snarp | Recent Researches: World of Warcraft Registration And Proxies (Reply)

Originally published at SarahPin.com. You can comment here or there.

This is what I do with a four-day weekend.

World of Warcraft Registration Error 202

Apparently, when you try to upgrade World of Warcraft from a trial to a normal registration using the “Upgrade Online Now” button (possibly also when entering an authentication key), while,

1) using an IP that maps to somewhere far away from the billing address you’re using (say, if your IP says you’re in Japan and your billing address is in Kentucky)

2) not on one of the continents supported by the version of WoW you’re trying to set up (say, if you’re in Japan and trying to set up the North American version, or in the US and trying to set up the Taiwanese version)

you’ll get an error message saying “Error 202: We were unable to process your request with the information provided. Please contact our Billing and Account Services team for assistance - (800-592-5499).”

I post this here because if you contact Blizzard about it, you will get an unhelpful form email that doesn’t explain the problem, because their system got creaky and ended up giving this error to lots of non geographically-unconventional people when Burning Crusade came out and their servers couldn’t handle it.

You could theoretically get around this by using a proxy located in the appropriate country. However, there is a problem with this proposition.

Free Proxies: They Are Probably Not Really Safe

When someone wants to access something through a proxy, they generally google something like “free proxy” or “web-based proxy,” go to a list like this one, and pick a proxy at random.

This is a short guide written by a middle- or high-schooler explaining how he set up a web-based proxy to steal his classmate’s passwords*, using a piece of free GNU software called PHProxy and a shared hosting account.

I’m pretty sure the kid’s not the only person, or the most technically advanced one, who’s thought to do something like this. Nor do I see any reason to believe that the people running those big proxy directory pages run background checks on the maintainers of every single proxy they list.

(When you’re talking secure connections - the kind over which one generally sends credit card information - I’m not sure at what point the encryption goes into effect (ie, whether or not it’s encrypted before it hits the proxy and only unencrypted after it comes out the other side), but the proposition seems iffy enough that I don’t really feel comfortable attempting it myself.)

If you want a web-based proxy to use at school/work/etc., probably the absolute safest thing to do here is to set up PHProxy or CGI Proxy on your own webspace. Making one of these do SSL right is my new project.

* How this works: The kid’s school, like many, uses filtering software to keep the kids from playing on MySpace or whatever. One can bypass these filters by using a proxy. The kids will generally find these proxies using one of those huge lists I mentioned above. However, the companies that run the filtering services also look at these lists, and go around blocking the proxies on them as quickly as they find them.

The way out of this arms race is a private proxy not listed on any of these sites and only used by a few people, so that the filtering company never knows to block it. So, Villainous Kid gives all his friends/enemies the address to his private proxy, and off they go.

(Villainous Kid is my new evil hero. This is such a perfect con. It works by taking advantage of its victims’ desire to Do Something Bad! If the victims catch on, they’ll be unlikely to report it because of their guilt over the Something Bad! It subverts the larger authority (y’know, the school) by taking advantage of a policy said authority implemented to make the kids more safe to make them less safe! If the authority catches on, they’ll feel horrible because of course their policy was going to lead to this, and they’re just lucky it wasn’t worse! Blame splatters everywhere and makes everyone all sticky! It’s perfect.)

If I were a school staffer/parent/employer using filtering software, I’d be considering whether it’s really worth the risk, given what people seem to be doing to get around it. If the point of the filters is to make your network/users more secure, I’d say a policy that encourages the use of proxies is counterproductive.

If the purpose is merely to keep them from fooling around on the internet, however, I think you would probably be happiest with a filter in place, for in my childish mind a person opposed to fooling-around-on-the-internet is just the kind of heartless bastard who would be pleased to see a kid lose her savings to a PayPal hacker as punishment for using Facebook at school.