Hello LFS Racers,

As part of the ongoing security updates, We have made a change which is significant in a way while not technically a big change.

The WEB password is now called simply "password" and you can no longer manually set a GAME password.

The GAME password is now called "unlock code" and is set automatically and sent to you in an email when you click a link on your details page.

In the next few days we will start passing through and zeroing any old GAME passwords that have not been updated for the new system.


EDIT: Now that we have already zeroed the old GAME passwords...


How to use your unlock code:

Please install the test patch with better support for the new unlock code.
Test patch: [EDIT: official version is now available]

Then...
1) Visit details page
2) Click: send email with a new unlock code
3) Get email
4) Paste code from email into LFS "GAME password" (or "Unlock code" in the new test patch)
5) Click unlock

The "GAME password" or "Unlock code" field is in the LFS unlock screen, accessible by a button at the bottom right of the entry screen.


If you do not have access to your registered email account:

You will need to register a current email address to receive your unlock code. But with our improved security, to change email instantly you need to confirm the change by receiving an email on your old address. Alternatively you can wait 7 days to proceed without confirming the email on your old address.

To do this, visit your details page and click the link "send email to set new address" even though you know you won't receive the email. Now you can see the time, 7 days ahead, when you will be able to set a new email address without the instant confirmation. This time remains visible on your details page.


Why do we need confirmation on the old email address or force you to wait 7 days?

This is to prevent license theft by anyone who manages to log into your account by somehow obtaining your password. Some people may have had passwords that were easy to guess. Others entered their LFS user name and password into at least one site run by hackers. This really happened and we had to rescue hundreds of accounts and return them to their original owners.

Before recent changes it was possible to change password and emails instantly, enabling theft of licenses. Now we send an email to the old email address and we give the recipient seven days to respond.

Question: will this change result a premature update for the LFS game as well?

What got into my mind about this is that those in-game help texts of that game will still mention that soon to be redundant GAME password, and do not mention anything about the new unlock code yet. Those in-game help texts (including English ones) will have to be manually updated by translators and those updates only come to effect into the game when you upload a new (test) patch.

I think it may be a good idea to release a compatible patch for this and the other updates in the current Test Patch with the new translation texts that you mention.

Will unlocking older versions be possible?

Yes, we made this change with full compatibility and minimal technical changes.

Your unlock code is used in the same place you previously entered GAME password.

That continues to be the case if you use a current, past or future version of LFS, but in the future version that field will be named "Unlock code".

I don't guarantee that will always be the case but for now it is and I prefer to keep it that way.

Quote from Scawen :

Hello LFS Racers...

doesn't work. should i just go somewhere else now?

There was a 20 minute break when I zeroed the old passwords on the master server. Testing in a test environment only resulted in a few seconds pause, but the main master server took a lot longer than expected. Maybe that's what you are talking about?

If anything isn't working now, do let me know!

I did change my password as requested. All seems to function normal here. ( from my side )

I think around 3% of people who had already set their new unlock code, got it zeroed again in this evening's process.

Sorry for the inconvenience. I should not need to zero any unlock codes from now on.

Hello scawen, I can't log in to my gmail account so I can't get the code, please help.@scawen

1) Visit details page
2) Click "send email to set new address"

If you can't access your existing email address then you need to wait a week after clicking that link, then you can proceed without access to your old email, to set a new email address.

3) Wait one week and come back to your details page, you will see a link to proceed.

It's the only way we can prevent license thefts. It is very important to make sure your LFS email is up to date.

Please do not ask technical support for help. Geraldine cannot help with this, she would have to email the old address to make sure the existing owner hasn't had their account stolen, then give them a week to reply. We have an automated process in place to do that. She doesn't have the time for this. It is your responsibility to keep your email address up to date.

As far as I understand, I will be able to link a new email address to my account after 1 week without receiving a code to my current email address. Is this correct?

That is correct but you do need to click the link "send email to set new address" to start the 7 day timer, which you should clearly see on your details page.

Okeyy, I started the timer and it shows me the exact date and time, thanks scawen

I never provided my email or personnal details, as a security measure. It worked well with LFS for 17 years.

Now because some noobs do write their personnal details everywhere, I am stuck offline for a week and then have to provide personnal details on my account page, wich I dont rly want to do

Grotesque.

Someone correct me if I'm wrong, but as far as I'm aware, the e-mail address has been a mandatory field when creating a new LFS account for many years. I remember entering it when I created my account in 2007.

Quote from turbofan :

I never provided my email or personnal details, as a security measure. It worked well with LFS for 17 years.

As Flame pointed out, email verification has always been required to create an account.

No personal details are required, other than your email address.

This is all about protecting the accounts of our users, so "grotesque" is a bizarre description of our increased security measures. If you find it grotesque to provide an email address, you'd better not join in the first place.

Grotesque because I hide everything for security, as advised by security experts, and then I have provide personnal information, for the same "security", as advised by security experts.

To create my account, I used a temporary email. That's what they are intended for, security experts told me it was the right way to do it.

Dont make me guilty for trying to protect my credentials, thanx, everything was fine for 17 years. Your answer is almost insulting Scawen, I did nothing wrong.

I won't get into an argument as you hope, but it's fairly obvious that you are the one who is being insulting.

I've been working very hard on these security updates since 24th July and they are genuine improvements.

As name sugest, temporary mails are good for things you want to access temporarly, e.g. download some file one-time, but it's walled behind some bs newsletter. LFS account rather is not a temporary entity(?) so it would be only appriopiate to create something long lasting. It doesn't have to be your main mail, you're always free to create pernament mails anywhere. But you can always continue blindly listening to your online experts instead, but in such case, I'd suggest finding experts how to use your brain corretly sooner than later, as I can't comprehand there's a human being who couldn't foreseen this becoming problematic in the future...

you don't even have a google account or something?

I only described my situation, didnt judge anything but noobs giving their credentials anywhere, I didnt make any implicit aswell or ask for anything, read my post again, you obviously misunderstood in the first place.

Now after ur last answer, people feel free to judge my cognitive capacity, because as you wrote, am here to argue... so nice.

Well, surprisingly, I too do have better to do than waste my time in useless arguments on a forum. File closed.

Regarding your problem now, since you are logged into LFS forum and LFS game, your identity is validated (i'm no security expert, let me know if this is invalid) so Scawen could possibly change your email on the database for your "main" email.

Regarding security and more offtopic stuff :

Quote from turbofan :

Grotesque because I hide everything for security, as advised by security...

I see where you're coming from, since I share some of that paranoidism about internet exposure/security (specially now that EU wants you to validate your age on your phone/browser, atrocious).

However, I only ever used temporary emails for temporary accounts ( or accounts where I need an email to use an app/service (cleaning robot, AI app, surveillance app, etc), and if I loose it I dont care cause I can create another(factory reset device, new account, done).
I don't know how you couldn't foresee this happening in LFS, since it's a "forever" account, and as a security measure, you should change your passwords now and then(and you need a confirmation email for that I think) or when you suspect something is odd.

Additionally for those still curious :
- Use a privacy focused email service like Tutanota or Proton(Proton made in Switzerland with privacy first in mind - use my referral link if you want to)
- Simplelogin is a browser plugin that allows you to create multiple email accounts (10 free) that forward their messages to your "main" email address. This allows you to know which of the services has been breached when you receive spam from one of those emails. Or have one of the 10 email address be [email protected] for accounts where you don't to expose your main email provider (which might have emails with your real name on it)

Quote from turbofan :

I only described my situation, didnt judge anything but noobs giving their...

Your mere existence on the internet is a breach in personal security, there's always someone who can find who you are.

Quote from CRAAACH :

As name sugest, temporary mails are good for things you want to access temporarly, e.g. download some file one-time, but it's walled behind some bs newsletter. LFS account rather is not a temporary entity(?) so it would be only appriopiate to create something long lasting. It doesn't have to be your main mail, you're always free to create pernament mails anywhere. But you can always continue blindly listening to your online experts instead, but in such case, I'd suggest finding experts how to use your brain corretly sooner than later, as I can't comprehand there's a human being who couldn't foreseen this becoming problematic in the future...

Well... I think you described this perfectly.