Blizzard Mobile Authenticator The Blizzard Mobile Authenticator ( or just " Authenticator " ; previously Battle . net Mobile Authenticator ; was also confusingly also called " Battle . net Authenticator " by Blizz ard ) is a small mobile phone application that functions similarly to the Blizzard Authenticator key fob device . However , it cannot be used in conjunction with the other device , one or the other can be used , but not both . On March 27 , 2017 with the release of v2 . 2 . 2 ( Android ) / v2 . 2 . 4 ( iOS ) , the app was renamed to the " Blizzard Mobile Authenticator " or just " Blizzard Authenticator " and the icon was updated . On January 9 , 2012 , three new languages were supported ( not on BlackBerry ) : Português ( Portuguese ) , Italiano ( Italian ) , and Polski ( Polish ) . The application is available for the iPhone , iPod Touch and iPad with iOS 3 . x and later . An iPad without 3G support or an iPod Touch needs a wi - fi connection for a setup , re - setup or a re - sync . The iOS application is free of charge . It ' s also available for many other mobile smartphones including phones running the Android operating system , Windows Phone 7 OS , and some BlackBerry® smartphones . Until December 13 , 2011 a version of the authenticator was available for some mobile devices like the Motorola RAZR , Nokia ' s Series 40 , and other " non - smartphones . " On June 16 , 2016 , the " One - Button Authenticator " feature was announced that removes the requirement for copy / paste of the authentication code , but instead gives an Approve / Deny option . This new feature is only available on the Android ( release Jun 15 , 2016 ) and iOS ( released Jun 13 , 2016 ; v2 . 2 . 0 ) versions , so far . The ability to approve or deny logins via Notifications and approve or deny login requests on your smart watch functionality appeared on iOS v2 . 2 . 1 on Jun 27 , 2016 and for Android on Nov 8 , 2016 . An iOS v2 . 2 . 2 appeared on Nov 8 , 2016 , but it isn ' t clear what the changes are ( probably bug fixes ) . Supported mobile phone OSes and languages . Mobile phone OS : Language : Versions . " As of Nov 8 , 2016 " Originally released . May 6 , 2014 update . An update was announced to occur around May 6 , 2014 for the following : Discontinued Java - based version . On November 10 , 2011 , Blizz ard announced it would be discontinuing support for the Java - based ( J2ME ) versions of the Battle . net Mobile Authenticator that were available for download at http : / / mobile . blizzard . com . Updates will no longer be provided after December 13 , 2011 . Unsupported Mobile Devices . It is possible to install and use the mobile authenticator on many mobiles which are not officially listed as supported by Blizzard . Most mobile phones are capable of running the basic java authenticator application , information on installing the authenticator on unsupported devices can be found here . Specification . The initialization of a Mobile Authenticator is done via an RSA encrypted request to Blizzards initialization servers including an one time pad key for encryption of the response . The server generates an 160 - bit key which is later used for code generation and a serial number is connected to that key . Both things are stored on the server and are also sent back to the client ( encrypted with the one time pad key from the request ) . The code generation is done via encrypting the current time ( milliseconds since 1970 / 01 / 01 0 : 00 UTC divided by 30 , 000 ) with HMAC - SHA1 using the key from the initialization . From the result are some bytes selected and displayed as current authenticator code . Security Vulnerability . Because of a weak one time pad key generation algorithm on the client side , an attacker who is able to capture the encrypted initialization response between server and client device can fully compromise the security of the Battle . net Mobile Authenticator . The reason is , that the one time pad key used for encryption of the server response only depends deterministic from the current time on the client device . Normally that time shouldn ' t differ too much from the common time . So an attacker only needs to guess some time values , calculate the corresponding one time pad keys , use them for decryption of the captured server response and check , whether one of the results make sense ( because of the known format of the included serial number , it is easy to say , whether a result makes sense or not ) . If he finds such a result , it is very likely that he guessed the correct one time pad key and now knows the authenticator ID and the secret code calculation key from the decrypted response . To prevent this attack even if there is no real randomness ( e . g . hardware random generator ) is available on the client device , there should be used aside from the current time also some kind of user generated randomness ( pressing random buttons on the device , . . . ) for creating the one time pad key used for encryption of the initialization data . Desktop ports . It is possible to re - implement the specification to run the Battle . net Mobile Authenticator also directly on the PC . It is difficult to say , whether this is less secure or not in comparison to running it on a real mobile device . Of cause an attacker could read out the necessarily stored secret code calculation key from the PC via a trojan and so breaks the security of such a PC authenticator . But with a trojan on the PC of the victim , the attacker could also read the typed authenticator code when the victim is logging into the game , interrupting the connection of the victim and using the current authenticator code by itself for immediate game login ( maybe with a bot ) while preventing further game logins of the victim via the trojan . List of desktop ports with public source code availability : It is also possible to run Blizzards implementation within a mobile phone emulator on the desktop . An online version also exists and is publicly available since November 2011 . The source code of the PHP implementation are published , but this is not the case for the website . This kind of online application are less secure than a desktop port , but , as an advantage , you can retrieve your code from anywhere .