Step 3 of 5

Making an account and confirming your email without regrets

An account outlives the installation. The email address and password you choose today are what you will use to recover the account in three years, so this step is worth ten unhurried minutes. Nothing here is specific to one game; it applies to any online service that keeps a record of you.

Data card 3.1
What a sign-up form asks for, and why

A sign-up form for an online game typically asks for four things: an email address, a password, a display name, and a confirmation that you accept the terms. Some also ask for a date of birth, which is how the service applies its own age rules.

That is a short list, and it is worth noticing what is not on it. A game account does not need your residential address, your telephone number or a copy of any identity document in order to exist. If a page asks for those at the sign-up stage, stop and work out why before continuing. Under the Australian Privacy Principles, organisations covered by the Privacy Act are expected to collect only the personal information reasonably necessary for their functions; the Office of the Australian Information Commissioner publishes the principles and explains how they work.

The general habit is simple: give the least that makes the service work, and keep a note of what you gave.

The date of birth deserves a sentence of its own, because people often type something untrue to move the form along. It is worth entering correctly. Services use that date to decide which features and purchases are available to the account, and some of them ask for proof of it later if the account needs recovering or if a payment is disputed. A birth date invented in a hurry is a problem you have posted to your future self, and it cannot always be corrected afterwards.

It is also worth pausing over the tick boxes beneath the form. One of them is usually the terms of service, which you have to accept; the others are often marketing consents, which you do not. Reading those four or five words before submitting takes a moment and spares you a weekly email for years.

Data card 3.2
Choosing the email address

The address on the account is the key to the account. Choose it deliberately rather than using whichever one is already typed into the browser.

• Use an address you will still read in five years. An address tied to an employer, a university or an internet plan disappears when the arrangement ends, and the account becomes unrecoverable.
• Use an address you control. A shared household address means everyone in the house can reset the password.
• Consider a separate address for games and shopping. It keeps the promotional mail out of the one you use for banking and work, and it limits what a single leaked address reveals about you.
• Make sure you can read it today. The confirmation message arrives within minutes, and a password reset needs the same access later.

Data card 3.3
The password, done once and done properly

The single most useful habit with passwords is not complexity. It is never reusing one. A password used on two services is only as safe as the weaker of the two, and a game account is rarely the stronger one.

1. Open the password manager you already have. Every major browser includes one, and so do both Windows and macOS. There is nothing to buy.
2. Let it generate a long random password for the new account. Length does more work than punctuation.
3. Save it under the game's name, so that it is findable later by someone who has forgotten what the account was called.
4. Make sure the password manager itself is protected — by your device login, or by a passphrase of several unrelated words that you can remember without writing down.
5. If you prefer paper, that is acceptable. Write the passphrase down, keep it where you keep other valuable paper, and do not photograph it.

The Australian Cyber Security Centre publishes general guidance on passphrases and account security for individuals, and it is the reference worth bookmarking if you want more detail than one step of a course can give.

Data card 3.4
The confirmation email

After the form is submitted, the service sends a message to the address you gave, containing a link. Following that link tells the service that the address is real and that you can read it. Until then, most services keep the account in a half-finished state, and some will not let you log in at all.

It matters for one practical reason above all: password recovery runs through that address. An unconfirmed address is a locked door with the key still in the post.

In the example used by this course, the sequence is exactly this: register on the vendor's page, confirm the address from the email, then log in. The affiliate network that operates our link describes the arrangement in the same order.

Visit the War Thunder website

Paid affiliate link. If you register and confirm an account after following it, GRAVELGANT s.r.o. receives a commission from the affiliate network. Your costs and your account are identical either way.

Data card 3.5
Two-factor and recovery

Many game services offer a second step at login: a code from an application on your phone, or a code sent by email. Turning it on means that knowing the password is not enough to enter the account.

It is worth doing on any account that will eventually hold purchases. It is also worth doing before anything is purchased, because the awkward moment to discover the feature is after something has gone wrong.

Two practical notes. Keep the recovery codes the service offers — they are what rescues you when the phone is lost. And if the second step arrives by email, the security of the account rests on the security of that mailbox, which is another argument for treating the mailbox as the valuable thing.

Data card 3.6
Your display name is public

The name you choose is visible to strangers, often permanently and sometimes unchangeably. Avoid your full real name, your birth year, your suburb and the name of your school or workplace. This is ordinary good practice rather than a warning about any particular service.

Online games are social places, and the social part can occasionally be unpleasant. Learn where the mute, block and report controls are in the first session rather than when you need them. The eSafety Commissioner is the Australian office dealing with online safety, including serious online abuse, and its site explains what can be reported and how.

Data card 3.7
Messages that are not from the game

Once an address is used for a game account, it occasionally attracts messages pretending to be from that game: an unexpected prize, a problem with the account, a free item waiting behind a link. The calm response is the same for all of them.

Do not follow the link in the message. Open the service the way you normally do, by typing the address yourself or using your own bookmark, and look for the same notice inside your account. If it is not there, the message was not real. Scamwatch, run by the National Anti-Scam Centre, describes current approaches and takes reports.

No legitimate game support team needs your password. Nobody does.

Summary
Before you move on

At the end of this step you have an account in your own name, reachable at an address you will still read in five years, with a password that exists nowhere else and, ideally, a second factor switched on. None of that depends on which game you chose, which is why it is worth getting right once.

Step 4 opens the client for the first time.