Read these answers before you use Asterobot with an Ankama account you care about.
Can my Ankama account get banned?
Yes. Using a bot breaks Ankama's terms of use, and Ankama can sanction the accounts involved at any time. That holds in Full socket mode and in MITM mode, with a package you wrote or one from the marketplace. Nobody can promise that an account stays safe, and these docs give no advice on avoiding detection.
Only use an Ankama account with Asterobot if you accept that risk.
Is MITM mode safer for my account?
No. A bot in MITM mode is still a bot, and it breaks Ankama's terms of use just the same. What MITM mode changes is who holds your login: you sign in yourself, in Dofus, and never give Asterobot your Ankama login or password. See Full socket and MITM.
Where does Asterobot keep my Ankama password?
In a file called accounts.toml, in Asterobot's data folder, as plain text, and only if you chose to store one. It isn't encrypted because Asterobot has to type it into Ankama's sign-in page. The same file holds each account's Login ID and the tokens Ankama gave Asterobot.
On Linux and macOS, Asterobot restricts the file so only your user account can read it. On Windows that restriction has no effect. Either way, anyone who can open files as your user, or who gets a copy of the file, can read the password and use the tokens. Asterobot never sends the password back to Asteroboard.
Add an account has the details, and Files and folders shows where the data folder is.
Do I have to store my Ankama password?
No. The password only serves automatic sign-in. Without one, you sign the account in yourself from Asteroboard whenever its sign-in stops working, as Manual sign-in shows. MITM mode needs no stored account at all.
What else on my computer gives access to my accounts?
A few files and folders, each worth protecting like a password:
| What | Where | What it gives access to |
|---|---|---|
accounts.toml |
The data folder | Your Ankama Login IDs, the passwords you stored, and Ankama's tokens |
zaapmanager/browser-profiles/ |
The data folder | A live Ankama session for each account that signed in automatically |
website.token |
config.toml, in the settings folder |
Your asterobot.net account, through Asterobot's sign-in |
server.basicAuth |
config.toml |
Asterobot's port, with passwords written in plain text |
On Linux and macOS, only your user can read these. On Windows, that protection has no effect. Never share any of them, not even to get help: Getting help lists what must stay private.
Can I use an account protected by Ankama Shield or two-factor authentication?
Only in MITM mode. Full socket mode doesn't support these accounts: Asteroboard has no field for a verification code, and automatic sign-in only types the Login ID and the password. In MITM mode, you sign in yourself in Dofus, codes included, and the bot relays that session. See Shield and two-factor authentication.
What happens when Ankama shows a captcha during automatic sign-in?
Asterobot gives up, and a person has to sign in. You have two ways out:
- Sign in yourself from the sign-in dialog. This always works, wherever Asterobot runs.
- When Asterobot runs on a computer you're sitting at, turn off
zaapmanager.browserHeadlesson Server > Config, start the automatic sign-in again, and answer the challenge in the browser window that opens. Turn the setting back on afterwards.
See Automatic sign-in.
Why doesn't Asteroboard say why automatic sign-in failed?
Because its message is the same whatever went wrong, starting with ankama account authorization required. The real reason is only in Asterobot's log. In the terminal or on Server > Console, look for the warning Automatic Ankama sign-in failed, a person has to sign in: its error says what happened.
When you started the sign-in from the dialog's own button, the dialog also shows a picture of the page the browser was on, which often tells a captcha from a wrong password. See Automatic sign-in.
What can a package do with my account?
Everything your character can do in the game. A package's script can send any message to the game server as your character, to move, fight, trade, sell or delete items. It reads everything the game sends, can read the session's game ticket and can close the game connection. On a MITM bot, it can also change or block what your Dofus and the server send each other.
It can't read your Ankama login or password, open files on your computer, use the internet or reach your other bots. Only play packages from authors you trust. Trusting a package lists everything.
Do package permissions limit what a package can do?
Not yet. A package can list permissions in its manifest, but Asterobot doesn't enforce them: a package that lists none can still do everything described above.
Note
Coming soon. Asterobot will enforce the permissions a package lists. Until then, don't count on them to limit what a package does.
See Trusting a package.
What do I do if I think someone used my Asterobot?
Stop Asterobot, or put server.listenAddress back to 127.0.0.1:8080 and restart it. Then change the basic auth passwords, click Disconnect on each Ankama account in Account Manager, change the Ankama passwords you had stored, and log Asterobot out of asterobot.net before signing in again. Security goes through each step, and explains who can reach Asterobot in the first place.