🚀 go-pugleaf

On Sun, 8 Dec 2013 03:27:21 +0000 (UTC), Lewis
<g.kreme@gmail.com.dontsendmecopies> wrote:

>In message <bgfe5c...@mid.individual.net> 
>  Catriona R <catrion...@totalise.co.uk> wrote:
>
>> On Sat, 7 Dec 2013 01:59:08 +0000 (UTC), Lewis
>> <g.kreme@gmail.com.dontsendmecopies> wrote:
>
>>>In message <bgfas9...@mid.individual.net> 
>>>  Catriona R <catrion...@totalise.co.uk> wrote:
>>>
>>>> Never mind outside the game - beware of ingame messages too!
>>>> Apparently, it's possible with some addons which let people share
>>>> custom settings with others (via whispering a link or code), to inject
>>>> code which doesn't so what you might be expecting... things like, mail
>>>> all your gold to someone else, or trade it all to someone. Seems to be
>>>
>>>Who told you that? None of that is possible.
>>>
>>>Trades and gold mailing absolutely require a confirmation, sent by the
>>>server, that the client must physically click. Anyone claiming otherwise
>>>is either an ignorant fool or a liar.
>
>> Well, the people who it's happened to in the thread linked, seem to
>> think it happened... I'll believe them until proven otherwise.
>
>>>> mainly WeakAuras and maybe TellMeWhen affected at present, but by the
>>>> sounds of things, pretty much any similar addon which lets you share
>>>> codes/settings with other users is a risk. Seems it's only a problem
>>>> if you click the link to run it, so lesson of the day: don't accept
>>>> things like that from untrusted sources, just in case!
>>>
>>>> http://us.battle.net/wow/en/forum/topic/10780477954?page=1
>>>
>>>I notice there's no confirmation from a blue post.
>
>> Last post on the thread, blue response. Of course they're not going to
>> shout "hey this is how the exploit works" until they can fix it, as
>> it'll only get more people using it, but the wording of that reply
>> sounds like they're taking it seriously.
>
>>>I used to have an addon for my mule that automatically mailed all but
>>>100g to my main anytime I went to a mailbox, so I remember clearly when
>>>they added the confirmation.
>
>> Doesn't necessarily mean people haven't found a way round it now
>> though. In any case, being careful is never a bad thing, and hearing
>> about this is a good reminder to be careful what dodgy scripts one
>> chooses to accept from random people ;-)
>
>After a little more consideration I suppose it is possible that Blizzard
>screwed up and left a hole in the trade/mail security. A script is not
>exactly the same as an addon.

If I could jump in here for a moment...

I don't have 'add-ons' for a variety of reasons. But one thing I have
noticed; in the last two months,  is that I'm finding that
the'friends' notice ("Iwana be your friend') - when opened -  contains
a gold for sale announcement.

When these folks did this in the main dialog box there was/is a simple
way to bring it to the attention of the 'proper authorities' . Is WOW
aware this is occuring through this menu? How can I rat them out?

- vetred, on the Steamwheedle serve