Your Account Security is At Risk.

In light of a reminder that security is often overlooked, I thought this issue would be worth a post here in order to make this issue known to more players more quickly. That is, there is a glaring flaw in the design of account security for League of Legends players.

If you navigate to the "Settings" tab when you expand the drop-down menu in the upper right corner of the website after logging in, you'll see that you have the options to change your e-mail address and password for your account. In order to change your e-mail address, you need to enter your current password. In order to change your password, you need to enter your current password. Finally, if you've forgotten your password or lost access to your account due to a compromised password (which may in fact be through no fault of your own - for example, you might have used the same 60,000 character long password for League as you did for your old e-mail account), you can change your password if you have access to the e-mail associated with your account.

Let me repeat that.

Forgot password/Change password/Log-in/Account compromised? Change your password with e-mail. Forgot e-mail/e-mail compromised/Change e-mail? Change your e-mail with password.

If you lose access to one, you can use the other. If you HAVE access to one, you have access to the OTHER AS WELL.

That means if you've been hacked through either your e-mail, your league account, or some old website for which you've used the same password for and completely forgotten about, then a potential hacker could very well potentially render you unable to access your account, forever, because they hacked that old website and you just so happened to use the same password for (also why you should never re-use passwords).

Now, I understand there's player support for occasions such as these, so that players who've purchased RP or have any other types of credentials associated with the account can always recover their account through player support. But that's simply a last resort, and shouldn't be the go-to option for massive numbers of players who could potentially have their accounts compromised. And that doesn't even consider the player who's been an active participant in and supporter of the League community through many more positive means (artwork, involvement in boards, etc.) not related to purchasing RP. Suppose that player has never purchased RP. There's no way for the player to prove the account is theirs.

Riot, I hope you fix this issue quickly, because the security of your players is right now, right here, at risk.

Players, please update your League credentials and the credentials associated with the e-mail you use for League before you regret it.

Thanks, Cardi (A Concerned Player)