Not an attempt to drive traffic to my blog honest, but the full story can  
be found here

http://flipc.blogspot.com/2010/07/xbox-live-and-lack-of-security.html

To summarize I'm asking any XBox360 owners here -

1) Is it possible to log in online without a passcode using only the  
publicly displayed gamertag?
2) How easy is it to 'accidentally' purchase something from Marketplace in  
this case a full £20 game.

As it stands my friend's son is on the brink of forfeiting his next  
Christmas and Birthday presents unless he pays up; but as an accident it  
could lead to a slightly more lenient response and the default "Bloody  
Microsoft" outcry :-)

-- 
Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

Phil Cook v2 wrote:
> http://flipc.blogspot.com/2010/07/xbox-live-and-lack-of-security.html


 > So you don't have to set up a pass-code you can just sign with
 > your Gamertag - the one that's public displayed every time you
 > play online?

There's a passcode, then there's a password. You get prompted to set up a
 
password right away, but you can save that to your profile so you can pla
y 
online without entering the password. The password is what gets you into 
the 
online store and such.

The passcode is four button presses on the controller that keeps other 
people in the house from logging in as you locally, so that big brother 
can't (for example) mess up your saved games and high scores.

> 1) Is it possible to log in online without a passcode using only the 
> publicly displayed gamertag?

Don't confuse password and passcode. The password gets you online. The 
passcode logs you in locally.

> 2) How easy is it to 'accidentally' purchase something from Marketplace
 
> in this case a full £20 game.

Yep. If you have the means to purchase stuff, and you're not careful, it'
ll 
buy it with just a couple of key presses.

This is why, if you have kids, you put points into the system instead of 
the 
credit card. Or set the kid's account to be a kid's account so they can't
 
buy with it.  Why did they give the kid the credit card?

> As it stands my friend's son is on the brink of forfeiting his next 
> Christmas and Birthday presents unless he pays up; but as an accident i
t 
> could lead to a slightly more lenient response and the default "Bloody 

> Microsoft" outcry :-)

If they gave him an adult account and associated a credit card with it, y
es, 
it's pretty easy to buy stuff without jumping thru hoops. The choice is t
he 
same screen as the demo downloads (which they "sell" you for $0, basicall
y).

Take the credit card off the kid's gamertag, or set the gamertag to be a 

child's gamertag.

-- 
Darren New, San Diego CA, USA (PST)
    C# - a language whose greatest drawback
    is that its best implementation comes
    from a company that doesn't hate Microsoft.

Post a reply to this message

Phil Cook v2 wrote:
> http://flipc.blogspot.com/2010/07/xbox-live-and-lack-of-security.html

http://support.xbox.com/support/en/us/nxe/kb.aspx?ID=934510&lcid=1033&category=xboxlive

You can't remove the credit card that's getting billed for an active 
subscription.

-- 
Darren New, San Diego CA, USA (PST)
    C# - a language whose greatest drawback
    is that its best implementation comes
    from a company that doesn't hate Microsoft.

Post a reply to this message

And lo On Fri, 16 Jul 2010 17:10:40 +0100, Darren New <dne### [at] sanrrcom>  
did spake thusly:

> Phil Cook v2 wrote:
>> http://flipc.blogspot.com/2010/07/xbox-live-and-lack-of-security.html

<snip>

> The passcode is four button presses on the controller that keeps other  
> people in the house from logging in as you locally, so that big brother  
> can't (for example) mess up your saved games and high scores.

I thought this might be the case, there is another child in the house so  
it would have been possible to pass the blame to them.

<snip>

>> 2) How easy is it to 'accidentally' purchase something from Marketplace  
>> in this case a full £20 game.
>
> Yep. If you have the means to purchase stuff, and you're not careful,  
> it'll buy it with just a couple of key presses.
>
> This is why, if you have kids, you put points into the system instead of  
> the credit card. Or set the kid's account to be a kid's account so they  
> can't buy with it.  Why did they give the kid the credit card?

As I suspected he's set up with the wrong account

>
http://support.xbox.com/support/en/us/nxe/kb.aspx?ID=934510&lcid=1033&category=xboxlive
>
> You can't remove the credit card that's getting billed for an active  
> subscription.

Which is a problem if you've bought Gold membership using a credit card  
but don't want to have the ability to buy things from the marketplace.  
After all the membership has been paid for in advance and the card is  
apparently being kept merely to facilitate the auto-renew ability, so why  
can't it be removed?

Thanks for that, does answer my questions.

-- 
Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

Phil Cook v2 wrote:
> Which is a problem if you've bought Gold membership using a credit card 
> but don't want to have the ability to buy things from the marketplace. 

Indeed! I suspect it's more marketing than a technical limitation. They want 
to make it easy to renew, possibly even automatic.

-- 
Darren New, San Diego CA, USA (PST)
    C# - a language whose greatest drawback
    is that its best implementation comes
    from a company that doesn't hate Microsoft.

Post a reply to this message

And lo On Mon, 19 Jul 2010 15:53:03 +0100, Darren New <dne### [at] sanrrcom>  
did spake thusly:

> Phil Cook v2 wrote:
>> Which is a problem if you've bought Gold membership using a credit card  
>> but don't want to have the ability to buy things from the marketplace.
>
> Indeed! I suspect it's more marketing than a technical limitation. They  
> want to make it easy to renew, possibly even automatic.

Oh yes renewal is automatic, you have to specifically turn it off. The  
question my friend now faces is can he create a new 'master' account and  
associate it with the current one? Can't seem to find the answer online  
could  it be that Microsoft just expect you to get it right first time?

-- 
Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

Phil Cook v2 wrote:

> could  it be that Microsoft just expect you to get it right first time?

What irony *that* would be! :-P

Post a reply to this message

Phil Cook v2 wrote:
> associate it with the current one? 

Associate it in what way with the current one what?


-- 
Darren New, San Diego CA, USA (PST)
    C# - a language whose greatest drawback
    is that its best implementation comes
    from a company that doesn't hate Microsoft.

Post a reply to this message

And lo On Wed, 21 Jul 2010 15:31:23 +0100, Darren New <dne### [at] sanrrcom>  
did spake thusly:

> Phil Cook v2 wrote:
>> associate it with the current one?
>
> Associate it in what way with the current one what?

Create a new 'adult' account with credit card details and use that for the  
current 'child' account and remove said details from that.

-- 
Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

Phil Cook v2 wrote:
> Create a new 'adult' account with credit card details and use that for 
> the current 'child' account and remove said details from that.

Oh. I haven't actually tried doing anything like that, so I can't help there.

-- 
Darren New, San Diego CA, USA (PST)
    C# - a language whose greatest drawback
    is that its best implementation comes
    from a company that doesn't hate Microsoft.

Post a reply to this message