The Not-So-Magical Part of Magic Online

Pete Jahn


Magic Online has some issues that are unique to an online environment. In the paper world, people rarely steal your identity or your whole collection, but it can happen online. Likewise, paper tournaments don’t go down when the computer hiccups, but online does. Finally, paper Magic judges can deal with any interactions – so the game never locks or freezes due to card interactions or misunderstandings. Online, however, has bugs. Here’s how to handle these problems.

Stealing Accounts

Let’s start with the biggest concern – someone hacking the MTGO servers and stealing your identity. Hacking the servers is extremely unlikely. Online games, including simulations and games like Asheron’s Call, World of Warcraft and so make big money from being online. They would risk their companies if the servers were hacked. Wizards is also part of Hasbro, a Fortune 100 company, and companies like that know how to keep their critical systems secure.

That is not the same thing as stable, however – but we’ll talk about crashes later.

Someone actually hacking their way through a well-programmed and well protected server is actually a very rare event. The vast, vast majority of data thefts are just a result of operator error. For example, certain server operating systems used to install with a standard account called “maintenance” with the password also set to “maintenance,” or a “guest” account with no password. Once installed, the use was supposed to disable those accounts, but a lot of people didn’t bother. The vast majority of data thefts have occurred because people just left the digital doors not only unlocked but wide open. The hackers weren’t really high tech thieves with amazing gadgets – they just walked around trying doorknobs at random until one opened.

(Yes, “maintenance” and “guest” are very dated examples. I’m not going to publish hacks for anything still in use.)

Anyway, the point is that the program is not going to get hacked.

A while back, the program did have a problem where passwords could be obtained. I don’t have full technical details, but it appears that the password was stored in certain locations on the user’s computer. It was supposedly possible for another person with access to that particular computer to get password data. That was not a problem for home users – unless you are in the habit of allowing nefarious people to muck around in various registries on your home computer – but it could have been of concern for anyone that plays MTGO on LAN computers in their local store.

It’s irrelevant, now. That problem has been fixed. However...

Although Magic Online does not store passwords in an accessible way, certain Microsoft XP settings can give other people information, if you are not careful. XP, and other software, will often attempt to populate fields, based on the last entry with the same starting letters of digits. This can happen with MTGO’s log in screen, but only with the name slot – I have never seen it offer to autocomplete the password.

The online store, however, is different. On at least one machine I regularly use, the machine will offer me a the choice of “one million words” after typing “on”, and it will also autocomplete my password. The password is shown as a series of dots, so that won’t let anyone read it.

Of greater concern, however, is the payment screen. Typing in the first digit of my credit card number displays this:

That is number is a fake, of course, but be careful which machines you use to place orders at the card shop. I have never seen an Internet Café or public library computer that enables autocomplete, but if you find one, I would consider not entering your credit card number. Use some other method of payment – maybe Paypal.

Earlier, I said that it was extremely unlikely that the MTGO servers can be hacked, and that hackers probably won’t get your account that way. That does not mean that accounts are never stolen. They are – but usually because the owner let the information slip.

Sometimes, the theft is really tricky. Some people can covertly watch your fingers are see what you are typing. It’s like lip-reading, and it is rare. Most thieves who use that trick hit ATMs. However, if strangers are watching you play, be ccarfeul with your password.

Thefts are far more commonly caused by people leaving their passwords where thieves can find them. Some people post them on blogs, or email them, or give them to friends. Others write them down in their Magic binders, then leave the binders around.

Hint, if you have to write down a password, or PIN number, or whatever, hide it. When I have to record pin numbers, I put them in my address list. For example, if the PIN is 2345, I include the following in my address book:

Randy Buehler: phone 265-4536, cell: 468-1010, FAX 265-5432.

It’s in the FAX number, backwards.

You can do the same sort of thing with your MTGO password.

Here’s another way to lose your account. Simply respond to an email like this one. I received this one last week:

Dear Magic Online User,

In order to continue using Magic the Gathering Online you must validate your
account by forwarding this message to mtgo-validation@mail.com. You must
include your account information in this format for our servers to process it:
------
Username: (your MTGO username)
E-Mail: (the email you registered your account to.)
Password: (the password you used to log in to your mtgo account.)
------

Our database will be formatted soon, due to some damage caused by some
users. We will need to record our active users and add them to our database
once again.

You must validate your account within 30 days or else your account will
get closed. Thank you for your co-operation, Best regards, MTGO
Account Managing Team.

This email is not from Wizards of the Coast. It’s a pure phishing scheme – if you respond, and provide your password, whoever the response goes to is going to log in as you and empty your account as fast as they possibly can. The simple rule: no reputable company of any sort ever asks for your password in an email. Not banks, not credit card companies, not Paypal, and not MTGO.

So, be careful. If you are uncertain, ask. If it is your bank, look up their phone number in the phonebook, and call them. (DO NOT use a phone number, if any, on the suspect email.) With MTGO, either log into the customer service website or log on to MTGO and ask the Adepts.

The short version of all of the above: your account is safe, provided you don’t do something stupid.

Bugs

The first Planar Chaos event I played in was a sealed PE. I opened a fantastic card pool. Here’s my deck:

1 Blazing Blade Askari
1 Bogardan Hellkite
1 Fatal Frenzy
1 Grapeshot
1 Lightning Axe
1 Skirk Shaman
1 Goblin Skycutter
1 Rift Bolt
1 Battering Sliver
1 Basal Sliver
1 Damnation
1 Enslave
1 Feebleness
1 Deadly Grub
1 Melancholy
1 Magus of the Coffers
1 Midnight Charm
1 Premature Burial
1 Urborg Syphon-Mage
1 Oros, the Avenger
1 Stormfront Riders
2 Sunlance

Damnation, multiple burn spells, Enslave, two dragons – it’s a fantastic card pool. I figured I had an easy walk to the draft. I strolled through rounds one and two, then got cocky and threw away round three. Suddenly, I was in the “must win” bracket. We split games one and two. In game three, he had my Skirk trapped under Utopia Vow. I cast Stormfront Riders, to bounce itself and the Skirk, thereby producing two 1/1 soldiers, and killing the Vow. With the Rider’s trigger on the stack, he killed the Riders. What should have happened was that I would return just the Skirk, and get one guy. Instead, the game asked me to choose two creatures to return. Since I only had one creature left in play, I could not do so. The game would not proceed past that point.

That’s a bug.

Basically, I was stuck at that screen until I either conceded or timed out. That bug cost me the game, match and my shot at the T8.

If you really have a bug, you can report it. If you are uncertain whether the problem is a bug, take a screen shot, and make some quick notes of what happened. Then check with a judge, or go to the Rules Help room (click on moderators, the rules help.)

If it really is a bug, report it. You do that at the Wizards customer service site, here:

http://wizards.custhelp.com/cgi-bin/wizards.cfg/php/enduser/std_adp.php?p_faqid=668.

If you don’t remember that, you can either ask an adept for the link, click on the “Report a Bug” link – this thing

– in the lower left of the MTGO screen,

or go to the MTGO customer service website

and search for the bug report form.

However you get there, the link looks like this:



Fill out the complete report. Provide all the information you can. If you have a screen shot, you can attach that. Be concise, but be complete. Depending on the circumstances, you may get a refund. I reported a bug with Saffi, which cost me a match in an 8-4 draft, and I got refund. The refund was in the form of a coupon worth the price of the packs and the 2 TIX entry fee.

One more thing – be polite. Sure, you may be pissed because you lost, or because something didn’t work right. That’s your right. However, the person who will handle your complaint didn’t cause the problem. That person didn’t write the code. That person is, however, now trying to help you. Cussing them out and ranting isn’t going to help.

I used to take customer complaints. I knew, if the person was calling with a complaint, that the person was somewhere between unhappy and seething. They did not have to prove it. I can also say that that sort of customer service job is about as bad a job as possible. Having people swear and rant at you does not help. And remember, you are hoping that this person will give you a refund. Swearing at him or her does not improve the chances of that happening.

Crashes

I had a bomb of a draft deck the other day. The green had Harmonize, 3 Citanul Woodreaders, three Uktabi Drakes, three Giant Dustwasps and Timbermare– and green was the support color. I wanltzed through round one, and won game one of round two easily. The, instead of going to the sideboarding screen, this appeared:


What was really ironic was that I was working on this article at the time, and had just written a note to remind everyone to record the event number when they enter. And I hadn’t done so.

After about a half hour, I was able to log back in. I got back into the draft screen (and got the draft’s event number) , but not the draft itself. Then MTGO crashed again, and this time it wiped out all existing matches.

Generally, if the system crashes, matches will continue once it comes back up. The system will add some time to the match – in my experience, usually about 20 minutes. If a crash wipes out your match – or if a crash otherwise prevents the event from continuing, you can apply for a refund. I have.

About the only downside is that refunds usually take a couple days to a couple weeks to process. With all the crashes that happen during a release event, and the couple known bugs (my Stormfront Rider problem is now listed as a known bug), I expect that a lot of refund requests have been filed. It will take time to process all of them.

A final note on server crashes and instability. It isn’t a server issue. It’s the code. The code was not written to handle the number of users now on the program. Buying more servers won’t solve the stability problems. New code is needed. Fortunately, the code is coming. MTGO v. 3 is now in beta testing.

PRJ

“one million words” on MTGO