What does "secured" really even mean? Come here and let me pick your mind.

[Trump 2016]

I don't really know the ins and outs of Neopets, so I wanted to ask this.

Take this scenario:

Someone cracks into an account that has been inactive for a year and spends their NPs on an item.

You buy that item on a shell. You eventually transfer it to your main.

The person whose account was cracked comes back to see their NPs gone. The person reports their loss. Let's say the NPs were spent 3 months before they came back. The staff go back to records from 3 months ago and track what happened.

You get frozen. I think.

Let's modify that scenario a bit:

Someone cracks into an account that has been inactive for a year and slowly but surely changes the password, PIN and e-mail and then spends their NPs on an item.

What follows that from the buyer is the same, but now let's say the person whose account was cracked comes back to see they can't log in at all.

They file a report using the e-mail with which they originally made their Neopet account and they punctuate it with sufficient information to prove it belonged to them (mentioning what avatars they had, what was in their SDB, etc.).

You get frozen. I think.

Okay, so what's my point?

I see a lot of threads saying the goods and/or accounts are secured, but they mostly go on to mention account inactivity or nothing at all as a sign of it. Here are my two questions:

1. Are most people who use "secured" just saying a certain amount of account inactivity is a good enough bet for safety?

1a. Is it understood that if the original owner comes back, you are screwed?

2. Shouldn't actual securing mean that the seller has access to the original e-mail (where they would get it because the e-mail itself became unregistered due to inactivity)? I almost never see the original e-mail mentioned as an asset.

3. In both my first scenario and then the modified scenario, I assumed staff could go back and trace what had happened 3 months ago, which would've led to you being frozen. Is my assumption incorrect? Can they not trace back that far, in which case "secured" can fittingly be attributed to a certain amount of inactivity?

[Lincoln]

When I use secure, I never mean that there's zero chance of a freezing. That's impossible.

The term means that, relative to being unsecured, precautions have been taken to lesson the chance of TNT thinking you're sketchy.

If I cracked an inactive and give you the password, you could get frozen.

But if I cracked an account months ago and give you the ip, original email, all three passwords used by the account, and the pin and birthday? Hell, even if the original owner filed a ticket, you seem more like them than they do!

The point is, there is no 'completely secured" or risk free account. Sellers denote accounts as 'secured' to show the added security. I sell accounts for which I don't have all this information. And for those accounts, you have less of a chance to get away with cheating. But for the most part, inactive is inactive, and as long as you aren't being a dumbass, it should be okay.

[Trump 2016]

Edit: Added a bit more to this. Hope this will clear up more. Please review. Thank you so much!

When I use secure, I never mean that there's zero chance of a freezing. That's impossible.

The term means that, relative to being unsecured, precautions have been taken to lesson the chance of TNT thinking you're sketchy.

If I cracked an inactive and give you the password, you could get frozen.

But if I cracked an account months ago and give you the ip, original email, all three passwords used by the account, and the pin and birthday? Hell, even if the original owner filed a ticket, you seem more like them than they do!

The point is, there is no 'completely secured" or risk free account. Sellers denote accounts as 'secured' to show the added security. I sell accounts for which I don't have all this information. And for those accounts, you have less of a chance to get away with cheating. But for the most part, inactive is inactive, and as long as you aren't being a dumbass, it should be okay.

Hey, thanks for that.

I guess I wanted to narrow down some points of finality. You mentioned the original e-mail, as I did, as being a great layer of security. Totally agree.

But by the same token:

A. Let's say someone comes back filing a report with that original e-mail.

B. Let's say someone you bought an item from used their NPs to buy that item.

C. Let's say you bought it on a shell from an IP different from the one you use on your main, and that the original owner found out about it 3 months or more after you transferred it to your main from that shell.

I get that if someone were using the cracked account as their new main or something like that, then they're irrevocably screwed. But I'm trying to figure out whether a blip of association screws you as well. Whether staff can trace back what happened with their NPs several months ago, among what must be 100s of thousands of other transactions on the site.

If staff could trace that far back, to them it would look like 3 IPs involved:

1. IP of the seller from that cracked account.

2. IP of the shell account that bought the item.

3. IP of the person who received the item from the shell.

And from there, it would look pretty clear that #3 bought them item, even if they weren't responsible for cracking the account as #1 did and even if staff can't confirm #2 is the same person as #3.

Since I don't really know this game's apparatus, I'm appealing to the experienced people here who might have some insight on how far back something staff can really trace, because then someone would be able to say they're in the clear as long as they've had the bought item on their main after x amount of time, where x represents the period staff can't trace.

[Lincoln]

@(you need an account to see links) may be able to expand on the extent to which JS can access previously used IP addresses.

I provide the IPs last used in my accounts to the buyer.

But aside from that, there is never a 0% chance of getting frozen. Even when accounts are sold by incredibly trusted users, or even if they're legit accounts, you can absolutely still get frozen for it.

But you also need to factor in the responsiveness of Jumpstart. Many on this forum understand how fucking lazy they are when it comes to responding to tickets. Is it likely that you'll get away with stealing an account if the user reports? No, but it'll likely take quite a bit of time before jumpstart acts.

But further, the transfer of nps doesn't necessarily mean an illegit activity is happening. In your example, you ask if a use who buys nps from a compromised account will also be frozen. I don't think this is likely, because TNT would have no way to know whether or not the user who got the nps on site was aware. If the account theif were to use points they found on the account, TNT may reverse the trade. But freezing? Definitely something you could dispute.

Secured doesn't mean full-proof protection. But when I say an account is secured, you have to be pretty unlucky to get frozen!

Additional note: if a user comes back from inactivity and puts in a ticket and you notice as a seller, drop the account. In addition to being the cool thing to do, leaving the account alone could help protect your other accounts, possible even the people you sold to.

[Trump 2016]

@(you need an account to see links) Makes sense; fair enough. Yeah it would be cool if anyone can expand.

Additional note: if a user comes back from inactivity and puts in a ticket and you notice as a seller, drop the account. In addition to being the cool thing to do, leaving the account alone could help protect your other accounts, possible even the people you sold to.

I can appreciate this part. I've never bought someone else's account and wasn't planning on it, and I try to buy non-stolen items, but what led to this thread were concerns over buying what could've been stolen ones.

Thanks again. Let's see if anyone else can pitch some insight.

[j03]

(you need an account to see links) may be able to expand on the extent to which JS can access previously used IP addresses.

@(you need an account to see links) Makes sense; fair enough. Yeah it would be cool if anyone can expand.

I've posted this before but it's probably hard to find digging through the forum search...

When you visit Neopets you are basically leaving your footprints (IP address) everywhere. Is TNT watching everyone all at once? No. If you give them a reason to dig through their logs and check hard enough then yeah they can definitely see the IPs you used on an account.

[Lincoln]

I've posted this before but it's probably hard to find digging through the forum search...

When you visit Neopets you are basically leaving your footprints (IP address) everywhere. Is TNT watching everyone all at once? No. If you give them a reason to dig through their logs and check hard enough then yeah they can definitely see the IPs you used on an account.

Does their data storage have any sort of expiration?

[Vindictive]

Does their data storage have any sort of expiration?

I think I remember someone saying like 2+ years or maybe I'm thinking of something else....

[j03]

Only their server admins would know the answer to that.

[Lincoln]

I think I remember someone saying like 2+ years or maybe I'm thinking of something else....

I'd imagine they have some sort of a limit to it, but I guess it wouldn't be easy to find out how long the data is kept for haha