138627-two-step-verification-removal-no-longer-needs-a-ticket

== Content ==
			
Hey folks,
 
After a lot of hard work our account systems team has created a webpage that allows you to remove two-step verification from your account without CS intervention!!!
 
find out how you can do with our latest KB article:
https://support.wildstar-online.com/hc/en-us/articles/204680615	
----
			
Okay,
 
I've asked this over twitter, but I want it documented here as well.
What prevents someone who might have gotten my credentials somewhere from logging in on the account and removing the authenticator, in order to plunder my game account.
If he has my email and password, he could now only access the website, but never the game.
 
If authenticators can be removed by ourselves when we have issues, then what is the point of adding it in the first place?	
----
			
This, what Oliver said.
 
It is like having awesome lock on the doors... while leaving window right next to it completely open.
 
I disagree with this, I like my account secured.
			
				
	Edited October 7, 2015 by Jayvi	
----
			I am split on this - glad it is easier to solve this issue ourselves rather than waiting 24hours without being able to play - but I can see the security concerns, A replt from Carbine would be awesome - Thanks	
----
			
Hey folks,
 
There is always a trade off. The number of player-email compromises is very low . While we agree if someone has complete access to a players email, they can remove the player's authenticator on their NCSOFT account and that is bad, it however pales in comparison to the number of requests we get to remove authenticators due to phone issues which is 99% of the requests. 	
----
			
{| class="blockquote"
Hey folks,
 
There is always a trade off. The number of player-email compromises is very low . While we agree if someone has complete access to a players email, they can remove the player's authenticator on their NCSOFT account and that is bad, it however pales in comparison to the number of requests we get to remove authenticators due to phone issues which is 99% of the requests. 
----
			How about add something similar to GW protection? Like name of one player character on the account to remove this protection? Probability of hacker knowing what character is on that account is very low, on the other hand player should be aware of name of his toon(s).	
----
			
{| class="blockquote"
I'm sorry, but if it's really this easy to remove the authenticator, that's not a trade-off, that a plain open security hole you are creating.
Please explain what the process is for removing an authenticator.
Because right now I'm assuming the worst, and if you indeed have opened a security hole like this you are going to be liable.
----
			
{| class="blockquote"
Right now you simply go to your account settings and remove it via automatic request, that uses your email adress for verification. So as long as your mail is secured you are ok. Once you have mail compromissed you are screwed.
----
			
The entire 2 step verification is a joke. 
 
Ive played WoW and countless mmos for 10 years and ive been compromised once.
 
Its not about adding another layer - its about having a mindset not *cupcake*ing clicking whatever bullshit there is out there, and keeping your PC clean on a basic simple level.	
----
			
{| class="blockquote"
The entire 2 step verification is a joke. 
 
Ive played WoW and countless mmos for 10 years and ive been compromised once.
 
Its not about adding another layer - its about having a mindset not *cupcake*ing clicking whatever bullshit there is out there, and keeping your PC clean on a basic simple level.
----
			You know 2-step verification is complex procces that cannot be broken by force. Trying to break security pin and password by force macro simply wont work. That is why it is excelent layer of protection. But this is feature is literally like disabling it completely. With simple removal like this it is like you are not even having this protection.	
----
			
Smiley, now that those hard working gentlemen are completed this project of automating the account authentication removals, can we get them working on the damn PvP leaderboards page that was supposedly done & functional 1 year ago and being 'tested internally' ??? 
 
I mean, how hard can it really be to query a bunch of data from your database and display it in a neat table on a webpage that updates every 15 minutes? I seriously can't understand why this hasn't been completed.
 
This post will probably go unanswered like the 500 other ones I've made, but just in case you read this and respond by some miracle, I'll check back for a response in a week.
			
				
	Edited October 7, 2015 by SamuelJackson	
----
			
{| class="blockquote"
Okay,
 
I've asked this over twitter, but I want it documented here as well.
What prevents someone who might have gotten my credentials somewhere from logging in on the account and removing the authenticator, in order to plunder my game account.
If he has my email and password, he could now only access the website, but never the game.
 
If authenticators can be removed by ourselves when we have issues, then what is the point of adding it in the first place?
----
			
I personally hate the way they implemented the stupid random keypad to input 2-step... But now I'm angrier actually. You made 2-step a very annoying system to enter into the computer for security reasons in case someone is key logging my computer (lol what) but now you've made the whole ordeal pointless by making it as easy as hacking my email to remove the whole thing. 
 
My gods... I get you are swamped with requests from the unthinking... But come on!	
----
			All has been said. Pretty bad decision.	
----
			
{| class="blockquote"
Okay,
 
I've asked this over twitter, but I want it documented here as well.
What prevents someone who might have gotten my credentials somewhere from logging in on the account and removing the authenticator, in order to plunder my game account.
If he has my email and password, he could now only access the website, but never the game.
 
If authenticators can be removed by ourselves when we have issues, then what is the point of adding it in the first place?
----
			
A simple solution to the security hole you're talking about: Use different passwords for game and email.  Ideally, different for every different account.  That might be the first password tip ever given to anyone.  The only other contenders are not to use any personal info for the password and to make it more than simple dictionary words.
 
At the absolute very least, use a different password for each of your different email addresses.  These are always used to recover passwords for everything else electronic, so protect those to the highest degree.
 
There's a second layer of security for the website, which protects the second layer of security for your game account.
 
I've only had a successful direct attack on any of my accounts for anything once.  There was a phone bill taken out in my name because I was stupid at 19 and gave out my SSN to a credit card scam.  That's 1 incident in nearly 20 years of using passwords for many different types of accounts.	
----
			
Virtek, sorry to burst your bubble, but password is not enough. Good password and non retard behaviour can work against phishing attacks (or other forms of social engineering) but it wont work against brute force tools.
 
Breaking through password is not matter of security but just the matter of time. Brute force method does not work against 2-step verification because of the way it is designed.
 
Right now we are simply not protected. Password security can work against teenagers who wanna boos their egoes (or other amateurs in general) so our only protection now is basicaly the fact that WS accounts may not be attractive enough for real deal to target it.
 
Edit: Well what you can do is to frequently change your e-mail password which lower chances of such account to be compromised or set up 2-step verification on your e-mail directly, which is not common practice. And having 2-step verification somewhere else because of this 2-step verification is not working is simply... CUPCAKE
			
				
	Edited October 8, 2015 by Jayvi	
----
			
Pretty much what Jayvi says.
And unless your password consist of a sentence, adding special characters, capital letters or numbers makes diddlysquat difference for a bruteforce.
Whether it needs to go through a-zA-Z or a-Z0-9!@#$ makes no difference, it just extends the total time needed to brute force the entire thing a little bit.
 
There's a great comic explaining how password strength works:
 
 
XKCD nailed it really with this.
Every company thinks they are re-inventing security when applying password restrictions, like a minimum length of 8 characters, add a capital, or a special symbol.
Human behaviour is so predictable that most brute force scripts already have pre-defined patterns for determine what a password might look like:
 
Capital letter requirement: First, last and symmetrical approaches   (Apassword, passwordA, pasSWord)
Number requirements: First, Last, Symmetric and l33t
Symbol requirements:  First, last, Symmetric
Use a script like that and you're guaranteed to get most password broken by it.
Because humans are lazy when it comes to finding passwords, and predictable.
 
Carbine made a huge mistake by this.
Everyone might as well just remove their authenticator now and get the free exp boost.
The effects and end-results are the same.
			
				
	Edited October 8, 2015 by Olivar	
----
			It sucks not to live in bliss by not knowing how these things works doesnt it Oliver? :)
			
				
	Edited October 8, 2015 by Jayvi	
----
			
{| class="blockquote"
It sucks not to live in bliss by not knowing how these things works doesnt it Oliver? :)
----
			
{| class="blockquote"
Hey folks,
 
There is always a trade off. The number of player-email compromises is very low . While we agree if someone has complete access to a players email, they can remove the player's authenticator on their NCSOFT account and that is bad, it however pales in comparison to the number of requests we get to remove authenticators due to phone issues which is 99% of the requests. 
----
			
{| class="blockquote"
Soooooooo.
 
Normal login: Email+password.
 
2-step: Email+password+authenticator app.
 
Remove authenticator app code requirement to get rid of authenticator, without adding any other sort of security layer:
 
Normal login = 2-step login. Except 2-step is a slight pain in the a** every 7 days. Like a breeze hitting a sore wound.
 
But obviously, if you just remove the authenticator when people e-mail you, no questions asked, then this step makes perfect sense, as you've already completely screwed over your own system.
 
Which begs the question: Why don't you do what facebook and google does, that 2-step is not an app, but a sms-text code to a phone number. Most people that lose their phone retain their phone number, they've just lost the app.
 
Meaning that they will be able to access the same phone number as before, thus keeping security intact.
 
Or you can just keep the authenticator as it is now, and then for your removal site it will send a text code to your phone number, which is then needed to remove the authenticator on your site.
 
Proper solutions are really, really obvious, and are proverbial low hanging fruits. Go do. 
----
			
I am actually curious if any of you tried to remove authenticator or are just playing security experts for the kicks. Current system does not allow you to remove an authenticator unless both your _game_ account and _email_ account was compromised.
 
And if your _email_ account was compromised then you're in for a world of much bigger hurt than silly game account, 'cause I highly doubt that mails in your mailbox contain less sensitive information than your game account. Besides, with ticket system, if someone had both mail and game account compromised, just not the 2-step, he could still remove it with ticket by pretending to be the account owner through mail.
 
Granted I am far from security expert and I do not know what flaws this system may have, I do know however that it's not worse than it used to be. The only thing I would be complain about is that there does not seem to be any limit to retries (say 3 before resending a new verification code) in inputting verification code from your mailbox as that is only 6 digits, only 1m of combinations, easy to brute force.
			
				
	Edited October 8, 2015 by Dennor	
----
			
{| class="blockquote"
I am actually curious if any of you tried to remove authenticator or are just playing security experts for the kicks. Current system does not allow you to remove an authenticator unless both your _game_ account and _email_ account was compromised.
 
And if your _email_ account was compromised then you're in for a world of much bigger hurt than silly game account, 'cause I highly doubt that mails in your mailbox contain less sensitive information than your game account. Besides, with ticket system, if someone had both mail and game account compromised, just not the 2-step, he could still remove it with ticket by pretending to be the account owner through mail.
 
Granted I am far from security expert and I do not know what flaws this system may have, I do know however that it's not worse than it used to be. The only thing I would be complain about is that there does not seem to be any limit to retries (say 3 before resending a new verification code) in inputting verification code from your mailbox as that is only 6 digits, only 1m of combinations, easy to brute force.
----
			
{| class="blockquote"
The entire 2 step verification is a joke. 
 
Ive played WoW and countless mmos for 10 years and ive been compromised once.
 
Its not about adding another layer - its about having a mindset not *cupcake*ing clicking whatever bullshit there is out there, and keeping your PC clean on a basic simple level.
----
			
{| class="blockquote"
They need your email to login.
Meaning if they are on that step, they already know your email, and your game password.
----
			As long as your e-mail has aunthenticator of its own it is ok. But not every e-mail has 2-step verification.	
----
			
What people are saying is that this new change makes 2-step verification pointless, because anybody that has everything they need for your account except your authenticator, can just remove your authenticator, so why even have an authenticator?
 
But it's not true, because even if they know your email address and password, it doesn't mean they can read your email.  Even if your email doesn't have an authenticator, it's still a different account.	
----
			
{| class="blockquote"
And if your _email_ account was compromised then you're in for a world of much bigger hurt than silly game account, 'cause I highly doubt that mails in your mailbox contain less sensitive information than your game account. Besides, with ticket system, if someone had both mail and game account compromised, just not the 2-step, he could still remove it with ticket by pretending to be the account owner through mail.
----
			
{| class="blockquote"
That's why I don't use same e-mail account for personal/business correspondence and for games... so your point is mute.
The point is that 2 step verification now serves no purpose, so they may as well just remove it.
----
			
suggestion: 2step removal with an, BEFORE THE 2 STEP is removed, security code as sms or voice mail.
They have to type the code. Then it works but the phone certification stays until an certifcated account changes the phone number.
 
 
2 step like fb, yt, google,.. be safe!
 
For sending codes : free internet sms service which carbine can trust. or even an own one.
pay this with advertising and letting serious(no illegal!!) sponsors pay.
 
Example: after this 1 spot you get your code.
 
/edit: for authentificators: let the users allow them to certificate via an authorized[added and verifyed by sms before the authenticator is going to be disabled] (mobile) phone number.
Non  mobile: voice sms.
Ip locating can help an ton.
			
				
	Edited October 11, 2015 by Bladeofhonour	
----
			You know whats really sad? You don't even need 2-step verification to access your account on the main website. You can just log in without being prompted for 2-step verification. Why is this bad? Oh I don't know maybe the fact that you can just make your way over to your "Transaction History", go down to a little tab called "Serial Codes", and bam open a ticket providing the serial code of your game and some other minimal information to get your authenticator removed. How do I know? I tested it myself on my own account just to see if I could get the authenticator removed via ticket. 1 day later it was removed just by providing the serial code and some other minor details... Everyone can see for themselves how easy it is for your account to be compromised even with 2-step for WildStar. Carbine. You already had a huge security flaw on the website and now you make it even easier to get the authenticators removed. Are you working to help the players? Please look into this ASAP and think about what you're doing.
			
				
	Edited October 15, 2015 by Ghrim	
----
			
Wait, GW2 went F2P too - and it's still impossible to remove the authenticator without help of the Anet support. Right, because they could also remove it completely if they did.
Just saying "We changed it that way because we can't handle the amount of requests" isn't the right way. It's a declaration of bankruptcy. You gotta say: "We want our player's accounts to stay safe and therefore you have to wait a little". I agree that a lost authenticator is frustrating for people, but to be honest: it's their own fault, so it's just fair to wait a bit. I mean, it's not that hard to write down the authenticator key on a piece of paper or save it on another machine.
If the current solution was a temporary fix to deal with the F2P launch wave and "real 2FA" will be turned on again, i'm totally ok with it. See, i wouldn't care if my account (among others) wouldn't be worth real money unlike the freebots.
 
 
(Oh, and props to Olivar for educating in IT security ;))
			
				
	Edited October 16, 2015 by Smiley	
----
			I don't really understand this fully, but not liking the idea of this at all. Also please add authenticator to sign into website. I still don't understand why it isn't used on the website as well as the game.	
----
			
Just found this, and...What?
 
 
First of all, I should mention this isn't really an issue for me, as I have separate e-mails for the authenticator and the account, and am pretty confident with my personal security.However, how one manages their personal security could, but I don't believe should be in discussion here - Carbine's employees would probably be last ones wanting their security to be compromised, thus the measures should, in the first place, be taken on their side... and to each player their own.
 
It makes no sense, as it's been mentioned more than once on this topic before, to create a way around a much harder to get past security step.
Is the 2-step authentication also an excuse to give out a free mount? You don't need excuses for that xD
 
 
{| class="blockquote"
How about add something similar to GW protection? Like name of one player character on the account to remove this protection? Probability of hacker knowing what character is on that account is very low, on the other hand player should be aware of name of his toon(s).
----
			
So,
 
we're a month later and not a single response from Carbine about this issue?
 
			
				
	Edited November 4, 2015 by Olivar	
----
			
{| class="blockquote"
Or you can just keep the authenticator as it is now, and then for your removal site it will send a text code to your phone number, which is then needed to remove the authenticator on your site.
 
Proper solutions are really, really obvious, and are proverbial low hanging fruits. Go do. 
----
			
{| class="blockquote"
Is it really such a pain to input the code every 7 days, that so many people are asking to remove it?
----
			
Carbine,
 
we're still waiting for an answer.
Please don't expect us to ignore this thing, nor should you.
Security is a major thing on the Internet.
 	
----
			
Carbine,
 
we're 2 weeks further yet not a single decent reply has been made in this thread.	
----
			
https://www.turnon2fa.com/
 
Just sayin'	
----