News and Updates

Archive for the ‘Security’ Category

Keep your Second Life Account Secure

Wednesday, November 11th, 2015

Recently, we have gotten some reports of Second Life accounts getting taken over and their Lindens and /or Bloodlines assets transferred to other accounts. Many refer to this as their account getting “hacked”, but it is more likely that they are getting phished, brute-forced, or their passwords simply guessed. Accounts are not getting compromised “through” Bloodlines or because of Bloodlines. There is absolutely no way that someone could gain access to your Second Life account through your Bloodlines account. The Bloodlines system does not interact with your Second Life authentication in any way.

Regardless, there are a few easy, simple things you can do to make sure this never happens to you. Keep in mind that we are not talking about your account here, or your account on this blog, we are talking about the authentication you use to log into the Second Life viewer.

  1. Make sure your password is strong, and is not anything remotely related to your name, or any word, or anything that remotely makes sense. Make sure it is long, includes numbers, symbols, and both capital and lowercase letters. If your name is Wilson, “wilson” is a bad password. So is “w1ls0n5”. Your password should look something like this: “FSm%9G*NxrZM#C”. Yes, it’s inconvenient to have a password like this, but so is getting all of your stuff stolen.
  2. Never give your password to anyone.
  3. Really, never ever give your password to anyone, for any reason. I mean it.
  4. NO, not even your girlfriend, boyfriend, wife, mother, son, or siamese twin. Nobody. Never, never, NEVER give your password to anyone!!!
  5. Ok, now that that’s out of the way: DON’T CLICK ON LINKS POSTED IN GROUPS OR IN ANY CHAT ANYWHERE IN SECOND LIFE! Once again, if someone posts a link to something in Second Life: DO NOT CLICK ON IT!!! This is how you get phished, someone will post a link to a “marketplace” listing that you think goes to, but it really goes to, which looks just like the sl marketplace, and is designed to capture your login and password (once you type it in), so then they can log in as you and steal all of your stuff. In this example:, “” is the domain you’re going to, and marketplace.secondlife has been set up as a subdomain there. Anyone who owns a domain can set up any subdomain they like on it. Make sure you look at the domain right before the “.com” to see what the real domain is that you’re visiting.
  6. Don’t type your password into anything except a trusted Second Life viewer, or into the website, after you have manually typed into your browser window, and made sure that the last thing before the first “/” in the URL is “”, and not “”. A good practice is to never type your SL password into anything unless you manually typed the URL into your browser.
  7. Don’t worry so much about people getting your public IP address. This tells them very little, and everything you do on the internet exposes your public IP address in some way. This is not how they are getting you. They are getting you because you are doing something like:
    1. Having an insecure password that is easy to guess.
    2. Giving your password to someone.
    3. Clicking on links in chat groups.
    4. Typing your password into sites that you clicked on from chat groups.

On top of that, if someone comes to you saying they are “quitting Second Life” and want to sell you all of their souls and containers, it is likely to be a scam. If someone tells you this, and you buy all of their stuff, and then we find out later that the account had been taken over by someone else, we are going to return everything that you bought from them. If someone is offering a large dump of resources like this, it is a good idea to contact their liege and confirm it with them, or someone else in their clan who knows them. Something else you can do is give them a waiting period, tell them you will buy it in 3 days if everything is still for sale, and report it to Lyle Maeterlinck, and we can check on it. If the person is truly quitting Bloodlines or Second Life, then they shouldn’t mind if we lock their Bloodlines account for 3 days to make sure that the real account owner doesn’t come back. If you’re really quitting Bloodlines or Second Life and want to sell all of your stuff, contact Lyle Maeterlinck first, and I can lock your account for a waiting period to make sure the real account owner doesn’t come back.

If someone asks you to transfer money outside of second life through Paypal or a bank transfer or any other way, it is almost definitely a scam. Don’t do this.

Given all of this, we can never guarantee or be held responsible for third-party transactions. If you are buying containers directly from us, we absolutely guarantee them, but if you are buying souls or containers from anyone else, there is a risk involved. Be careful, take things slowly, and use good judgment. Feel free to contact me directly in Second Life (Lyle Maeterlinck), or comment on this post if you have questions.

Beware of Fake Affiliate Vendors

Tuesday, February 11th, 2014

It has come to our attention that someone has copied the prims and textures of our affiliate vendors, and is passing them out. The fake vendors don’t contain our scripts, but they do contain a script by someone else that asks for permission to take Lindens from your account when you rez the vendor. If you grant permission, it will drain your account of Lindens, and then self-destruct.

No one is authorized to hand out Bloodlines affiliate vendors, and real vendors do not have transfer permission. If someone hands you Bloodlines affiliate vendors, they are fake, and will probably try to drain your account. The only place you can get real Bloodlines affiliate vendors is delivered in a crate from our in-world servers in response to you requesting them from the vendors on Liquid Estate. The servers that the vendors are delivered from are all owned by Mars Bracken, and the vendors themselves will be listed as created by Mars Bracken.

If you have fallen victim to this scam, please check your transaction history by logging into, and find the name of the person that your money was sent to, and file an abuse report on that person for Fraud > L$. Be as detailed as possible in your abuse report.

If you have any questions, please feel free to contact Lyle Maeterlinck directly. Be careful out there!

Privacy Concerns

Wednesday, April 4th, 2012

Some people have been expressing concerns regarding privacy when logging into the website. There have been some unfounded rumors going around, such as that the new Bloodlines HUD “logs your IP”, which is false. It may be possible for some items within Second Life to get access to your IP address using shared media, depending on what viewer you’re using, but no Bloodlines item currently uses shared media features within SL. For more information on shared media and what you can do to protect your privacy, see this linden blog post on shared media. The website does collect hardware and software information when you log in for the purpose of maintaining sessions between the server and your client (browser), but this is not different than any website that you can log into. Keep in mind that you are not required to log into the website in order to play Bloodlines. The reason we created the website logins is to deliver cool new features like profile photos, customized profiles, clan profiles, and a richer way to interact with each other on the website. In order to provide these features, we need to put authentication in place, so that only you can edit your own profile. You have the option of logging into the website if you want access to these upcoming features, but it is by no means required.

Some have also expressed concerns about privacy when changing their password in-world. Also, some people have been trying to log into with their Second Life password. Do not try to log into with your Second Life password, it won’t work. We don’t know what your Second Life password is, and can’t authenticate you with it. Your password for is a different password that you create with your HUD by going to Settings > Account > Register. Right now, when you change your password, you do it over chat on a randomly selected channel. It is technically possible for someone to hear this password if they have a channel scanner. So, we advise you to only change your password when you are out of chat range of other avatars. We will be issuing another update soon that will make an attempt to make this process more secure. Please do not make your password for the same as your second life password; use a unique password. We don’t store passwords in plain text, we only store passwords as encrypted hashes, so not even we can see the password you have chosen, and if an attacker were to gain access to our database, they would not have the passwords you have chosen either.

We take your security and privacy seriously, and we take measures to keep your information as secure as possible. If you have any questions about privacy or security, please see our privacy policy, or feel free to contact Lyle Maeterlinck in-world with questions.

Warning: Never Buy Blood or Lumen Containers on the SL Marketplace

Wednesday, January 5th, 2011

All of the blood containers being sold on the Marketplace are fake or deactivated copies. If you buy a deactivated container on the Second Life Marketplace, we cannot help you. We do not sell official containers on the Marketplace, because as long as copy exploits still exist, we have to have containers rezzed and registered in-world before we can sell them. The only place to buy guaranteed blood containers is in the Bloodlines stores on the following regions:

Liquid Designs

Liquid East

Liquid Badlands

Liquid South

If you are anywhere else, you are buying a container that we cannot guarantee will work. ALWAYS test containers before you buy them. NEVER buy containers on the Marketplace, because it is not possible to test them first. Please see the procedure for how to test a blood container before you buy. Also, this is what to do if you have a deactivated container. Please be careful!

UPDATE: If you do end up buying a deactivated container on the SL Marketplace, please write a review on it saying that it is a scam, and warning others not to buy it. Also, please file an abuse report for fraud on the person who sold you the tank. You can get the name of the person who sold you the tank through your transaction history.

New War Weapons and War Updates

Tuesday, August 10th, 2010

We’re pleased to announce a release date for the new Bloodlines: War weapons. The Handgun, The Sword, and The Flamethrower will be released one week from today, on Tuesday, August 17th! The Handgun has a ‘silenced’ mode so that you can have a gunfight anywhere in Second Life without rezzing bullets and creating collisions with other residents. You can also use this silenced mode in areas where you don’t have permission to rez objects. Both the bullets and the sword contain blood effects when they make contact with other Bloodlines War players.

We will also be updating the Health Serum and the Mine so that they are no-transfer. We regret having to do this, but there are a small group of residents who have permissions-cracked versions of our transferable items, and sell them at below cost. As a result, we have to update all of our transferable items to be no-transfer, and we will not be releasing any more transferable items. So, you have one week to use up all of your current health serums and mines (a great excuse to create a nice big minefield), because after 8/17/10, they will no longer work. If you still have any mines or health serums left over after this date, you can trade them in for the new versions. If you see residents selling any health serums or mines for very low prices, please don’t buy them, they are counterfeit. We are only able to trade in mines and health serums if you originally purchased them directly from us, and not from a reseller. We can’t guarantee any item that’s purchased from a reseller. You must seek a guarantee from the avatar you’re buying from.

If you need to trade in your items, please observe the following procedure:

  1. Items must be placed in a folder, and NAME THE FOLDER WITH YOUR NAME ONLY. To do this, go to your inventory, and select New > Folder. Right-click on the folder and select ‘Rename’, then type your avatar name. Drag and drop your items into this folder.
  2. Please don’t name the folder with any text other than your avatar name. Including additional or different text will delay your trade-in.
  3. Include a note card with a copy of your transaction history for the purchase. You can get this by logging into your account on, then going to Account > Transaction history, and copying and pasting the transaction information into the notecard. Drag the note card into the folder with your name on it.
  4. Pass the folder to Noire Luminos, but please do not start sending in mines or health serums until after they are deactivated on 8/17/10.

We appreciate everyone’s patience while we worked on the new War Weapons, and for your patience with the item trade-ins. We have more exciting Bloodlines additions that will be released in the coming weeks, so check this blog often for updates.

Warning: Do Not Buy Amulets From Other Avatars

Sunday, October 18th, 2009

We have discovered avatars selling counterfeit Infinity Amulets. If anyone tries to sell you an Infinity Amulet for less than the price of $7999, it is definitely counterfeit, and will be deactivated, and you will probably not get your money back. There is absolutely no legitimate reason for anyone to be selling an Infinity Amulet for less than $7999, as there is no legal way to get one from us for less than that price. Infinity Amulets only work for the first person to wear them, so there is no way for someone to use it for a while, then sell it for a lower price. The item is transfer, but the protection it gives is not.

If you have purchased an Infinity Amulet for less than this price from anyone, your best bet is to come forward to us and let us know who you bought it from, and for how much. We’ll do our best to help you, but only if you’re honest with us. If anyone offers or has offered to sell you an Infinity Amulet for less than $7999, please report their name to us right away. If you want to buy an Infinity Amulet, make sure you buy it yourself directly from a vendor. If you legitimately bought an Infinity Amulet from one of our vendors, you have nothing to worry about.

Avoid Fraud: How to Buy a Blood Container

Friday, March 6th, 2009

Below is a procedure you can use to help make sure you don’t buy a tank or cask that doesn’t work or has been deliberately removed from the system by us when an account is terminated.

1. Check to see if the avatar you’re buying from has an active Bloodlines account. Type their name into the search box on, and if you can’t find their page, don’t buy from them, regardless of what excuses they give you.

2. See if the container in question appears on their Blood Cellar page. (Make sure that if you’re buying a full 20 L cask, that you see at least one full 20 L cask on their blood cellar page. If there isn’t one, don’t buy it.) You can get to their Blood Cellar page by clicking on the blood container icon on their profile.

3. Have them rez the container in front of you. Right-click on it and select ‘edit’. Your build tools window should open. Look on the “General” tab, and make sure the creator is Mars Bracken and that the owner is the name of the avatar you’re buying from.

4. In the build window, go to the ‘Content’ tab, and make sure that the container contains a script called ‘Bloodlines Blood Container’. If there’s nothing in there, the tank won’t work.

5. Have the seller set the container to open access and fill/drink mode. Once they’ve done this, when you click on the container, you should get a menu with ‘Fill’ and ‘Drink’ buttons.

6. Fill the container with 0.1 L of blood. (If the tank is full, then drink 0.1 L). Make sure that the blood comes off of your vital blood and goes into the container. The best way to check this is by looking on your own Bloodlines profile, and on the Blood Cellar page of the avatar selling the tank. Make sure that your vital blood dropped by 0.1 L, and that the amount in the tank went up by 0.1 L (or vice versa if you drank instead of filled). If this worked, the tank is good.

7. Now, if you’re ready to buy the container, DO NOT pay the avatar directly and have them hand it to you. Don’t take your eyes off of the container that you just checked. Have the seller set it for sale at the agreed price, and then right-click it and select ‘buy’. You will now be the owner of the container.

General tips:

  1. If they’re selling it in the Bloodlines store, NEVER buy from them. Selling blood in the store is prohibited. Please report them to us.
  2. If you see anything funny happen after you check the container, check it again.
  3. Don’t let them rush you. You’re the one that stands to lose if this deal goes bad. Take your time, and if you’re not certain it’s good, don’t buy it. If they’re in a hurry, ask to meet at a better time for them.
  4. Don’t let them talk you into any other custom procedure, no matter what explanation they give you. In fact, if they try to talk you into anything else or convince you of anything, it’s a good sign that they’re scamming you.
  5. If they say they work for Bloodlines, or that they’re friends with the creators, or that Bloodlines or the Lindens certified their tanks, they are lying to you.

If they give you any trouble or you get a bad feeling about them or anything else, trust your gut and don’t buy it.

If you do end up buying a tank that doesn’t work, I’m sorry, but we won’t be able to replace it for you. Here is the action you can take:

1. File an abuse report on the person for Fraud > $L. We’re not sure that they will be able to help you, but it’s worth a shot.
2. Send us their name so we can possibly take action against them, including but not limited to: banning them from our land, draining and deregistration of additional blood containers and termination and destruction of Bloodlines account(s).

We want to support the blood trade, but we take theft and fraud very seriously, and we pursue blood theives and frauds to the extent that we are able.

SL Bug Affecting HUDs

Monday, December 15th, 2008

There is a bug in SL at the moment that may be affecting your HUD and Bloodlines items. We want to make you aware of it, as well as ask for your help in filing messages on the SL JIRA, in hopes that it may get fixed sooner rather than later.

The SL bug is one that affects the owner data on prims; in some regions, the sim is unable to report who owns what prims properly. This has a negative effect on many things, including our HUDs; if your HUD cannot tell that you are the owner, or can’t tell that your friend owns their HUD, then you may have issues with scanning, drinking blood from casks/tanks, using potions, etc.

This is NOT affecting all regions, so if you are having issues, definitely try your items in another region to see if they resolve. 

If you’d like to do your part to help get this issue fixed – you can vote on the JIRA issue associated with this bug. Voting only takes a moment, and if sufficient votes rack up the Lindens tend to give the issue higher fix priority.

The JIRA issue can be found here.

Once the JIRA page loads, on the left side, near the top, it should say: “If you were logged in you would be able to see more operations.”

If you click the “logged in” portion  of that statement, it will prompt you to log into the SL JIRA. Once you do, you’ll then see (on the left side again):

” Voting: You have not voted for this issue. Vote for it if you wish it to be fixed”

Click on “Vote for it” and you’ll add your voice to those that wish to see this issue fixed in the near future!

NEW items! The Siphon, The Blood Bottle, and Version 3.0 Containers

Tuesday, October 21st, 2008

Today we’re proud to announce the release of Version 3.0 Blood Containers, Blood Siphons, and Blood Bottle Container Refills.

The Version 3.0 containers have a few exciting new features: Group Security and Drink / Fill Records. We’ve gotten rid of the unwieldy user list feature that we had on the version 1 and 2 containers, and we’ve added a feature so you can allow access to a Second Life group. So, you can either set your container to open access, or to group access only. You can still set the container to fill only or fill / drink for others that have access. To see a readout of the current security settings, just press the check button on the menu. In addition, we’ve made it so you can check the drink / fill record for your containers. Under security, just check ‘View Record’, and you’ll get a readout of the last 25 drinks and fills, so you’ll know who’s been filling and who’s been drinking.

The Blood Bottles are 5L refills for your blood containers. They will work on version 2 and 3 containers, and you can track them on your Blood Cellar page.

The Blood Siphon is a tool you can use to quickly move large amounts of blood between your containers, without having to drink from or bleed into them. You can use it to distribute or consolidate your blood. It’s a must-have tool for blood merchants, and anyone who keeps a blood cellar for their clan or bloodthirsty guests. Blood Siphons will also work on version 2 and 3 containers. Once you get your blood siphon, you’ll get a new item icon on your Blood Cellar page.

Bloodlines Validation and Terms

Saturday, October 11th, 2008

A few security checks have been activated on the Bloodlines systems today. First, we need to get everyone to indicate that they agree to our terms and conditions to continue playing. If you detach and reattach your HUD, our terms of service will be vended to you, and you’ll have to answer ‘Yes’ to the blue dialog window indicating that you agree to them. You’ll only have to do this once. In addition, we’ve added an automatic validation system, so that even if those pesky hackers and counterfeiters are able to modify the permissions on the HUD again, it won’t work unless it validates with our purchase database. No activation keys will be necessary, the system knows who purchased a HUD and who didn’t. We wish we didn’t have to waste your gaming time and our development time with troubles like this, thanks to everyone for your patience, and please know that we’re doing these things in the best interest of the system.

If you get an error message telling you that you’re not validated, or if it just tells you “There was an error, please try again.”, this may mean that our system didn’t get your avatar name properly. If your connection happens to be slow or there is a lot of lag, you might notice that the name on your SL resident profile appears as “(waiting)”, or “Loading…”. Our system may also get your avatar name this way, so it’s unable to check you in, and will give you an error message. If you just wait a few seconds, or try viewing your own profile and making sure your name comes up, then reattach your HUD, it should work. If not, be sure to let me (Lyle Maeterlinck) know, and I’ll look into it for you as soon as possible.

Also, please note that the current version of the Bloodlines HUD is 2.7, if you’re not currently using 2.7, you’ll need to update in order for it to work. We’ve been able to turn our auto-updaters back on, so your HUD should check in when you attach it and make sure that you have the most recent version.