I only believed the other account was compromised because the only code on it did not work. On my main account, the gift codes were all used and I could clearly see that. I don't know if it was due to a compromised account or a vulnerability in the gift codes themselves. I have been given no information at all other than a list of usernames who registered them which I can see in my account. I've looked up those names, and the registrants are clearly foreigners from places like Eastern Europe and the Middle East. The most common countries seem to be Czech Republic and Turkey. I have no idea how Mojang thinks I came into contact with these people who don't even speak English.
Silvania Studios"they didn't even look at that second account to see that there was an unused code still left!"
...That is 100% your responsibility, not theirs. You are getting support on the one account you are using for the support talks, and that's it. Even if you could "prove" you owned the second account, no company worth their salt would give out any information at all on a second account unless in direct talks with that account.
Honestly this thread seems super fishy. I mean if you had no plans to use the codes and just wanted to buy them to "support mojang" then why do you care to begin with? It sounds to me like these codes either were already used by you, or simply never existed to begin with and you're trying to con out some free ones.
That being said, assuming they did exist, and were the old 12-char codes, it's totally possible someone has a small background task running that grinds through all combinations in a brute force-style code redeeming system which periodically sweeps through the entire spectrum (probably taking well over a year to complete) in the hopes they'll snag an unused code. This is a well known problem with gift codes everywhere, and it's why they are designed to be used, and not designed to be sat on. If you sat on the codes for 4 years without using them, and a bot snagged them, that's your fault and not theirs. Plus, there's physically no way to prove that it was a bot and not you, it's been well over any form of "warranty period" (Not that there IS one for gift codes to begin with), and thus legally they do not have to do anything at all. Hell, even morally they don't really have to do anything, because as I see it it's your fault for not using the codes for such a long time.
Firstly, I just want to say I appreciate your honesty. I'm trying to understand the other side of this issue, and it's really helpful. I just want to make sure you understand the full situation of what's going on.
At the moment, I'm not getting support on any account. They are now ignoring all communication. I'm trying to even get answers to simple questions like if they track logins. So I can know if the password was compromised, for example. I think that's reasonable. I point-blank sent them an email which had only that one question in it, nothing else at all. And they point-blank didn't answer it. That was the first message they ignored and it quite frankly scares me. To this day, I still don't know if someone else logged into the account. And I don't think they have any idea either.
I do own both accounts and did provide proof that I purchased the gift codes with the original transaction IDs. Both accounts use the same email address. The second one was registered in alpha when the email address wasn't the account key. So I was using the most appropriate email to ask about the other gift code.
I did have plenty of plans to use them. At the time, almost everyone I knew played Minecraft. I ran a large online community and wanted to do a weekly give-away to boost activity. Christmas was a couple months away. And spare accounts. I just set up the 11th, and I use them all for one of the multiplayer servers I'm on. I know people who have more than that even and use them for decorative heads. I had plans to launch servers, which I did, and I was going to give away gift codes there too. I have no way of knowing 6 years ago exactly how many codes I would want to use. If my life had taken different paths, I would certainly have used them, maybe even run out and been kicking myself, spending hundreds of extra dollars, but on the current path I overestimated. But I'm by no means done using them. I have my whole life ahead of me. And the only thing that's been relatively stable in it for all 6 years is Minecraft.
I love Minecraft and Notch and I did have a strong love of Mojang, but I didn't 'just' buy the codes to support them. I also play the game a lot, and I wanted to get a good deal on something that I saw would use and would make excellent gifts for friends and family at the time. You have to remember, the game costed $12 back then and now it's $36, and these price hikes were announced in a huge blog post. They also threatened they might one day charge for upgrades and expansions, which they still could, but in alpha you got them for free. Games like Minecraft help people connect and make friends, and learn all kinds of cool things. Plus, Mojang is a small business with a great idea. At the time I was playing probably about 3-5 hours per day. I absolutely wanted to support Mojang and Minecraft and Notch but it wasn't 'just' that. I still expect I'll get to use the codes I bought. I saw this saving me hundreds of dollars overall. I don't think that buying more codes than I need is a valid reason I shouldn't be able to use the ones I do need.
And I absolutely needed one more account for my shops. On the multiplayer server I play on, building space is provided on a per-account basis, and I was right ready to launch the next shop, only needing the space. I planned things out based on the knowledge I had extra accounts if I needed them, and indeed the last time I had checked my account they were all there and unused. Starting over a month before, I spent a lot of time and energy generating buzz for the launch of the shop, and I attempted to set up the account a full 2 weeks before I needed it. I left a code unused on the second account too, with a separate password, and now none of the codes on either account worked.
In the end, when it became clear that this whole process was going to take more than 2 weeks to sort out, I had to go and beg my friend to let me borrow his account so I can keep my promises I made to other people who depended on the shop, and break the pattern of naming with some random name. People kept asking me if I knew someone was copying my design, and they couldn't find the shop because the name was different. And now, there's the unlikely possibility my friend can steal all my stuff from that shop. I spend a lot of time on that server. I'm competitive but I also have a lot of fun. My friend was only willing to let me use the account for a while until I got the codes back, and we had an argument a few weeks ago, and he changed his password. My shop is now locked in a broken state. That impacts me a lot because of the time I've spent on it.
I had left the one code on the second account as a backup even in case this did happen, and even that didn't work. So I ended up spending hours and hours trying to work around not having this one account, and at this point, it's become a tremendous loss, all over this simple matter. And maybe - it's just a game, whatever. But I actually care about it. And the idea that this whole time, Mojang could have spent a couple minutes to look up a code I asked about, to save me days of effort. That's what I'm so upset about.
This is not so much about the codes themselves, but the human element. Like you said, if I haven't used the codes, why do I care so much? Well the reality is, had the support been handled properly and professionally, had my questions been answered, had Mojang helped me with the account, or even been willing to let me have the one account activated, it probably wouldn't matter as much. At this point, I probably sound crazy for my rants, but the truth is I'm more than anything, disappointed because I loved Mojang in a way people wont even understand. I still love the game, I thought they were the best people, I had aspired to meet the creators of Minecraft one day. I even wrote a report for one of my classes about Mojang. This is what hurts so much.
I have done everything reasonable to secure my account. I migrated the account. I used a unique password with letters (both uppercase and lowercase), numbers, and digits. I engaged their additional security questions feature, which is the only protection they have other than the password. I never accessed the website on any computers outside of my home PC, and I kept my home PC regularly free of all viruses or malware. It was still clean when I last checked after the gift codes were first noticed gone. And I reported the issue as soon as it happened. There is nothing more that I could reasonably have done.
I know you say I should use the codes and I did set up a lot of accounts. When I set them up, I set up 10 and thought that was way more than I'd ever need personally, but I was wrong and I needed one more. In additional to the logistics of setting up and remembering dozens of different email accounts, I wanted to leave the other codes unused, because it's tacky to give someone something used. Think about it - giving away a used Minecraft account for a friend for their birthday versus a brand new Minecraft account? The first feels a lot like giftwrapping some piece of junk I don't use in my house, and the second is a thoughtful gift I went out and bought. I haven't ended up giving them away because most people I know don't play the game anymore. But I don't think that's my fault.
A company has an obligation to provide the products or services which it promises. In this case, I was promised the ability to register Minecraft accounts, or give away to anyone this right. There were no restrictions placed on when I could use the codes or what I could do with them, other than I couldn't sell them. The blog post for the Beta release is on and on about how Minecraft provides lifetime upgrades and expansions for free. Clearly that's what I'm to expect. There is no expiry, mentioned at any point, now or in the past. And if they want to add one, well they have at the very least an obligation to let me know.
It's not only possible but probably that not just one but multiple people search the gift code space. This is also not a hard thing to fix. Limit the number of searches per IP per day. Keep track of how many searches people do and throttle it back. Add a simple lock on the codes the account owner can invoke. Make them longer. Email people when codes are used. Compare the IP of who's registering the code and who bought the code. There's no excuse why, in a day of such interconnectivity, I can't find out my codes are used except by logging in repeatedly to check, which is an absurd expectation.
But I think the brute guessing is least likely. They're all gone 100% from my account. I would expect some of them to be left. The search space was still 4 trillion, and there is a limit of 10 per day per IP address. It's more likely the codes were pseudo-random instead of cryptographically random. The difference is well documented. A cryptographic random algorithm is designed by a security expert so it can't be reverse engineered, while a pseudo-random algorithm simply uses a seed to efficiently spit out numbers in a given pattern. Anyone with the seed can get the same sequence of numbers, and the seed is usually something like the computer's timestamp. So, in short, if you correctly guess when the algorithm was started, you know the seed, and if you know the seed and the formula (which is probably something like a simple modulus on each number) you can generate one gift code after another. In a typical program, the random seed is assigned at the start and used throughout, which means finding one seed would generate you potentially thousands or even millions of valid codes at once. You'd get every code generated in that session until the server was reset, and servers are typically reset at most once per day. Think how many copies of Minecraft are sold in a whole day. Of course, most would be used. But they'd all be valid codes from one point. If you found even 1,000 unused codes, and set up accounts which you sold for $5 apiece, you made an easy $5,000. And you can keep doing it. I think Mojang has a responsibility to ensure they use proper algorithms and to be aware if they mess this up. I've specifically asked about this possibility, and it's been completely ignored. It would be easy to disprove if they showed me that other gift codes around the time I set up mine weren't used, or verified the algorithm they were using.
What's also possible is that someone got ahold of my username from my thread where I stupidly mentioned having the codes. (I was actually hoping I'd find decent people to give a few of them away to.) From there, they got my email, which is not hard to find. Because it's publicly available. From that, they used hacked databases to get hashes of passwords I've used on other websites. That's not as hard as you think to do - I was the other day able to confirm at least 30 hashes exist out there. Having the hashes means they can perform a ton of computation on them and ultimately break the password in a brute force manner. It says it would take 8 months to guess my password from a hash, but I have to imagine it can be done faster, particularly if some of those sites use poor security, more than likely as evidenced by their databases being compromised. From there, they know what types of passwords I used to use, and can then make 'educated' guesses as to what my Mojang password was. The last and final step is the security questions, which have been proven over and over to be trivial to get past by guessing answers. So if that's true, it has implications for everything, and I could have known 4 months ago. But the way to defend against that is to notify me when people try to log into my account from other places, or require an email verification for suspicious logins, or even just hide the codes if the login is suspicious. Not to do what they did and say 'everything' is in order with my account but also not answer whether they track logins and then just ignore me entirely.
If they had said they wont replace the codes but still answered my questions and helped me through this, that would probably be within the realm of what I could accept. I was, after all, mainly trying to set up only one account.
Even if they sent me a skeptical email like the one you did, I'd be a lot happier with that. We'd back and forth. I'd get answers to my questions, and know what I can do differently. But they aren't even doing that. I get the feeling like they're hiding something, because they don't answer simple questions. Like, maybe they know there's a vulnerability. And it's not right. And again, I have no idea if it's true, except that all my codes are gone, and they don't even want to figure out what happened. Mojang recently had to suspend accepting PayPal due to fraud, so there are some serious issues going on there for sure.
