Step 3 of 5

03

Accounts, email confirmation and sensible security

Online games are tied to an account rather than to a disc, and the account is created with an email address. This step covers what you are asked for, what you should choose, and how to read the email that arrives afterwards.

Why there is an account at all

In an online multiplayer game, almost nothing of importance lives on your computer. Your vehicles, your progress, your purchases and your place in the game's world are stored on the publisher's servers, and the account is the key that connects you to them.

That has one pleasant consequence and one unpleasant one. The pleasant consequence is that you can install the game on a different computer and everything is still there. The unpleasant one is that whoever controls the account controls everything in it, which is why the rest of this step spends so much time on passwords.

For the title this course uses as its example, the sign-up sequence is the ordinary one for the category: you create an account, you confirm your email address, and then you log in to the game itself. Those three actions together are what the vendor treats as a completed registration, and — in the interests of plain dealing — they are also the actions that trigger the commission that funds this site.

What a sign-up form asks for

Most game sign-ups ask for three things: an email address, a password, and a display name that other players will see. Some add a date of birth, usually so the publisher can apply age-related settings. Some ask for a country.

Treat anything beyond those as optional until proven otherwise. A field marked as required must be filled in; a field that is not marked required can usually be left blank, and leaving it blank is the default worth preferring.

Your display name deserves a moment's thought, because other players see it and it is often awkward to change later. It should not be your full real name, your email address, your school or workplace, or anything that identifies where you live. This is ordinary good practice online rather than a response to any specific risk.

Choosing which email address to use

A game account is a low-stakes account that is nonetheless worth protecting. A reasonable habit is to keep one email address for the accounts that really matter — banking, government services, your employer — and a different one for everything else, games included.

This costs nothing and takes a few minutes with any free email provider. The benefit is not that game accounts are especially dangerous; it is that the consequences of any one account being compromised stay contained.

Whichever address you use, it must be one you can actually open, because the next part of the process depends on it.

Choosing a password, properly

Three rules carry nearly all the value, and the first is far more important than the other two.

Do not reuse a password. The main way accounts are taken over is not clever guessing; it is someone trying an email address and password that leaked from an unrelated site. A password used in one place only cannot be reused against you.

Make it long. Length does more work than complexity. A sequence of four or five unrelated words is both easier to remember and harder to attack than a short string of symbols.

Write it down somewhere sensible, or use a password manager. A password manager is a program that generates and stores passwords for you, so you only remember one. The Australian Cyber Security Centre publishes free, general guidance on passwords and account security for individuals at cyber.gov.au, and it is a better reference than any advice we could improvise.

If the publisher offers two-factor authentication — a second check, usually a code from an app or a message, on top of the password — turn it on. It is the single most effective thing you can do for any account, and it is normally found under security settings after the account exists.

The confirmation email, and why it exists

After you submit the form, almost every service sends a message to the address you gave, containing a link or a code. Until you use it, the account usually does not work.

This exists for two reasons that both serve you. It proves the address is yours, so that nobody can create an account in your name using an address you own. And it gives the publisher a working channel for the messages that matter later: password resets, security alerts, and notice of changes to terms.

If no message arrives within a few minutes, check the spam or junk folder before doing anything else, since automated mail of this kind is filtered often. If it is genuinely absent, use the service's own “resend” option rather than creating a second account, because duplicate accounts on the same address cause their own problems.

Telling a genuine message from a fake one

Messages that imitate a service's own emails are common, and the period just after you sign up for something is exactly when one is most likely to be believed. Four habits deal with almost all of them.

If something looks wrong, the safest move is to ignore the message entirely and log in by typing the publisher's address into your browser yourself. Scamwatch, run by the National Anti-Scam Centre, collects current information about scams reported in Australia and takes reports at scamwatch.gov.au.

What the publisher knows about you

Creating an account means handing over personal information, and the document that governs what happens to it is the publisher's own privacy policy, not ours. It is worth two minutes before you sign up rather than two hours afterwards. Look for what is collected, who it is shared with, and whether data is stored overseas.

The Office of the Australian Information Commissioner is the independent regulator for privacy in Australia and explains individuals' rights over their personal information at oaic.gov.au. Our own handling of information is a much smaller matter, and it is set out in full in our Privacy Policy.

If you want to compare the vendor's sign-up and policy pages against what you have just read, you can open them directly.

Visit the Crossout website

Paid affiliate link. Creating an account through it pays Subtle Plane a commission; nothing about your sign-up or your costs changes, and this step works perfectly well if you ignore the link.

If the player is under eighteen

Where a teenager will be using the account, two things are worth settling before rather than after. The first is whose email address the account is attached to, since that address receives password resets and purchase receipts. Attaching it to a parent's address is a reasonable choice that nobody argues about later.

The second is who knows the password. An account shared openly within a household behaves differently from one held privately, and the decision is yours to make rather than ours to recommend.

The eSafety Commissioner is the Australian regulator for online safety and publishes guidance for families about games and online interaction at esafety.gov.au.

The household, at Step 3

Before you move on

Checklist for Step 3

The printable version of every checklist lives on the All checklists page.