway. The browser just notifies you that the cert has expired, but you can skip it and access the gateway as usual. You should get used to it, since issuing a new cert can take as long as 2 weeks.

    That said, how can you forget to renew the SSL cert????? That's some serious negligence from your side, esp since most, if not all, CAs send several notification mails before it expires.
  • two30two30 Member, NW M9 Playtest Posts: 1,168 Arc User
    edited February 2015
    The arcgames.com certificate expires July 11, 2015. I hope it gets renewed before then.
    Neverwinter Tools for evaluating boons, mounts, dyes, etc.
  • justawillyjustawilly Member, NW M9 Playtest Posts: 63 Arc User
    edited February 2015
    two30 wrote: »
    The arcgames.com certificate expires July 11, 2015. I hope it gets renewed before then.

    I'm Betting 1AD they will forget.
  • kvetkvet Member, NW M9 Playtest Posts: 2,700 Arc User
    edited February 2015
    Akro, thanks for posting this - while they're getting it renewed, tell them to use SHA256 and not the SHA1 <font color="orange">HAMSTER</font> cert you guys had on their before. SHA1 can be bruteforced using normal consumer-grade computers in a not-very-long period of time. The cert had a 2048-bit RSA key, which is good (a lot of the SHA1 certs use 1024-bit key lengths, which basically means you can crack the cert in effectively a finger-snap), but you should make sure to use current-standard encryption (SHA1 is considered deprecated).

    EDIT: I should point out -- if you play this game on a public wifi (like in a coffee shop or cafe or whatever), anyone sniffing wireless traffic can steal your PWE login even with the SSL if the certificate is reasonably easy to crack (like any SHA1 cert). If the certificate isn't valid and therefore not working it means there's a good chance your login is being sent in plaintext which, needless to say, is easy to steal. So... 1) be careful out there. 2) don't use the gateway on a public wifi (including on your mobile) unless you can verify the SSL - even then... careful. A guy with a laptop in the parking lot can steal a lot of data from you and you'd never know...

    This isn't a particular vulnerability with the Gateway, mind you, but rather just a fact of life with WiFi. You need to be really careful if you're not on a network you trust (and if you trust the Starbucks network, you're a fool ;) )

    Sekhmet@kvetchus_
    Guilds: Greycloaks, Blackcloaks, Whitecloaks, Goldcloaks, Browncloaks, Spiritcloaks, Bluecloaks, Silvercloaks, Black Dawn
    Tredecim: The Cloak Alliance
  • vyperdrivevyperdrive Member Posts: 56 Arc User
    edited February 2015
    kvet wrote: »
    Akro, thanks for posting this - while they're getting it renewed, tell them to use SHA256 and not the SHA1 <font color="orange">HAMSTER</font> cert you guys had on their before. SHA1 can be bruteforced using normal consumer-grade computers in a not-very-long period of time. The cert had a 2048-bit RSA key, which is good (a lot of the SHA1 certs use 1024-bit key lengths, which basically means you can crack the cert in effectively a finger-snap), but you should make sure to use current-standard encryption (SHA1 is considered deprecated).

    This is the real issue here - Google et al have been gradually working on 'sunsetting' SHA1 certs, and updating their browsers to no longer recognise it as a valid protocol. In effect they are forcing organisations to move to SHA256. Many of these organisation have bought SHA1 licences in 3 or 5 year blocks - don't trust the expiry date quoted earlier in this thread, that just shows the date the browser stopped believing the licence to be valid.

    This article breaks things down well - it also points out the problems to those users of XP who have not updated past Service Pack 2.
  • two30two30 Member, NW M9 Playtest Posts: 1,168 Arc User
    edited February 2015
    So launcher.playneverwinter.com uses the same expired certificate, but I don't think the launcher actually bothers with HTTPS.

    I think it salts and hashes the password then sends it over plain HTTP. (http://launcher.playneverwinter.com/launcher_login http://launcher.playneverwinter.com/static/all/js/cryptic-hash.js)
    Neverwinter Tools for evaluating boons, mounts, dyes, etc.
  • nuudlznuudlz Member, NW M9 Playtest Posts: 285 Arc User
    edited February 2015
    two30 wrote: »
    So launcher.playneverwinter.com uses the same expired certificate, but I don't think the launcher actually bothers with HTTPS.

    I think it salts and hashes the password then sends it over plain HTTP. (http://launcher.playneverwinter.com/launcher_login http://launcher.playneverwinter.com/static/all/js/cryptic-hash.js)

    And why the **** would the launcher establish a TLS connection with a well known login server? the hash.js is just a framework to create hashes - yes, thats correct. The payload is still send over a secured connection...
    The Zisters' Magazine - Subscribe now and you'll never run out of style.

    We are always looking for new models --- Borderline Fashiondolls ---
  • kvetkvet Member, NW M9 Playtest Posts: 2,700 Arc User
    edited February 2015
    Get over yourself.

    I can Google too, though I've known this for years now:

    "The SHA-1 cryptographic hash algorithm has been known to be considerably weaker than it was designed to be since at least 2005 — 9 years ago. Collision attacks against SHA-1 are too affordable for us to consider it safe for the public web PKI. We can only expect that attacks will get cheaper."

    SHA-1 is considered deprecated tech. Period.

    Sekhmet@kvetchus_
    Guilds: Greycloaks, Blackcloaks, Whitecloaks, Goldcloaks, Browncloaks, Spiritcloaks, Bluecloaks, Silvercloaks, Black Dawn
    Tredecim: The Cloak Alliance
  • zebularzebular Member, Neverwinter Moderator, NW M9 Playtest Posts: 15,270 Community Moderator
    edited February 2015
    Calm down folks. There's been so many companies even more reputable than an MMO company who have forgotten to renew certificates. Google has even forgotten a few times over the years, the BBB site forgot for over a month, Yahoo and even major national banks have forgotten -- just to name a few, heck even Microsoft has forgotten a few times. It happens, it will be fixed. Keep calm.

    Safe travels,
    Archmage Zebular of Mystryl
    PWE Community Moderator
    [ RoC | ToS | Support ]
    [ My Character Bios | Discord: Zebular#9524 | In Game: @zebular (PC) • @MtnDewFreak (XBOX) • @Terraseer (PS4) ]
    Zebular
    [ Support Center • Rules & Policies and Guidelines • ARC ToS • Guild Recruitment Guidelines | FR DM Since 1993 ]
  • mortelunesmortelunes Member Posts: 5 Arc User
    edited February 2015
    I understand why they don't communicate on the certificate expiration ,
    it must be very embarrassing for a pro compagny to forget to renew their certificate, it make them look as full noobs. With the next launch on Xbox this is a very untrustfull and unprofessionnal image given.
    So as a workaround put the date on your computer back a couple of days.
    Setting your browser to ignore certificate is NOT a good idea because if i was a hacker i would choose this time to intrude and fake the gateway to phish thousands of accounts.
  • nuudlznuudlz Member, NW M9 Playtest Posts: 285 Arc User
    edited February 2015
    kvet wrote: »
    Get over yourself.
    SHA-1 is considered deprecated tech. Period.

    Still no reason to run around and spread panic everywhere by telling people how ez pz sha1 is to crack...
    SHA1 can be bruteforced using normal consumer-grade computers in a not-very-long period of time.

    That's all im referring to.
    The Zisters' Magazine - Subscribe now and you'll never run out of style.

    We are always looking for new models --- Borderline Fashiondolls ---
  • kvetkvet Member, NW M9 Playtest Posts: 2,700 Arc User
    edited February 2015
    two30 wrote: »
    So launcher.playneverwinter.com uses the same expired certificate, but I don't think the launcher actually bothers with HTTPS.

    I think it salts and hashes the password then sends it over plain HTTP. (http://launcher.playneverwinter.com/launcher_login http://launcher.playneverwinter.com/static/all/js/cryptic-hash.js)

    It uses a Javascript-based encryption engine that uses available libraries, and you're right, it doesn't use SSL. I actually posted about it to the Alpha forum back when the game was in Alpha, along with Wireshark logs showing how to steal a user's credentials over an unsecured wifi. It was ignored (or at least, it was never replied too anyway). No big deal, it's pretty unlikely anyone will care enough to do it, although not long after I posed, they implemented SSL on the Gateway since that by itself will stop 99% of the risk. The other 1%... like I said, no one that knows how to deal with SSL would waste the time just to get someone's PWE account, so in a practical sense, I don't think there's much risk. Just don't play the game on an untrusted network - like I said, that pretty well goes for anything that involves you logging in, so Neverwinter isn't really some sort of special outlier there.

    Sekhmet@kvetchus_
    Guilds: Greycloaks, Blackcloaks, Whitecloaks, Goldcloaks, Browncloaks, Spiritcloaks, Bluecloaks, Silvercloaks, Black Dawn
    Tredecim: The Cloak Alliance
  • nuudlznuudlz Member, NW M9 Playtest Posts: 285 Arc User
    edited February 2015
    kvet wrote: »
    and you're right, it doesn't use SSL.

    Ye - correct. It uses TLS.
    The Zisters' Magazine - Subscribe now and you'll never run out of style.

    We are always looking for new models --- Borderline Fashiondolls ---
  • kvetkvet Member, NW M9 Playtest Posts: 2,700 Arc User
    edited February 2015
    zebular wrote: »
    Calm down folks. There's been so many companies even more reputable than an MMO company who have forgotten to renew certificates.

    Yes indeed - don't take my comments as being particularly critical of their web team forgetting to renew a cert. It really does happen, especially if the teams are siloed due to a merger. My comments are just general concerns that are apropos to the question of the game's security overall.

    Also -- depending on how they sign their certs and how the company's internal bureaucracy works, and how they deal with change management on their production systems, it can be a couple days. If you are using the gateway from your own home, there is NO RISK HERE despite any doom and gloom warnings on your browser.

    Sekhmet@kvetchus_
    Guilds: Greycloaks, Blackcloaks, Whitecloaks, Goldcloaks, Browncloaks, Spiritcloaks, Bluecloaks, Silvercloaks, Black Dawn
    Tredecim: The Cloak Alliance
  • jonyhdezjonyhdez Member Posts: 0 Arc User
    edited February 2015
    My browser says that the certificate for *playneverwinter.com has expired by 02/19/2015.
    Is it secure to use gateway or should i wait until cert. is updated?
  • elvenaarelvenaar Member, NW M9 Playtest Posts: 81 Arc User
    edited February 2015
    Since it's the weekend coming I'm guessing Monday at PST time? So us europeans will have to go 3 days w/o easy access to the game. Thank you very much Cryptic.
    Sorcerer.jpg
    D&D Home Page - What Class Are You? - Build A Character - D&D Compendium
This discussion has been closed.