90344-carbine-2-step-verification-explained

== Content ==
			
Hey Folks,
 
We have been receiving a lot of feedback regarding our 2-step verification process. Over the last few days I have been in multiple meetings regarding how we are going to improve the experience. One of our Network Engineers wrote a great document explaining our system. It was so good that I asked him if I could post it on his behalf. 
 
Enjoy.
 
Carbine 2-Step Verification Explained
People often complain about 2-Step Verification (aka 2-Factor Authentication or 2FA), saying that it is annoying to use. Well, it is. But it also keeps your account safe.
 
That said, some folks assert that our implementation is flawed, or that our implementation can be circumvented. I'd like to take this opportunity to explain why our game's implementation of 2FA works the way it does, and to address any such concerns.
 
 
Here is a summary for those who don't want to read all the words. ;)
Summary
·         Our implementation follows industry standard practice for the order of operations w.r.t. username, password, and 2FA code entry. There are very good UX reasons for doing it that way.
·         The use of 2FA is not the same as lengthening a password. It is fundamentally different, and obtaining the 2FA codes as a second step has no practical impact on account login security.
·         We have taken a simple extra step (randomized number pad with mouse clicks) that will defeat JavaScript based key loggers, an attack vector that has resulted in successful account hacks on other games over the past few years. This feature provides a significant benefit to everyone.
·         You cannot remove 2FA through account management without either a 2FA code or a CS contact.
 
Reading Material
http://en.wikipedia.org/wiki/Brute_force_attack
http://en.wikipedia.org/wiki/Dictionary_attack
http://en.wikipedia.org/wiki/2-step_verification
http://en.wikipedia.org/wiki/Multi-factor_authentication
 
Lecture Mode
When guarding against a brute-force or dictionary login attack, one best practice is to only acknowledge a failure of the combined username/pass. This improves security when neither the username nor password is known by the attacker. Treating the two as a combined puzzle that must be solved makes the puzzle harder. Clearly that doesn't matter when the username (e.g., email address) is known somehow, but still, best practice prevails.
 
Brute-force and dictionary attack success rates can be reduced by adding password complexity restrictions and a velocity check -- multiple login failures result in temporary lockout. We have a password complexity restriction and we block login for 15 minutes after 5 login failures. These are standard practices.
 
Now, let's deal with 2FA and common complaints. There are several issues to ask about:
                                                                                 
1)      Why is the 2FA code entered in a second dialog?
2)      Does using a second dialog for 2FA reduce login security?
3)      Why use a randomized keypad with mouse clicks?
4)      Can a hacker that guesses my username/password remove 2FA through the account management website?
 
Why is the 2FA code entered in a second dialog?
We won't spend time here debating the pros and cons of requiring everyone to use 2FA, but here are the facts.
                                                                                           
·         We do not require everyone to use 2FA
·         Presenting everyone with a 2FA entry field, even those that don't have it enabled, is confusing for you and results in extra work for customer support
·         We don't know if you have enabled 2FA (we don't know who you are) until after you have submitted username/password credentials
 
So we pop up the 2FA dialog box as a second step. This is the right user experience (UX). If you look around, you'll see that other game and technology companies who implement 2FA for login use the same UX/data-entry sequence.
 
Does using a second dialog for 2FA reduce login security?
UX aside, are we compromising security by not requiring the 2FA code be entered together with the username/password? Technically, yes, but only to a trivial amount. It's equivalent to adding an extra few inches to a mountain climb, and the 2FA code is the mountain. To understand this we need to talk about how 2FA raises the security bar.
 
Brute-force and dictionary attacks work because they will eventually test all possible combinations. If your username/password never changes, the attack will eventually succeed with a time cost on average of testing half of all combinations. That's why short passwords are bad (especially when everyone knows your email address.)
 
Let's assume that the attacker does not have the 2FA device. (If they do then the game is over anyway.) The attacker has to guess the same 2FA code that the login server has randomly generated. The likelihood of a successful guess is very low (1 chance in a million for a 6-digit code).
 
More importantly, the hacker can't increase his odds of success through repeated efforts because the 2FA code changes every 30 seconds, unlike a username and password.
 
Technical note: repeated login attempts during the 30-second window are possible, but improve the likelihood of success only slightly. Velocity checks still apply and lockouts will ensue.
 
The end result is that using 2FA is fundamentally different from using a fixed username/password pair. Using 2FA presents a high bar that does not get lower with work applied by the hacker. Most hackers are too lazy work that hard, especially given that hacking someone without 2FA is soooo much easier. :)
 
Why use a randomized keypad with mouse clicks?
No computer security mechanism is perfect (other than unplugging your computer, removing the hard drives, grinding the drive to bits, and vaporizing those bits into plasma.) Every security methodology works by increasing difficulty for the attacker, but none can ensure security.
 
So how does an account hacker deal with the increased difficulty of 2FA? They use key loggers. There, I said the dirty words. Standard 2FA code entry (using the keyboard) can be defeated by website-drive-by JavaScript key loggers. The hacker's hurdle there is to stop your client from submitting credentials, or to beat your client to the login (a race). A prominent game company has had two major account hack incidents in the past few years that used key loggers.
 
How do you beat a key logger? One way is to not use the keyboard. Use the mouse instead. JavaScript code can read the mouse position, so we use randomized key positions on the number pad to beat that.
 
Yes, optical character recognition (OCR) can defeat the randomized key positions. However, screen capture can't be done with JavaScript (or even with Flash without manually configuring reduced security in the browser). Today, to take the OCR route, you need a binary executable.
 
Now sure, if I can run a binary executable on your computer then I can do screen captures, do the OCR, and get your username, password, and your 2FA code. But if I can run executables on your system you're already fish bait. I pwn your credit card, your bank account, whatever you have or do on the computer. I don't care about your WildStar login at this point. I've sold your identity info to people who are turning your identity into cold hard cash. They are taking out a 2nd mortgage on your home and walking away with the money.
 
The upshot is that the random number pad with mouse clicking provides real benefit. It raises the security bar by addressing the key loggers you may become afflicted with, and which can be defended against.
 
Can a hacker that guesses a username/password remove 2FA through the account management website?
No, they can't. They would have to provide a 2FA code to disable 2FA for game login. That means they have to steal your 2FA device (phone, tablet, etc.).	
----
			Anyone who says 2FA is annoying has obviously never been hacked.	
----
			While I agree with you (and appreciate the write up) it might help to change all the font to white since the color text and background blend too much, and make it hard to read. 	
----
			
{| class="blockquote"
While I agree with you (and appreciate the write up) it might help to change all the font to white since the color text and background blend too much, and make it hard to read. 
----
			
{| class="blockquote"
I was editing it to white when you made the comment :).
----
			
The randomized keypad lowers user adoption, reducing ecosystem security. Now is not the time quibble over details. Put the 2nd factor box right on the login page and let us enter it with a keypad. The number should time out after 30 seconds. This dramatically reduces the effectiveness of keylogging the 2nd factor and will make it easier to use. 
 
You can justify your stuff all you want. That doesn't get people to use it. 
 
More to the point, you still don't have any sort of coin lock feature in place, which would make a hacked account effectively useless for anything but spam. 
 
Swallow your pride on this one. Simply the 2FA and add a coin lock to accounts accessed from a new IP. 	
----
			
Spacetime, I kindly disagree.  I actually *feel* safer with the randomized keypad, so I'm happy to play the 2FA minigame each time I log in.
 
I've never played with a coin lock system, so I can't comment there.	
----
			
{| class="blockquote"
The randomized keypad lowers user adoption, reducing ecosystem security. Now is not the time quibble over details. Put the 2nd factor box right on the login page and let us enter it with a keypad. The number should time out after 30 seconds. This dramatically reduces the effectiveness of keylogging the 2nd factor and will make it easier to use. 
 
You can justify your stuff all you want. That doesn't get people to use it. 
 
More to the point, you still don't have any sort of coin lock feature in place, which would make a hacked account effectively useless for anything but spam. 
 
Swallow your pride on this one. Simply the 2FA and add a coin lock to accounts accessed from a new IP. 
----
			
{| class="blockquote"
The randomized keypad lowers user adoption, reducing ecosystem security. Now is not the time quibble over details. Put the 2nd factor box right on the login page and let us enter it with a keypad. The number should time out after 30 seconds. This dramatically reduces the effectiveness of keylogging the 2nd factor and will make it easier to use. 
 
You can justify your stuff all you want. That doesn't get people to use it. 
 
More to the point, you still don't have any sort of coin lock feature in place, which would make a hacked account effectively useless for anything but spam. 
 
Swallow your pride on this one. Simply the 2FA and add a coin lock to accounts accessed from a new IP. 
----
			Has it been explained why Wildstar has the requirement to enter the 2FA code on every single login? Why can't users be given the option to only enter the 2FA code if their IP address changes? I don't mind having to enter it every time, but it sure would make my life easier if I didn't have to.	
----
			
I said it before on a previous thread,  I want to congratulate the devs on the choice of 2FA.  On my old WoW days I got my account hacked even with the 2 step authentication.  No idea how WoW handle 2 step authentication now, but at the time it was like SWTOR: 2 text fields to enter password and key, which both can be bypassed with a simple keylogger.  My old account got hacked, and while I got it back after cleaning my PC, it's username/email was compromised and probably is still a target these days.
 
Eventually got tired of fighting it and started again on a new account a year and a half ago, losing all achievements, mounts, high lvl chars.
 
I understand that the way it's done may be a problem for some people, specially those with vision or other disabilities, but sadly there's always a trade-off between easy and security.
 
And I prefer security all the way.	
----
			
{| class="blockquote"
The randomized keypad lowers user adoption, reducing ecosystem security. Now is not the time quibble over details. Put the 2nd factor box right on the login page and let us enter it with a keypad.
...
 
Swallow your pride on this one. Simply the 2FA and add a coin lock to accounts accessed from a new IP. 
----
			Another thing that would drive adoption is to slightly enhance the buff. Have the buff increase looted money and vendor sales by 2%. That will drive up the adoption rate quickly.	
----
			
{| class="blockquote"
Has it been explained why Wildstar has the requirement to enter the 2FA code on every single login? Why can't users be given the option to only enter the 2FA code if their IP address changes? I don't mind having to enter it every time, but it sure would make my life easier if I didn't have to.
----
			
{| class="blockquote"
Has it been explained why Wildstar has the requirement to enter the 2FA code on every single login? Why can't users be given the option to only enter the 2FA code if their IP address changes? I don't mind having to enter it every time, but it sure would make my life easier if I didn't have to.
----
			
{| class="blockquote"
We are currently discussing other incentives to increase adoption, that should be revealed in the coming weeks.
----
			[Redacted]	
----
			
i dont see why some many people are anti RSA security steps. i bet not one of them complains when its on their bank account.
 
Good work Carbine!	
----
			
Personally, I would find it far more annoying to only have weekly/monthly use of the 2FA. At current, I know I need the code every time I log in. If it's only needed periodically, then I either have to remember when I need it again or be annoyed because I then have to grab my phone because it's time to put in the code again.
 
I vote for leave it as-is. It's the most secure that way and I don't have to think about when/if I need to enter it.	
----
			It really isn't a hassle. If anyone reads something saying it is, I'm here to say it isn't. That makes it some how subjective, which means you have to at least try the 2 step verification and decide for yourself if you haven't used it. If you think it is a hassle, I'm not here to change your mind, just giving my opinion.	
----
			
{| class="blockquote"
You have to be careful with IP spoofing. If the attacker knows your IP, which is unlikely but not impossible if the attacker has access to your other online accounts, which is how attackers obtain credentials in the first place, depending on the service they may be able to derive your IP from them, and spoof their IP as yours and access the game. Combining MAC and IP would be more safe, since websites are not able to obtain your MAC unless through special means (like Java applets).
----
			
{| class="blockquote"
I less kindly than avidguru disagree.  If people are too stupid and lazy to take 5 seconds clicking with their mouse when they log in, then I don't care about the security of their accounts.  Stupid/lazy people doing stupid/lazy things have bad things happen to them, and they deserve it.
 
Considering how many hacked accounts there have been already, I personally think they should require it, in it's current form, for everyone who has an account.  Then you could have your ecosystem security, and I could keep my extra safe account protection instead of having it weakened by the stupid and lazy whiners.
----
			I'm still not a fan of randomized keypad that I have to click on after reading what you said. Maybe make it an option...	
----
			
{| class="blockquote"
Do you understand how difficult it is to spoof your ip address?
----
			
{| class="blockquote"
 
Considering how many hacked accounts there have been already, I personally think they should require it, in it's current form, for everyone who has an account.  
----
			
2FA is one of those security things that really show the old saying is true "any increase in security will be a decrease in user friendlyness" wich is true. But its all down to how much a user can bare before thinking its rediculous and doesn't want to comply/ tries to work around it himself! (yes i've worked @ company's where users actively tried to work around 2FA and other security measures because they are idiots)
 
I think its absurd that a game has a better 2FA system then 99% of the company's i've worked for, i've never seen the mousedriven random keypad before and have to say its a really smart idea.
 
So yeah, 2FA is annoying. Especially since you need to grab your phone (or alt-tab) start the app, check the code... can't copy paste it ugh and then have to enter it into a RANDOM keypad (so no memorizing the keys for you!). It's annoying as *cupcake*!
 
But, it's really worth it to anyone who either understands how easy it is to break username/password combo's on PRIVATE//unmoderated pc's OR who has been hacked in the passed.
And Wildstar throws in a 2% exp/influence etc bonus to boot! (I have to admit, that drew me over the line :P)
 
1 little tiny winy thing i'd like to see though, is physical code generators. Just because....well.... i like em and then even if you have a executable taking screenshots/movies from your screen, they STILL cant see the code untill i enter it. (I use a pc authenticator in case that was't clear, cause i dont like smartphones :P)	
----
			
{| class="blockquote"
I'm sure that would go over swimmingly with most users. You'd more likely play on "dead" servers with only the current 2FA users. I'd venture that a majority of people without it currently would simply cancel. It's that annoying to use in it's current form.
 
I'll be glad to adopt 2FA though, once they make it less obtuse to use. I already have a password that I have no chance of ever memorizing. Don't make me sight-read two items every login, with one of them being reset every 30 seconds.
----
			
Is there a way to enable this, withought using phone or tablet?
Cause I do not have phone capable of installing this application.	
----
			
{| class="blockquote"
Is there a way to enable this, withought using phone or tablet?
Cause I do not have phone capable of installing this application.
----
			
Taking the few seconds to input a simple 6-digit code is so easy, I literally cannot comprehend why someone would be so lazy to use it.
 
There are so incredibly few legitimate reasons I can conjure up as to why someone couldn't use 2FA; one would make it technically impossible to play Wildstar (no computer) and the other would make it physically impossible (severely handicapped) ... either way, there is no excuse.
 
Only two real problems exist with the current 2FA system:
It's not a requirement.
Clear and concise instructions published by Carbine in a prominent place (link in account login screen) that denotes where and how to get 2FA running on a computer to make the above requirement possible.
 
Whoever wrote out that document is awesome, and thank you for sharing it with us. While I am already a big proponent of the 2FA system, reading that has erased any concerns I had lingering in the back of my mind.	
----
			
My 2 cents:
 
If there was a physical fob like thing for 2FA, I'd be all over it.  I don't have a Smartphone, so that app is right out.  I hear there is a PC version, but it's not listed on the account management pages, so I won't use it.	
----
			I know that I had trouble setting it up with my smart phone due to the app crashing. More options for adding another level of security to your account besides Google Authenticator could help.	
----
			
There's a lot of talking about 2FA, but I actually haven't seen anything about it ingame. So I guess you should really put the box on the first page and explain in a short text what it actually is and what kind of bonus people get when they use it.
 
And remove the random click-only keyboard, it doesn't add to safety.	
----
			
{| class="blockquote"
i dont see why some many people are anti RSA security steps. i bet not one of them complains when its on their bank account.
 
Good work Carbine!
----
			
{| class="blockquote"
Probably because the frequency of use? I'm glad my bank website has 2FA with a random keypad, I never log into it more than once per week at most.
 
On the other hand, I'm not exaggerating when I say I'm logging into the game a dozen times a day. Besides the "normal" logins, I need to regularly restart the game in raids to keep a decent FPS, I'm getting random DCs from time to time, and add to all this the crashes.
 
Memorizing the code isn't the problem at all, I mean, I doubt anyone really has a hard time keeping in mind a 6 digits code for 10 seconds. But having to lose those 10 seconds grabing my phone, opening the app, and above all searching for the right keys is a giant *cupcake*ing pain in the ass, especially when I need to get back in game as quick as possible. Every single time I log in, I'm on the verge of removing 2FA-it's barely worth it.
 
Adding the possibility to enter the code with the keyboard, without removing the mousedriven random keypad, would incentivize without a single doubt a lot of those who just don't want 2FA because of the incredible tediousness it goes with. And although it wouldn't be as secure as the keypad, it'd still be times better than nothing but the password.
----
			
The best way to drive adoption?
Make it mandatory for all accounts.
There is no reason to leave it as user's choice.	
----
			
@ ferari and Drivart
 
You can basicly use any authenticator that uses google's algoritm. I use Winauth myself as i already used it for something else. 
 
To get it working:
 
1: Go to https://winauth.com/ and download the authenticator
2: go to your account management page and enable 2 factor authentication you need to copy the code you see (next to the QR code) into the authenticator and copy the 6 diget response code back)
3: thats it. Log in as normal, now you get a keypad asking for a code. check the authenticator (refresh the code) and enter the 6 digits.	
----
			
{| class="blockquote"
This is actually something the devs are working on, making it weekly or even monthly. I guess we'll have to wait and see.
 
 
[...]
----
			
{| class="blockquote"
Standard 2FA code entry (using the keyboard) can be defeated by website-drive-by JavaScript key loggers.
----
			
i wonder how people who dont have an actual OS on there handy are able to use this 2FA?
I know a few who dont have an app handy and probally wont buy one for this reason so how is carbine going to adress this problem?	
----
			
Personally, I think you're encouraging the ecosystem of lazy and ignorant users who refuse to educate themselves on account security best practices, by not making 2FA a MANDATORY REQUIREMENT to play your game.
 
Not only that, you're wasting your money helping people get accounts back that they should have never lost to begin with due to your suggested security practices.
 
These people will never learn until you make them learn.
 
And in regards to the randomized on screen keyboard, how are people arguing this does not add an additional layer of security? I want what you guys are on.	
----
			
{| class="blockquote"
i wonder how people who dont have an actual OS on there handy are able to use this 2FA?
I know a few who dont have an app handy and probally wont buy one for this reason so how is carbine going to adress this problem?
----
			
This is not by me, but please watch (never mind, I didn't realize this was unlisted and will respect that person's privacy) if you consider this randomized button mouse-only 2FA code entry the second coming of security.  e: To explain what was going on there, a person made an app that automates the OSK entry using a 2FA code from WinAuth.  He did this by reading an image of the screen (basically a screenshot) and calibrating the tool to recognize the 2FA code query and the numerical keys on the OSK by a closest-matching algorithm.  At this point, the mouse is moved to correctly enter in the 2FA code.  At no point does this app interact with the WildStar process directly, so no, you aren't going to catch this by checking that.  Combined with some of the below issues, you can see why there is a problem.
 
Tests anyone can do that shows glaring issues:
While using 2FA, enter your username	Do not enter the correct password
It will say Invalid Username or Password without first prompting for a 2FA code.
A proper solution would, if the username were valid, also prompt for a 2FA code, then notify of failure.
 
While using 2FA, enter your username	Enter your password correctly	Wait until your auth refreshes a code	Enter the 2FA code correctly and remember code	Exit from character screen back to login	Login again with the same code
This should not be possible, and allows a Replay Attack by anyone listening in actively.  A solution would be what Lykyl wrote.	
----
			
{| class="blockquote"
And in regards to the randomized on screen keyboard, how are people arguing this does not add an additional layer of security? I want what you guys are on.
----
			What irks me is that I use Google 2FA with my phone via SMS, but I can't set this up here without the app (WinAuth is a non-starter for me). If it would send me phone codes like anything I buy with google or paypal I'd be fine with it, however they wanted it entered, OSK or not. The notion though that everyone has smartphones is irritating and unreasonable. Just sell a freaking key-fob code generator and have done. To be honest, one should come in every box and they should have shipped them out a month in advance to every pre-order. Tack the price onto the cost of admission, we would have paid it.	
----
			
User-rate adoption is not high because the steps to install the Authenticator are obfuscating, too long, and too technical for you average, non-savvy MMO user.
 
Also take into account that a sizable minority of people do not have a smartphone (hard to imagine for a lot of people for some reason) and the link to install the browser-based 2FA isn't easily available, you create this recipe for a disaster where devs have to come in and give us a lecture on encryption-based methodologies.
 
I don't understand the point of this thread: most people who aren't using 2FA obviously aren't technically-savvy and this post would make their brain explode. The only people even posting here are obvious techies.
 
You want to raise the adoption of your 2FA system? It's time to start looking for a hardware token manufacturer and sell those damn keychains. It comes down to this and people rather spend the $9.99/$14.99 than install an app on their smartphone/browser tied to third-party program.
 
(Also have to take into account that some people may not have a Google account either thus requiring extra steps and effort in getting the 2FA ready).	
----
			
Hello MrSmiley,
 First off I would like to thank you from taking a reddit post to a full blown news and announcement post, and everything this engineer said in his brief seems really on the level and is a great byte of knowledge. I just have one issue and it is with the following line.
 
{| class="blockquote"
So how does an account hacker deal with the increased difficulty of 2FA? They use key loggers. There, I said the dirty words. Standard 2FA code entry (using the keyboard) can be defeated by website-drive-by JavaScript key loggers. The hacker's hurdle there is to stop your client from submitting credentials, or to beat your client to the login (a race). A prominent game company has had two major account hack incidents in the past few years that used key loggers.
----
			
{| class="blockquote"
I less kindly than avidguru disagree.  If people are too stupid and lazy to take 5 seconds clicking with their mouse when they log in, then I don't care about the security of their accounts.  Stupid/lazy people doing stupid/lazy things have bad things happen to them, and they deserve it.
 
Considering how many hacked accounts there have been already, I personally think they should require it, in it's current form, for everyone who has an account.  Then you could have your ecosystem security, and I could keep my extra safe account protection instead of having it weakened by the stupid and lazy whiners.
----
			
I would like to add 2-factor authentication to my setup. 
 
In the instructions:
 
http://www.wildstar-online.com/en/news/protect-your-account-with-2-step-verification/
Here's how much we care about your happiness. Not only does using 2-Step Verification cost nothing -- you use a free application on your phone or tablet (nearly any Android, IOS, or Windows device, really) -- we will give you awesome in-game benefits as a reward.
 
Yet, when I go to my Account Management and attempt to add this, the only supported Authenticator app is Google's. I am confused.	
----
			
{| class="blockquote"
Yet, when I go to my Account Management and attempt to add this, the only supported Authenticator app is Google's. I am confused.
----
			
{| class="blockquote"
Any application that implements RFC6238 works.
https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en
https://itunes.apple.com/en/app/google-authenticator/id388497605?mt=8
http://www.windowsphone.com/en-us/store/app/authenticator/e7994dbc-2336-4950-91ba-ca22d653759b
----
			
Still have to complain about forced mouse input for the 2FA.
 
You could simply make it optional, i would definitly type 5 numbers with the keyboard and just click a single one. Effectivly same level of security as clicking all 6 numbers but considerably faster and therefor better UX.
 
Additionally you should implement real OTP so any Keylogger lost the race once I used the 2FA code and does not have about 20 to 30 seconds left to use it too. Thats a huge flaw in your implementation. You allow the reuse of the same OTP code during the time intervall.
 
And on the security topic: Why don't you simply log the first 8 to 16 bits of the IP Address for website login? At least with 2FA enabled. Though most of the people have dynamic ip addresses, the first 8 to 16 bits are mainly location specific and don't change. Getting hacked from the same geographic region isn't that much of a risk (at least if you don't live in China...^^)	
----
			
After trying to follow the instruction point for point and it still says i put in the wrong verification number im gonna ignore 2step verification.
 
Better to change password every 3-4month than having same password for years :)	
----
			The mount is great incentive for people to finally get 2 step verification, its a win win situation no matter how you look at it. Frankly, if a free mount isn't enough motivation to make you get 2 step you deserve to get hacked, just sayin'.	
----
			So I guess those of us who use windows phones are just not going to be supported?  I realize it isn't a popular phone option but it would be nice if it could be supported if you are going to try to make it work.  I mean there are like 20 different versions of the android operating system that you will end up supporting, why not windows phones?	
----
			
{| class="blockquote"
Spacetime, I kindly disagree. I actually *feel* safer with the randomized keypad, so I'm happy to play the 2FA minigame each time I log in.
 
I've never played with a coin lock system, so I can't comment there.
----
			
{| class="blockquote"
The randomized keypad lowers user adoption, reducing ecosystem security. Now is not the time quibble over details. Put the 2nd factor box right on the login page and let us enter it with a keypad. The number should time out after 30 seconds. This dramatically reduces the effectiveness of keylogging the 2nd factor and will make it easier to use. 
 
You can justify your stuff all you want. That doesn't get people to use it. 
 
More to the point, you still don't have any sort of coin lock feature in place, which would make a hacked account effectively useless for anything but spam. 
 
Swallow your pride on this one. Simply the 2FA and add a coin lock to accounts accessed from a new IP. 
----
			
{| class="blockquote"
The randomized keypad lowers user adoption
----
			
{| class="blockquote"
So I guess those of us who use windows phones are just not going to be supported?  I realize it isn't a popular phone option but it would be nice if it could be supported if you are going to try to make it work.  I mean there are like 20 different versions of the android operating system that you will end up supporting, why not windows phones?
----
			
Dear Carbine,
 
Your 2 step authentication option is annoying and crap. Please implement a solution similar to Steamguard. Thanks.	
----
			
{| class="blockquote"
Dear Carbine,
 
Your 2 step authentication option is annoying and crap. Please implement a solution similar to Steamguard. Thanks.
----
			
{| class="blockquote"
Please provide your evidence to support this statement.
 
And if anyone is foolish enough to not use the 2FA because of the keypad they deserve what they get.  
 
The only people who complain about things like this are either never going to be satisfied no matter what is done or just like bitching for the sake of bitching.
 
I have yet to see one legitimate, sensical argument against the keypad 2FA entry.  Not a single one. 
 
They all boil down to laziness and just utter bullshit.
----
			
Hi everyone. First-time poster. I HATE posting on forums. 
Anyhow. I don't have a mobile device. I'm sorry if that's weird, but I still have a land line.I DO have an internet connection, as you can see.All the things I've read lead me to believe that without a mobile device, I cannot use 2-step verification.Is my understanding true, or is there a way for me to do this without one?Thanks.Tyronicus -- For a Noble Dominion. 	
----
			
{| class="blockquote"
maybe do as your advice in your own double post right below the one i quote just search in this thread instead of the whole forums and you see several people (including myself) stating they dont use it because of that. And likewise several ppl stating and explaining why the keypad offers little to no extra security over normal keyboard input of the code, now the reasons doesn't really matter, the FACT is it does lower user adoption
----
			still waiting for a keyring authenticator since i dont have a cell phone and i still have not found a way to get 2 - step without  a cell phone	
----
			
{| class="blockquote"
still waiting for a keyring authenticator since i dont have a cell phone and i still have not found a way to get 2 - step without  a cell phone
----
			
{| class="blockquote"
Anyone who says 2FA is annoying has obviously never been hacked.
----
			
I'd prefer if there was a way to disable it on well known IP, especially with the current stability issues.
Having to reach for phone, unlock it, launch the app, then enter the key to log in can be pretty annoying, especially when you crash midfight and need to get back on ASAP.	
----
			
 Here you go.  There are plenty of alternatives if you don't have a smartphone.
 
{| class="blockquote"
Hi everyone. First-time poster. I HATE posting on forums. 
Anyhow. I don't have a mobile device. I'm sorry if that's weird, but I still have a land line.I DO have an internet connection, as you can see.All the things I've read lead me to believe that without a mobile device, I cannot use 2-step verification.Is my understanding true, or is there a way for me to do this without one?Thanks.Tyronicus -- For a Noble Dominion. 
----
			
This has protected me from being hacked 3 time already, HOWEVER, as much as I hate to suggest copying Blizzard in any way, is there any way you can make it so you have to put the code in before being able to ask for a password reset on you account and/or to log into the webpage/forums/account info page like Blizz does? 
 
It's nice having my characters protected and all, but having hackers able to get to the area that lets the request a change and then change my account password with no security is just, well, annoying.  :-D	
----
			
{| class="blockquote"
I'm not the one making outlandish claims, the burden of proof isn't on me.  :rolleyes:
 
LOL, @ "several" people.  Ok champ.  Choosing not to use the 2FA simply because you have to use your mouse is foolish and asinine.
----
			
Since we are having a discussion in this other thread I'd like to post my proposal to replace the current randomized button layout and allow keyboard entry of the auth code here:
 
After a user logs in with the game client his IP gets one minute to provide an auth code. During this time no other client using a different IP will be able to log in. The account server could store LastLoginDate and LastLoginIP for the account in the database. After the user provides the correct auth code it and all its predecessors are invalidated. Since this is a time-based one-time password this could be realized by storing the timestamp of the relevant auth code as LastAuthDate in the database.
 
This solution would eliminate the small window of opportunity that would be left if only the auth codes would be invalidated. Another advantage would be that it would also stop malware which used OCR to read the randomized button layout.
 
Yes, this would require some effort from Carbine but if that means more people would use 2FA the cost could probably be easily recouped due to reduced support cases.
 
Any thoughts?	
----
			
{| class="blockquote"
Hi everyone. First-time poster. I HATE posting on forums.
 
 
 
Anyhow. I don't have a mobile device. I'm sorry if that's weird, but I still have a land line.
 
I DO have an internet connection, as you can see.
 
All the things I've read lead me to believe that without a mobile device, I cannot use 2-step verification.
 
Is my understanding true, or is there a way for me to do this without one?
 
Thanks.
 
 
Tyronicus -- For a Noble Dominion.
----
			
{| class="blockquote"
The irony that as I was writing up a post explaining about the uselessness of the OSK, someone posts the video I created that shows it off.  That code started off as proof-of-concept code that logged digits entered into the OSK.  It took about two hours to write -- in other words, trivial.  I'm morphing it into something useful instead, which the video is showing off, because I have no need for an OSK logger.
----
			
{| class="blockquote"
This has protected me from being hacked 3 time already, HOWEVER, as much as I hate to suggest copying Blizzard in any way, is there any way you can make it so you have to put the code in before being able to ask for a password reset on you account and/or to log into the webpage/forums/account info page like Blizz does? 
 
It's nice having my characters protected and all, but having hackers able to get to the area that lets the request a change and then change my account password with no security is just, well, annoying.  :-D
----
			
{| class="blockquote"
I am impressed.  You indeed have shown doing an OSK as being basically useless.  Which is short of funny because I have said the samething in the past, yet I actually defended the randomized OSK, I entirely forgot that if it is indeed javascript being used to generate the OSK.
----
			Hey , i seem to be stuck atm .. i did download the 2step shizzle , ive used it a few times , works perfect but now , ive resetted my phone since it was getn to slow .. Now i redownload the app , but it doesnt generate a key , it asks me to configure it again.. meaning entering the barcode again.. wich i cannot find , i tried Deactivating the 2 step shizzle , but carbine asks for the 6 digit code coming from the authenticator ... dunno what to do ? :s	
----