Let me know if you've ever seen any other servers like this before! And make sure to subscribe! Join my discord - discord.gg/WGc9UNM

@jarPlays11

9 ай бұрын

ok

@luciantheslayer7543

9 ай бұрын

Why tho

@jakeyoung4954

9 ай бұрын

Okay:)

@malignantapple

9 ай бұрын

​@@jarPlays11no

@hamter7427

9 ай бұрын

Ok

pretty ironic how migrating accounts was supposed to be for security but instead opened a new can of worms with microsoft oauth login permissions

@AverageKaijuGamer

9 ай бұрын

then the log4shell exploit happened 2 weeks after migration this Microsoft account migration has done more harm than good.

@JavaJumper

9 ай бұрын

​@@AverageKaijuGamerlog4shell exploit is unrelated to Microsoft account migration

@StuffandThings_

9 ай бұрын

I mean "safety" was never the point, it was about Micro$oft exerting more control and their policy of "embrace, extend, extinguish." Probably meant to force any Linux players of Minecraft to make a Micro$oft account and to make chat reporting easier. Security is the tried and true excuse for stuff like this.

@kuching.sniper2792

9 ай бұрын

Suck

@RunicSigils

9 ай бұрын

Having multiple accounts is and always will be more secure unless you're a brainlet who uses the same password on everything. It was never for your security, it was always just to bump MS account numbers. Convenience, freedom, and security are interconnected and getting more of one means getting less of both of the others.

Never knew that phishing of Minecraft accounts could be done this way, though honestly with a name and server domain like that it's so obviously shady

@Tigery760

9 ай бұрын

This can easily go past minecraft, many games even on steam could use something similar. This is a very scary thing to deal with and just know is out there.

@jayemover_16

9 ай бұрын

Anyone who trusts that kind of name is a certified internet noob

@ashleybyrd2015

9 ай бұрын

@@jayemover_16 On a game with a primary audience of children that's to be expected and something we should take into consideration rather than make fun of. You were an internet noob too once, don't be elitist just because you can spot a phishing scam.

@Proferk

9 ай бұрын

what do you fucking mean? this is nothing new. It's just that the phishing scam is doing in minecraft instead of some scam youtube bot or discord

@Zylcel

9 ай бұрын

Everywhere I go, I see his face.

This is entirely Microsoft's fault. Their wording is vague ("This does not give xyz any additional permissions"?) and there's no warnings or confirmations.

@maxrburgess

9 ай бұрын

Absolutely, it’s nuts that it doesn’t say it includes access to your MS account! Edit: Access to your Xbox account

@not-underscore

9 ай бұрын

Yeah, there's a reason why discord/google give you the scope of the app you're allowing access to, and that's to verify the permissions that the app would have. Nothing other than what's included in that scope is accessible by the app. But yeah, it seems that M$ gives full access to your account without even telling you. 🤦‍♂️

Never thought i'd see the day where some Minecraft servers use the same scam methods as PH ads 💀

If that MS login permissions list is correct, that's 100% Microsoft's fault - they're giving the app access way out of the scope of what it says it is giving

@WalkingBrainTheMathNerd

9 ай бұрын

no, they just don't tell u what it is

@tiggerbiggo

9 ай бұрын

@@WalkingBrainTheMathNerdare you stupid or did you just not read? Or both.

@dagdnoob

9 ай бұрын

​@@WalkingBrainTheMathNerdThats what he said

@WalkingBrainTheMathNerd

9 ай бұрын

@@dagdnoob true, I kinda misunderstood it

@Theunicorn2012

Ай бұрын

If the MS login permissions list is correct, that's 100% Microsoft's fault - they're giving the app access way out of the scope of what it says it is giving

Mojang: We are forcing people to migrate to Microsoft accounts for better security Meanwhile the better security:

@N0TAN1M3

9 ай бұрын

no security?

@309electronics5

9 ай бұрын

Microsoft was probably the one who told Mojang to do it so microsoft themselves made the attack surface of the game bigger causing more hackers

@sus-ft3vu

9 ай бұрын

@@309electronics5 but mojang is microsot

@KiraSlith

8 ай бұрын

It's wild to think that every change Microsoft has made to Minecraft has proven to be not only worthless, but actively destructive to Minecraft from every possible angle. Just wait until you hear about what they did to their EULA terms yesterday, they basically gave themselves permission to kill peoples' entire Microsoft accounts if they post unfavorable videos like the above, as well as reversing the old trademark use terms Notch setup, making anyone using the word "minecraft" in anything's title the "wrong way" a criminal overnight. 🤬

@PaxTheCat

8 ай бұрын

"free rectangle and bugrock/yava"

this isn't an exploit, per se. it's entirely intended behavior, specifically made for 3rd party launchers. the issue here is that microsoft worded their warning poorly. it should make it very obvious that you're HANDING OVER ACCOUNT ACCESS.

@venturoes1912

9 ай бұрын

Exactly this, just look at how Xiaomi designed their UI for allowing third party downloads on their phones, just google "xiaomi dangerous permission screen" Unlike Microsoft, Xiaomi decided to add a red warning triangle, a wall of text that very clearly tells you that you would be at risk allowing this, explained in a very clear tone that even a grandma or kid could understand and finally, there is a 10 second cooldown before you can even proceed, after pressing a separate checkbox.

@motherchuckair404

9 ай бұрын

if its open source and can be community peer-reviewed and audited, this is technically not the case. you also need great op-sec to browse the internet these days

@fireworkstarter

9 ай бұрын

maybe handing over access to an account isnt that good? how about some diffrent kinds of rights for apps so that they cant just hyjack it afterwards

@venturoes1912

9 ай бұрын

@@fireworkstarter It's not account access, rather it just lets it generate login tokens, aka it can only let it join servers with your name. This is required for third party minecraft launchers, however as you can see it can easily be abused by scams

@mega_gamer93

9 ай бұрын

@@fireworkstarter there are other kinds of account access, it's just that piglinbrute requested authentication tokens and people got phised into giving them to them

Wow this is a shame, I was actually planning to develop a legitimate Minecraft linking system through Microsoft login, but the fact that Microsoft is giving entire account access to sites you sign into makes that idea impossible without feeling like a red flag to players.

@wojtekpolska1013

9 ай бұрын

just make sure to set up the permissions correctly, you probsbly only rly need the player ID from the account for most purposes

@gerobi1233

9 ай бұрын

make it open source and you're good

@tartas1995

9 ай бұрын

Why would you need to link it though? How and why does it add anything to anything?

@JohnDoe-sg1qb

9 ай бұрын

@@tartas1995 microsoft makes sure that sensitive actions (like oauthing applications) couldn't be done by robots

@mo-s-

9 ай бұрын

What do you mean by "linking system"? It sounds interesting

Its kind of amazing how messed up the Minecraft multiplayer ecosystem has become. Very, very few servers are fun, safe, and have a good community these days.

@keagaming9837

9 ай бұрын

I know of servers that are still safe, but yes they are getting rarer and rarer these days. :(

@friedrichhayek4862

9 ай бұрын

userbase*

@DeafEars5723

9 ай бұрын

Singleplayer mode

@StuffandThings_

9 ай бұрын

@@DeafEars5723 For real, singleplayer is becoming the only viable option. But it gets kind of boring after a while, after all sharing the results of your work is part of the fun, as is hanging out with friends.

@DeafEars5723

9 ай бұрын

@@StuffandThings_ I started playing Minecraft by mining on singleplayer, and my last play through will be mining on singleplayer, multiplayer is just such a huge risk to your account, and is only fun when you’re actually good at the mini games

2b2t players: Definitely a Popbob thing.

@thedrunkenknight

9 ай бұрын

Watch it be actually popbob

@Akira__743

9 ай бұрын

Popbob is a girl 🤫

@zoes32flavaz

9 ай бұрын

69 likes on this comment

@VRavTech

9 ай бұрын

The popbob sex account duplication glitch

@norcobick

9 ай бұрын

what the heck is a popbob

I accidentally got ratted on skyblock yesterday so thank you for bringing this to light so nobody else suffers the same mistakes

@kingacrisius

9 ай бұрын

How tf did you manage that

@100Create

9 ай бұрын

​@kingacrisius he verified a "hypixel" bot to his Microsoft, same as me which just takes ur acc, I recovered my stuff and acc but many cant

@lilnasnusnus7867

9 ай бұрын

Same bro I got ratted a few days ago too cause Microsoft gives zero shits about random websites and so on havin full access to your account

@pierrotA

9 ай бұрын

Sorry for you and all the others. Grinding for years and losing everything is never funny. Personnally I simply stopped playing minecraft because I refuse to link it to a microsoft account, especially because I mainly play solo and I see no reason at all to do it. But even if I understand that few people want to go to that extreme, I cannot understand why people still accept to give so much access to any games/apps they download. If you download a game or an app (mobile or PC) that ask you to give a ton of permission that are not necessary, it's *always* to sell your informations and/or to do shady things with them. I hope that someday people will massively say NO and switch to an other game (or an other server) each time they need to give away all their data for no reason, but I know it's not for tomorrow. The worst is on mobile, when some people give all the permissions (camera, memory, account,...) to games they do not know...

@slicepie410

9 ай бұрын

​​​@@lilnasnusnus7867​​ maybe you shouldn't give access to your entire account to these random websites yourself. You live am you learn. Blaming microsoft for what is essentially a mistake on your part will not fix anything What microsoft could've done is not make it so vague. "Allow app to see and update the data you give it access to" doesn't *really* explain what data exactly. Either way, letting an app modify data on your behalf is already suspicious

1:37 the "checking physics" thing actually does make sense, bot accounts usually emulate the java edition client instead of actually using it (to save resources and for flexibility), meaning they have to properly emulate the players physics too. it can check if your player falls, and if your player doesnt fall or falls in a way that doesnt seem legit, it can flag you based off of that (obviously this server has been rigged to flag everyone, but thats certainly a normal check)

@ShokyoLeaf

9 ай бұрын

oh nice!

This happens so often in both games and social media accounts. Thank you for calling it what it is when so many people want to call it "hacking". It's not hacking, it's "account theft".

@TristanY_

9 ай бұрын

Yeah, hacking is more of things like DDoS attacks, hacking into websites, and other things. Also video game "hacking" is actually exploiting, as they are exploiting vulnerabilities in the game's code.

@road__house

9 ай бұрын

​@@TristanY_A very surprising majority of people don't know the difference between exploiting and hacking. Its kinda sad

@LilacMonarch

9 ай бұрын

​@@road__housePeople call leaving their twitter logged in on their friend's computer and that friend making a troll post getting "hacked" it's so dumb

5:16 NOOOOOO!!! Hot Minecraft Girls Are Not Waiting For Me!

And this only possible due to the account migration… ahhh thanks again Microsoft. We all knew this would happen…

I love how when someone discovers a new account stealing exploit it *always* comes down to them tricking you into giving up account details yourself. The pattern is there people, be wary of it.

@caustictoad

9 ай бұрын

Yeah lol. Joining the server yourself doesn't do nothing. Only if you enter your own credentials, - then something will happen.

3:29 we have to thank that one policeman from Scotland for taking down the site

Thank you for covering this. I have been pushing for this to be sorted out for a very long time. There are so many solutions and yet no department in Microsoft seems interested in doing anything.

@shadowsniperyt8015

9 ай бұрын

Average microsoft moment.

Legend says the policeman from Scotland was actually inspector gadget all along!

I like how Microsoft was making glorious claims about their authentication system outperforming Mojang's Yggdrasil and yet ended up here.

I love the hoops people are going through just to steal some kids' virtual lego account, that virus that was on Curseforge was was impressive for how elaborate it was, im sure the same happens on Roblox as well.

@TristanY_

9 ай бұрын

roblox is far more simple, you google "free robux" and you find a pdf file hacked onto a dentist's website that contains a link to a phishing website

@SoftisNelaris

9 ай бұрын

If I'm understanding things correctly, they're not just stealing Minecraft. They're getting into peoples' *Microsoft* accounts which will include any personal or payment info associated.

@MisterPancake778

9 ай бұрын

@@SoftisNelaris Yeah and the entry point is some lego game a bored swede came up with one day, since so many kids play it and arent educated on online saftey regarding phishing scams it creates a hotbed for malicious people trying to steal their info.

@TristanY_

9 ай бұрын

@@SoftisNelaris Yeah and Roblox has your stuff stored but censored. Although, if you have 5,000 robux (Or maybe more? I don't remember) and you make games for the platform, you can cash out your robux for real money (At the rate of a free money mobile game basically, so not much money, but it's still money that they can take from you). So all they have to do is gain access to someone who has millions of robux, then change the credit card associated with the account, then cash out.

You know it’s a good day when mister epic uploads

@realredguy9999

9 ай бұрын

yup

@leogaitsgorypiano8870

9 ай бұрын

never heard that one before

@RidinWithMyLocsOn

9 ай бұрын

it all seems fake though, the document is full on trolling and he throws it out there like its real lol

Man if only there were people smart and brave enough to take out the server at the source in person, maybe some of this stuff will never happen. Thank you for warning us about this.

you need to be really wary of these micosoft login screens if they say *anything* more than just accessing your player ID. when multimc asked for similar permissions i had to research it for a couple minutes to make sure i trust them. and i would definitely not give such trust to a random mc server

You clearly understand the OIDC authorization process. I liked how you made a clear distinction between access and refresh tokens. This kind of problem exists for all OIDC SSO technologies because people don't check what permissions they are allowing on their accounts. Nice vid

This is a very important issue, and I'm thankful you are making the general community aware of it. Some skyblock youtubers have already made a video on this topic a while back, but even hypixel skyblock is small compared to the rest of minecraft, and I don't think you share a lot of viewers with it. MIGRATION promissed better SECURITY, but all we got is new ways of exploitation.

@WalkingBrainTheMathNerd

9 ай бұрын

true, as before the only ways to steal accounts before was through mods and blatant login pages, both not so effective. I have been oath ratted nearly 3 weeks ago, when I joined a discord server for a guild I was in

@piebit101

9 ай бұрын

😢חבי ‏‪0:39‬‏ 😢חהבחבנב😢

We’re the server host features in this video and may have been in the thumbnail for a while, we’ve since taken both servers down - the Minecraft server and the strange phishing site itself - note we have zero control over the domains but were the host of the servers 🥲 We were only informed of this phishing Minecraft server today after the video was released, we would’ve appreciated being alerted before releasing the video, but at least it’s taken down now 😅 We do not tolerate abusive services such as phishing, malware, hacking (without ethical hacker / security research credentials), etc. We never expected to end up featured by a 600k sub Minecraft KZreadr, but we at least appreciate that you didn’t place the blame entirely on ourselves 😅 ~SG123 - CEO @ Privex ❤️

@SupersuMC

9 ай бұрын

True Chads right here.

This reminded me of this crazy situation that happened on skittlemc where players were getting doxed because of a leak or something not sure of the whole story because I was gone during that time. Microsoft shut them down for almost a year for not following certain guidelines. They made a lot of changes in the server to make more acceptable. It also lost alot of the playerbase it once had. I think I accidentally spoke to the doxer who helped me find a job exploit to earn emoney on the server. He later blocked me on discord and he hid his past names on namemc and went off into the unknown somewhere. He was perm banned but they unwhitelisted him then whitelisted him back.

@quantdev

9 ай бұрын

the IP leaking is probably because of Minecraft literally printing your ip in the server console when you join, which is really stupid

@KatOnline

9 ай бұрын

@@quantdev Yeah it is really stupid. I questioned whether I should use a VPN, but I'm worried Microsoft would terminate my account. They've been known for freaking out about people going on their account in different ip locations because they don't permit selling or borrowing people's Minecraft accounts. I don't want them to take my VPN as some else using my account. Idk if a VPN now would matter anyway because they prob have my real ip stored somewhere. I don't care that much if the server admins know my location, I just worry about it getting leaked to everybody.

7:40 just a tip, you probably should put a black bar over sensitive information like your email there instead of blurring it out. It's possible to read out some of the characters manually (because of the screen movement) or via using an AI. A black bar is a bit more protective.

@sajeucettefoistunevaspasme

9 ай бұрын

Although you can sometimes read it you just have to apply the mosaic then do the movement which soloves the problem and yes, some AIs can read through blurs but not through mosaic where information is lost

@mathgeniuszach

9 ай бұрын

By "blur" I mean blur and mosaics. Some techniques can work through mosaics by applying the mosaic on guesses for letters until a best match is found. They aren't as safe as a black strip over data.

@schrenjaminsstift92

9 ай бұрын

@@sajeucettefoistunevaspasme blur loses data aswell, but you can still see through it. Same with mosaic.

This is thankfully easy to avoid. It can be made more elaborate if went like: This server is modded, here's the modpack you need: ... Then you'll get a malicious mod, it can even go and say, don't forget to share this modpack with with your friends! Or you can make it better by actually letting the person in and require another player to access a feature, it'll attract more players duss more accounts to steal. So stay careful outhere giving credentials.

"You can get no info" was so badass tbh

Every single time I see something like this I’m expecting it to be something like “just logging on and nothing else can put you at risk” instead of a variation on the same old “oops put my password and information into the shady website and now it’s doing shady things!” Like I’m glad it’s always the latter but it always boils down to user gullibility

The checking physics thing is actually real on some servers. some clients tend to have physics modifications, for example meteor client where you for some reason take falldamage from 3 blocks instead of 4. this is an anticheat to detect if people are running certain cheats or certain clients. A good example is Purity Vanilla. It's an anarchy server where no cheats are allowed and this system there works so well that people are barely able to join with cheats on.

Thanks to TheMisterEpic's videos about these scams, it has made me better at spotting them. Keep up the good work :)

wow thats amazing there still doing this! I logged into a server like this back in like 2014

I was almost a victim of something similar to this through a discord verification tool. It was only due to my experiences with these kinds of things that I had realized what I had done and immediately revoked access and secured my account. Somebody without the years of experience dealing with these things like I do would be none the wiser to this trick. Great video.

@auser1078

9 ай бұрын

Holy shit. Ur the guy from spokes old civ events

I remember once i joined a discord server being advertised as a giveaway server, and It asked me to verify using this method. It looked so sketchy and I am now so glad that I didn't click verify.

The moment a server ask me to give them my account i dip out. Why anyone would give up their info for a server is beyond me.

This happened to me but on a discord server. Thank you for making everyone aware of these.

Thx for informing us dude

“Join out of curiosity” 8:04

KZread buffering doesn't want to let me watch

From mass content farms, KZreadrs basically scamming children on p2w servers, and people straight stealing accounts in ways I didn't even think possible it's nice to see somebody genuinely caring about the player base and helping inform the masses for us to be wary.

What makes this particularly ironic is that one of the reasons given for the migration of Minecraft accounts to Microsoft accounts was increased security. Instead this has increased the attack surface for people's MS accounts. At least back when Minecraft Java accounts were separate the damage was limited if your MC account was phished/hacked.

@Max128ping

8 ай бұрын

Technically it did. That just a side effect. It just matter of convenient and security. You guys seems fine having 1 steam account for several tens of MP games and your credit card. Yet annoyed when using a separate account for Ubisoft, EA or Epic, but they provide increase security by the fact it is separate from each other

Funny thing is, the microsoft page where you change the permissions is "under maintenance" and has been for some time now.

The checking physics thing totally makes sense. Knockback, falling and similar stuff is all mostly handeled on the client

Its sad to see, that mojang doesnt care about this issue..

It’s worth mentioning that although they have similar effects the login with email code feature and oauth are 2 completely different systems. e.g. 1 attack uses officially provided APIs for account access and the other simply forwards user input to the real service

That one policeman from scotland was definitely in charge of the whole investigation.

Sounds creepy. Thanks for causing awareness about these kind of methods

fire video as always, thx for the information

You are actually lucky if they only steal the Minecraft account token. There is a similar phishing attack on discord. That one has the Microsoft authentication set up in a way where they can change your email and password to kick you out of your Microsoft account.

As a cracked player i see this as a absolute win

@Akira__743

9 ай бұрын

Lmao

@matheuscarneiro899

9 ай бұрын

Holy🗿

@JavaJumper

9 ай бұрын

As a player with more than 1 braincell i see this as a absolute win

@Kitulous

9 ай бұрын

same. been playing Minecraft since 2010 and never gave Microsoft/Mojang a dime

@nectabs8994

9 ай бұрын

​@@Kitulousi dont think thats a thing you should brag about.

Pretty much the same is happening in older CODs, the problem is that the servers are still directly hosted by Activision It's literally safer to play cod on modded clients other than the fact that they have anticheats & better servers in general

Something similar happened to me when I signed into steam through a fake login screen. With in 1 minute I lossed my account

When he says no pressure for the subscribe button I can feel the pressure building in my mind as he continues the video.

This happens in Hypixel Skyblock Dungeons- the party finders that say "Free Carries for joining Discord server" have discord servers that have verification websites exactly like this. I almost fell for it once lmao

Don't play MC, but this got my attention. Great work!

Interesting stuff, as usual :D

This is the funniest phishing scam ever. I wouldn't be surprised if they made this just because it was so unbelievably easy.

Just wanted to say, I am thankful I have never been hacked before. My ip was once leaked, but that was more than 5 years ago, and I use a vpn since then. Just like the video explained, Its really easy to be baited into giving your info, even though it looks like the same screen a 3rd party launcher would ask for. So I think that as long as you never enter your account info in verifications, you should be good.

i thought there was some crazy session exploit or smth, and then its just a phishing scam, my disappointment is immeasurable and my day is ruined

They should make account tokens its own OAuth scope. Maybe having one service-specific token for misc services, but then they can request to use a different service token, then have that clearly outlined. The way they worded it is that they can view what details you have on your xbox profile, NOT login tokens. Just what I'd do to resolve this.

This is why I don't even go on servers anymore tbh. It's better to make sure things are fine routinely and occasionally play on singleplayer or with friends on a personal server

MisterEpic, just wanted to ask what shaders you use for your videos? They look gorgeous and I’d like to copy those settings

Thanks for educating the Minecraft community about all this suspicious stuff.

I was looking into MS OAuth and the Xbox scopes were locked out and required special permission from Microsoft to use. I'm not sure how they managed to get that...

This is why I’m glad I only ever play on locally-hosted servers I make with my friends, lol.

"Hot Minecraft girls are NOT waiting for you." Man, I'm dead. XD

@zR1tz

9 ай бұрын

🤣🤣

Thanks for this info share this to more people ❤

this is actually the same page you get directed to whenever you play a gamepass/ms store game for the first time, making it seem less malicious

Let's take a moment to appreciate how he makes his videos it's seems like a interesting history lesson with music in back ground to make it more dramatic. This video keeps my interest

A way to stop other people griefing servers that you play on can be asking the server owner to implement login security mods so you can only log in with a password.

@truerandomchannel

9 ай бұрын

or, hear me out, whitelist

@ashleybyrd2015

9 ай бұрын

@@truerandomchannel That wouldn't work here since the griefer in question would have access to your account, unless you used an IP whitelist I suppose.

@felixchen1796

9 ай бұрын

@@truerandomchannel No I mean if somebody steals your account or you are sharing your account with a sibling or friend

@felixchen1796

9 ай бұрын

@@ashleybyrd2015 The login security mod makes you log in with a password on the server that isnt saved to the server instead of your account and therefore they wont be able to access the password.

@ashleybyrd2015

9 ай бұрын

@@felixchen1796 I was responding to the person who said "or, hear me out, whitelist"

It’s crazy how simple this can be recreated, the plugin would take less then an hour to make and the website maybe a few hours. Verification is a good way to secure logins (since I own a server) but never sign in with your Microsoft account to get verified on a server. I’ve been reading some other comments its crazy that Microsoft does not explain what is going to happen if you allow access, it gives very brief detail.

Meanwhile mojang is banning servers for having guns

4:40 domain privacy services are very common and quite often included with a domain. Not really sus as most people wouldn’t want to have their real address and phone number publicly accessible. Also they don’t register “on behalf” they just proxy communications (you put their address instead). Love the video though - nuts.

Oh man That's a Method I didn't know about and thank you for Info MisterEpic

i remember a few weeks ago i tried to go into this server out of curiosity because i thought it was funny not knowing it was an actual account stealing thing. I joked around with some friends "lol there goes my IP" and instantly removed the account connection from my account not realizing how BIG of an issue this actually was. Jeez, I almost got my stuff YOINKED, thank god I'm really strict with my security stuff.

This just made me think about something - is it possible to hide malware in a server resource pack? When you download a server resource pack the file stays on your computer.

can a minecraft server steal your session id if you just join if the owner modifies the server? i've heard the session id pops up in the tcp protocol when joining to verify your account

Almost had my account stolen once by this method, I wanted to join a discord server but you needed to verify. Luckily I found it a bit suspicious so didn't lose my account.

You'd think a captcha itself would make people avoid places. "Why do I have to do an extra ANNOYING thing just to visit this place that I know nothing about and is only slightly alluring?" I guess people just want to be ANNOYED maybe?

@HungryWarden

9 ай бұрын

Captchas suck. The one on the Roblox website was so excruciatingly difficult and when I finally completed it, it gave me this “An error occurred” 🤬

Here's the thing, if it gives access to the gamertag associated with the minecraft account, if you've also bought stuff from the windows store or the xbox marketplace, there's a decent chance your card info, or in the case of a minor, their parents card info, is saved to the account. Getting access to the account doesn't then just give them a free account, it gives them access to that card, even if they can't see the card details to use elsewhere, they can still add their main account as a friend, and then gift themselves games and game currencies on someone else's cash. Granted, there are built in safeguards you can setup to prevent that if your account gets compromised, the most simple being a custom passcode you need to input before making any purchases, but something tells me not many people would have that set up, and less parents would have that set up on a child's account.

Its always an amazing day when you upload!!

That type of microsoft verification is commonly used in skyblock discord scams. I got my account hacked by it once, but managed to recover it.

'Department of Juice' got me 🤣

In bedrock I've joined servers where, after joining and playing in them, I suddenly found myself having to relog into my microsoft account, often more than once a day. One time it was so bad I almost lost the ability to log in (something messed with the log in box). All of them were cross-play servers, and so far I still haven't found an explanation for it.

@nikkiofthevalley

9 ай бұрын

Huh. Weird. I haven't seen that with my personal server with Geyser installed, so either they borked their configs or something shady is happening. Geyser itself is fine, (in terms of security) whatever server you're connecting to may not be.

I've seen a few videos about something similiar, it's quite scary, but there is one way around this from happening, use common sense. As harsh as it may be, most victims don't see the blatant red flags. Seen a similiar system used, instead of having a server like this, instead a discord "verification", which suprisingly a decent amount have been tricked by it. I wouldn't recommand allowing any launcher to get permission to the account, even the ones that seems legit.

ive been developing minecraft launchers for a while now, but in my login process it never asks the users to grant some permission, its just a login page.. yet it still gives me a token and refreshToken......

I mean, in order to get your account stolen, you need to join the server, and have little internet security consciousness.

One thing i will say on domain registration, you almost always want to privatize your information when registering a domain, i forgot to once while registering a domain for a website, and i was flooded with texts literally every day about "developers" wanting to build me a website for cheap. Doesn't take away from the scam at all just saying its a pretty common thing to hide your information if your not a company

What is your sky texture pack its amazing 🤩

Dang, I really like that people like you make these videos to warn people about these account thieves, especially since it's extremely hard for even Mojang and Microsoft themselves to prevent this stuff, even though they've made efforts in the past. (BT dubs, I felt targeted by those guys when you said younger, more susceptible players.)

@venturoes1912

9 ай бұрын

It's not hard for them to prevent this, this is literally pure stupidity by Microsoft to design a dangerous screen to look like that.

5:05 damm, if you would say "over and over, again" it would fit the music a lot

3:00 the music makes me think of something you'd see on pirate screens

Thank You for this info.

Got damnit i was really looking foward to this server

Another fantastic MisterEpic video 👍🏿

I got ratted in a similar way and an even crazier way - I joined a discord server and allowed a bot and 30 seconds later my Microsoft account was gone and they had infinite access I only knew abt it cuz they had logged into hypixel while I was on so I knew somone had access and saved it but still is crazy to me that just a click of an allow button to a discord server that I didn't even think abt could control my account