Metin2 account security: Gameforge password rules and two-factor authentication

[admin]

Account theft is one of the more avoidable ways to lose a Metin2 character. Gameforge publishes security guidance for its accounts, and this post condenses it for Metin2 players.

Password rules from Gameforge

• At least 10 characters, with upper and lowercase letters and at least one number. Longer is better, and special characters such as ! ? , . + and & add protection.
• Do not use a word from the dictionary, consecutive numbers like 123456, consecutive letters like abcdefg, or keyboard runs like qwerty.
• Use a different password for every account. Gameforge says this matters most for your email password.
• A password manager can generate and store complex passwords. Gameforge's other suggestion is to memorize a sentence containing a number and use the first letter of each word plus the digits.
• Never share your password with anyone.

Turn on two-factor authentication
Gameforge offers two-factor authentication (2FA) with an authenticator app. Once it is on, signing in needs a time-based code from your phone after the email and password. To set it up, install an authenticator app, then open your account settings in the Gameforge Client or on the Gameforge website, click "Generate QR code" and scan it with the app.

• When you enable 2FA, a window shows a recovery code. Write it down, because you need it if you lose your phone.
• Gameforge lists Microsoft Authenticator, Google Authenticator, LastPass Authenticator, 2FAS, Protectimus Smart and Duo as recommended apps, and suggests choosing one with cloud backup or device sync in case you change phones.
• 2FA is optional. Gameforge also says it can currently only secure games that use the Gameforge account system.

If you think someone got in
Gameforge's instruction is to change your password immediately and contact their Support team. If you reused that password anywhere else, my suggestion is to change it there too.

A note for private server players
Gameforge says its 2FA only secures games that use the Gameforge account system. A private server login is usually a separate account on that server, so I would not assume Gameforge's 2FA covers it. Ask the staff whether they offer anything similar, and never reuse your Gameforge or email password there.

If you have a safety tip that worked for you, or a scam attempt you want others to recognize, post it below. Leave out real account names and passwords.

Sources
[1] Gameforge support: account security FAQ
[2] Gameforge support: two-factor authentication