119444-about-that-authenticator

== Content ==
			This thing is to much trouble.  And those problems people have every once in a while.  There should be some sorta failsafe if all goes to pot.	
----
			
{| class="blockquote"
This thing is to much trouble.  And those problems people have every once in a while.  There should be some sorta failsafe if all goes to pot.
----
			
I haven't had to remove mine yet, but I do know I'll run into a self-inflicted problem if/when I do because I forgot to write down the seed code I was given to attach it to W*  
 
As for it being too much trouble, I don't see it as any more bothersome than the authenticators I've used on a couple of other games.  Having to type in a code every time I login > having account compromised and dealing with getting unbanned afterwards.	
----
			You have to decide which is more trouble. Using an authenticator, or having your account hacked. :) 	
----
			
I've never had authenticator issues where the authenticator itself was at fault.  I've had to factory reset my phone because something got corrupted once so I had to reset all of my authenticators on every game I played.  That wasn't fun. 
 
However I've never had one fall out of sync.
 
Either way, you can resync the Google Authenticator in the options, and that will usually solve your problem.	
----
			
What I always recommend to people who had or have issues is simply that when CSRs remove their authentication from the account to save the seed code they get the next time they apply it. The seed code will allow you to resync your authentication should you need to reset your phone, apply it to a new device should you wish to have more than one device, lost/damaged your current device, or transfering to a new one.
 
I'm not worried about it because when I set my authentication up I copied the code I was given and stored it someplace safe incase something did happen to my phone. You can also redo the process as well by removing and reapplying authentication on your account in order to acquire a new seed code to save.	
----
			
{| class="blockquote"
There should be some sorta failsafe if all goes to pot.
----
			Also, since google authenticator won't allow apps like Helium to back it up, you can use another app like Authenticator Plus, which does allow full backups (Encrypted, to the cloud if you wish), and will even import your google authenticator settings.	
----
			
I really like using the Authenticator on my account. I like the added security it gives. After reading several stories of players getting their accounts hacked, which freaked me out because I didn't want that to happen to me, I'm glad I don't have to worry about it anymore. The extra goodies and perks you get from using it are a big help too.
 
The only problem I have with it is that I have to constantly switch between Windowed and Fullscreen (I use the computer version of the authenticator) which is a pain but if it stops my account getting hacked, I can live with it. I'd much rather have to waste 5 seconds switching that than lose my account altogether.	
----
			
{| class="blockquote"
You have to decide which is more trouble. Using an authenticator, or having your account hacked. :)
----
			
{| class="blockquote"
You have to decide which is more trouble. Using an authenticator, or having your account hacked. :)
----
			
{| class="blockquote"
I don't see this as an either/or situation as in EITHER you get the authenticator OR you get compromised. I don't believe most accounts get "hacked" just out of the blue either.  My friends and i have played online games for 8+ years and none of us ever got hacked on any of them, including this one .I believe most accounts that do get "hacked" are compromised by people that know you that somehow got your pass or *cough* you gave it to them at some point.
 
I did get the authenticator on W* simply because I was too cheap to pony up the g for the mounts, not because I'm paranoid I'll get hacked.  I keep this annoying evil so they don't take the mounts away.  (I'm SO cheap :P)
 
This is the ONLY game I have an auth. on simply because it offered  the free mount.  
----
			
{| class="blockquote"
Since it has never happened to you, how can you say for sure how it actually happens?  I've had my WAR account hacked, and an attempt on my WoW account(attempt because I did have the authenticator on it).  In neither case had a I given my account info to anyone, including my husband.  But in both cases I did have kinda crappy passwords :P  But I won't say that's how everyone that's been hacked got hacked.
----
			
I have no problem having the authenticator on my account.  I haven't had an issue with it being on my phone and I made damn sure I kept my seed code in case my phone dies or needs to be replaced.
 
I'd like to, at this time, reiterate my support for a Wildstar token the way WoW and FFXIV have them (I believe they just have little decal skins on the same model of VASCO token).  I'd pay a bit extra to have a small standalone unit like that just for the additional relief of not having to worry about whether my phone lives or dies.
 
Not a huge deal, though.  What they've got is fine.  Still, if you don't ask, you don't get.	
----
			I've had to redo the authenticator twice on my account (due to changing/losing phones).. first time was a few hours, the second time about 20 minutes.	
----
			
{| class="blockquote"
I don't see this as an either/or situation as in EITHER you get the authenticator OR you get compromised. I don't believe most accounts get "hacked" just out of the blue either.  My friends and i have played online games for 8+ years and none of us ever got hacked on any of them, including this one .I believe most accounts that do get "hacked" are compromised by people that know you that somehow got your pass or *cough* you gave it to them at some point.
 
I did get the authenticator on W* simply because I was too cheap to pony up the g for the mounts, not because I'm paranoid I'll get hacked.  I keep this annoying evil so they don't take the mounts away.  (I'm SO cheap :P)
 
This is the ONLY game I have an auth. on simply because it offered  the free mount.  
----
			
{| class="blockquote"
Last but not least, we are currently working on adding some grace period for 2FA, which mean that if you connect from a known IP address + have used 2FA is the past X days (exact number to be determined), you will be able to log on without having to enter your 2FA code again. This should make using 2FA more convenient and hopefully encourage more players to use 2FA while still providing an excellent level of protection.
----
			
{| class="blockquote"
That's similar to how NCsoft's login (and I think GW2's?) works. If you log in from a new IP you have to do a few extra steps and then can choose if you like to store the IP. I get hit by that periodically as my ISP changes my IP on occasion.
 
It'd be nice not to have to enter via clicks the code every single time.
----
			
The people that complain about the Authenticator being to troublesome will be the first to demand material compensation when their account gets compromised. 
 
The more steps there are to security the more difficult it is to bypass, the more difficult it is to bypass, the less likely it is to happen, the less... you can see where this is going.
 
Imagine for me, if you will, a house. This house has no doors and windows and isn't very secure. The owner of this home, you, decides that the daily robberies and drafts are too much and you decide to install doors and windows. The are good additions to fight off the cold and keep the robberies at bay, but they haven't stopped.
Locks! This should solve everything, right? Wrong. A trained locksmith or a novice lockpick could easily break into your house. 
So what's next? A deadbolt. Why? Because most burglars enter through the front door because it's easiest. Most people wont say anything about someone trying to enter the front door of "their" home, but usually have a problem if they see someone trying to crawl through a bedroom window. 
The particular burglars are good though, you have only put up a roadblock in their path to your valuables and precious computer. Three robberies later you call ADT. They install a home security system, glass break sensors, door/window sensors, stickers on the window (which according to our ADT guy here in my region say they decrease robberies by up to 18%), and even a fancy sign to put in your front lawn. 
All this probably won't do anything in the long run, but they are added measures, ever increasing levels of security that don't stop criminals, they make it harder and harder for them. Hard targets are hard. Easy targets are more profitable. 
 
When a criminal enters your home either with you there or while you're out they will most likely take easy things to grab that will net the most cash. 
- Xbox
- Computer
- TV on table (wall mounted is usually too hard to grab without damaging)
- Jewelry
- Money
- Silverware
Little things that add up. Generally criminals don't take personal information and most "low-tech" criminals wouldn't know what to do with a SSN before getting caught and sent to man prison for 10 years for identity theft. So you're down a couple thousand dollars and your sense of security.
 
Enter computer ("high-tech") criminal, stage left. Oh what he could do with just a small amount of information. You decided that the authenticator was too difficult because it required an extra 19 seconds of your time. This computer, let's call him a hacker, hacker has some cool software he designed to grab your password.
Unbeknownst to you, you subcribe to the false belief that a password such as Tr0ub4dor&8 is secure.
Simple substitution is the easiest way to include the long list of requirements. You replaced o with 0, a with 4, and added a pretty basic set of numbers and characters at the end. You did this because it was easy to remember. Or so you think...
28 bits of entropy, ~3 days to crack at 1000 guesses per second, pretty basic password stealing software can do this easy. Password strength = weak. 
Try this password out correct horse batter staple, four random words. 
44 bits of entropy, ~530 years to crack at 1000 guesses per second. best thing is you already remembered it.
 
So he has your password. Chances are you use a similar password for your email or another web service. In less than a day this high-tech criminal can literally destroy your life...
Bank account = emptied
Identity = stolen
Credit cards = maxed
Mortgage = defaulted
Car = repossessed
Credit score = irreparably tarnished
 
All because a call to WS CS is too much trouble if your phone gets wiped. 
All because 19 seconds to manually press 6 keys on your screen is difficult. 
 
Think about it.	
----
			
{| class="blockquote"
I don't see this as an either/or situation as in EITHER you get the authenticator OR you get compromised. I don't believe most accounts get "hacked" just out of the blue either.  My friends and i have played online games for 8+ years and none of us ever got hacked on any of them, including this one .I believe most accounts that do get "hacked" are compromised by people that know you that somehow got your pass or *cough* you gave it to them at some point.
 
I did get the authenticator on W* simply because I was too cheap to pony up the g for the mounts, not because I'm paranoid I'll get hacked.  I keep this annoying evil so they don't take the mounts away.  (I'm SO cheap :P)
 
This is the ONLY game I have an auth. on simply because it offered  the free mount.  
----
			
{| class="blockquote"
[...]
 
I also know that this:
is only a problem if your game's security watches someone attempt to login 1000 times a second, getting it wrong thousands of times in a row, and doesn't find that to be cause for alarm. If that seems like incredibly lax security, that's because it is. No game should let logins try and fail to provide the right password indefinitely--after no more than 5 incorrectly attempted logins, it should lock down the account for at least 20 minutes and send an automated warning email to the account owner warning them that someone tried to hack their account, with a link to reactivate the account.
 
So yeah, 2FA is swell. But since the only supported authenticators are specific to people with Google Android or iOS, it's not a substitute for some basic, obvious moves to secure the login UI from automated shotgunned password guessing.
----
			
{| class="blockquote"
That is not how they work....
----
			
{| class="blockquote"
That is not how they work....
----