Blizzard Authenticators May Become Mandatory

An anonymous reader writes "WoW.com is reporting that a trusted source has informed them that Blizzard is giving serious consideration to making authenticators mandatory on all World of Warcraft accounts. The authenticators function the same as ones provided by most banks — in order to log in, you must generate a number on the external device. Blizzard already provides a free iPhone app that functions as an authenticator. The source stated, 'it is a virtually forgone conclusion that it will happen.' This comes after large spates of compromised accounts left Bizzard game masters severely backlogged by restoration requests."

Comments

No thanks

[sopssa]

Sure it might work with just one game, but what about if this starts a trend and all online games start to require such? No thank you.

We do not use such USB devices with banks here btw, instead everyone has an account number and running list of one-time codes, with a second list of confirm codes. It's a little pain but incredibly secure. However, it's not something to use with games.

Instead of mandatory, please at most make it only the default option so those who want to can turn it off.

Re:No thanks

[Anonymous Coward]

Most of them are not USB devices. Just simple fobs with a push button and cheapo LCD display.

Re:No thanks

[bertoelcon]

Agreed. Also, do they plan on putting them out other ways for free if they try this. When I looked into one you had to buy the thing from Blizzard for like $25 or something. I know there is a free Iphone app but what if you don't have an Iphone? Anyone know if they have other authentictor apps for other platforms.

Re:No thanks

[Anonymous Coward]

Not sure about the WoW tags (which presumably will go for all of Blizzard's upcoming games, Diablo 3 and Starcraft 2 included), but S-E's FFXI/FFXIV/Front Mission Online/assorted minigames all rely on a single RSA-style tag that hashes a unique salt and the current time and displays a 6-digit key to be checked on the server. This makes it more than convenient enough for game use.
I'd say that having a whole keychain full of these could be inconvenient and overkill, but it's not like you need to carry them in public, and I really doubt even most hardcore gamers would need more than three or four at one time (Steam, Blizzard, Live, PSN?) Likewise, the cost could get annoying, but a one-time $10 charge (including delivery) with an in-game kickback isn't too bad at all.

Re:No thanks

[compro01]

They're $6.50.

http://us.blizzard.com/store/details.xml?id=1100000822

Re:No thanks

[grumbel]

but what about if this starts a trend and all online games start to require such?

Maybe secure login will then become a common practice and devices will be standardized and we will live in a bright shiny future where login is no longer done by the most primitive system imaginable.

I mean seriously, passwords are among the weakest chain when it comes to security today and not something that can be fixed by 'educating the user' (last time I counted I had around 100 password), it wouldn't hurt to replace them with something that is more secure and more comfortable to use, even if it might be a bit painful at first.

Re:No thanks

[MajroMax]

Also, do they plan on putting them out other ways for free if they try this. When I looked into one you had to buy the thing from Blizzard for like $25 or something.

The authenticator is hardly $25. In the US, it's $6.50 with free shipping, and in the EU it's EUR6.99 also with free shipping. The price covers the cost of the physical unit and (obviously) the shipping. Blizzard's hardly making a killing on these.

For mobile authenticators, the Blizzard Website has more detail. The short version is that the Mobile Authenticator is available on a wide range of phones, depending on provider. Support isn't universal, though.

That said, the only time Blizzard could make Authenticators mandatory would be at a game-changing event, like the release of the next expansion. If they go ahead and do that, they'd probably throw Authenticators in the box, to automatically have near-total distribution. Their biggest concern is probably whether they can source a few million of them.

The long and short of it is that account theft is a big problem, both for Blizzard and for people who play WoW. Not everyone has a locked-down system, and phishers are using tactics formerly reserved for actual banks to try to get account info. Players have to deal with having their account possibly stolen, Blizzard has to deal with perpetual requests (some possibly fraudulent!) to restore characters/items, and the game as a whole suffers from the RMT that goes on.

I, for one, welcome our Keyfob and Mobile-Authenticating Overlords.

Re:No thanks

[fm6]

what about if this starts a trend and all online games start to require such?

This business of every application requiring its own password is a problem in itself. (I've got 400 passwords in my Roboform archive!) That's why so many sites are adopting OpenId.

Re:No thanks

[Mr. Freeman]

400 passwords that you use, or 400 that you've used at one time or another in the past 10 years. There's a little bit of a difference.

I'm going to call bullshit and say that you don't use more than 20 passwords or codes on a weekly basis.

Re:No thanks

[Mr. Freeman]

Where is "here"? Your list of codes seems like a large pain in the ass. These are not USB devices we're talking about, they're things about the size of a pack of gum (the ones with 5 sticks (that's five, not the brand 5)) with an LCD on them. They display a random number and a little bar that decreases over the course of a minute or so. Every minute, new code.

Re:No thanks

[sopssa]

What? I also interestingly have about 400 passwords in my keepass. No, I do not frequent ALL of them so often. The point is that every site or service has a different password. It's just stupid to use the same one in several.

Re:No thanks

[sopssa]

It's the list of codes in scandinavia and probably other european countries too. It's not actually so pain in the ass, you keep your list near your computer in drawer or so. My bank account with my money is something I can do with little inconvenience, because a running two-tier list of codes is unbreakable* with keyloggers or such. But I'm not gonna put up with tens of games requiring the same kind of inconvenience.

* in theory it would still be possible for a trojan to modify your web session in real-time, but this security model still is the best one available and I cannot understand why US doesn't use it instead of just plain username/password.

Re:No thanks

[Jthon]

You seem to have totally misunderstood how the authenticators work. They are decidedly NOT USB dongles.

An authenticator is a changing key generator, which shows you a one time key when you hit a display button. You then type this key in after entering your username and password to log onto the game. This is very similar to the RSA SecurID token my work requires I use to log onto a our VPN.

Basically the keyfob contains a psuedo random number generator which generates a new key every few seconds. The authenticating server knows the original seed, and can figure out the currently "valid" number shown on the key. Since each code is only valid for about 30 seconds, this makes is significantly harder to hack the account.

In fact this system is more secure than any system my bank uses, as very few banks in the US even give you the option of using a system like this.

Re:No thanks

[sopssa]

Yeah, I noticed that afterwards, wonder where the USB dongle thingie came from. But the point is still quite same - if all online games start to require such, it's really inconvenient. It would be even more inconvenient if my PS3/360/Wii would require it after I have sit down on sofa to play something. Security is good, you should have the option for people to use it to max, but you shouldn't force it down to people. Make it default option, sure. But have an option to turn off the extra security if user wants to.

Re:No thanks

[fm6]

Twenty is about right. So what? All the passwords represent logins that I had to use at least once. And even 20 is too many for good security.

Re:No thanks

[Anonymous Coward]

The downloadable authenticator app for the iPhone is free.

Re:No thanks

[Anonymous Coward]

First, every heavy web user has a huge number of logins. Sure, some people use the same passwords for all the web sites they use but that doesn't make them the same logins...

Second, are you implying the passwords we use only bi-weekly (or even once a year) are not important, that remembering them is not required? I use my login at the domain name registry every three years but I consider it fairly important.

Re:No thanks

[Jthon]

I agree it would become inconvenient, but in general 99% of games probably will never require it. The big problem is that WoW items have real world value. People sell game items and gold on the black market, and there's real money to be made by hacking unsuspecting people and taking their stuff. Basically criminals are hacking into peoples accounts, stealing their virtual items and liquidating it all for gold, then stealing their in game gold and selling it to other players via black market sales.

Blizzard currently attempts to restore items from accounts which have been ransacked, but it takes a large number of man hours to go through all their logs and investigate all these hacking occurrences. They're looking to add this extra security as a way to significantly reduce the number of hacked accounts, and reduce their costs with investigating these issues.

So until other games on the PS3 and XBOX become big targets for hackers who are trying to make real world money, I don't think we'll see these authentication schemes on your console. There's really no value in stealing my PS3 trophies. The problem here is that criminals have found an easy and fairly lucrative target in trading WoW gold.

Re:No thanks

[K-Mile]

I assume if consoles start using this technology, they would integrate the keyfob into your controller. Most consoles have a way of placing an extension into a controller, so if you register your controller or keyfob serial when you buy the game, the system can figure our it's you, unless someone physically steals or uses your controller. Its actually easier for consoles, since there the security system can be provided my Nintendo / Microsoft / Sony, instead of each publisher individually.

Re:No thanks

[Azzmodan]

My bank uses a text message that sends you a code, but you can choose for the old fashioned list of codes.

You can even request a couple codes in advance for when you'll be going somewhere and you know you don't have access to your cellphone.

I quite like the text message system over the physical device that some other devices/blizzard's authenticator use because I'll have my cell phone with me everywhere, but the physical device is unlikely to travel with me.

Re:No thanks

[beelsebob]

I don't get it... Here, we have little card readers. The bank sends a challenge, you put your card in the reader, type in the challenge and your pin, it gives a response which you type back into the web page. Simple.

Re:No thanks

[Anonymous Coward]

As an aside, the Blizzard authenticator will (does?) function for all battle.net games, not just World of Warcraft.

Re:No thanks

[lbbros]

if all online games start to require such, it's really inconvenient.

FWIW, other MMOs have started to use this as well. Final Fantasy XI users can use a token like this (I do, in fact), and the same token will also be used for the upcoming Final Fantasy XIV. It's not mandatory, though.

Re:No thanks

[Xugumad]

I would love to see password authentication replaced with using PGP-style signing. Never actually send the private key to the remote system, but instead when you signup you say "This is me" by giving them your public key and they then know the person with the matching private key is you.

Of course, somehow the private key would need to be kept somewhere viruses can't extract it outright, which means a USB dongle or similar that does the signing on request, which is more stuff...

Re:No thanks

[Narpak]

Personally when I have to log into my bank account I have to use a generated code from my security token, my personal number (provided by the state at birth), and my BankID code (site in Norwegian only). And so far I have yet to have my bank account hacked. That being said neither have I had my WoW account hacked, though having used computers since getting my very own 486 back in the day; I have learned (sometimes from very bad experiences) to take my computer security seriously. Over the last three years (or more) with the exception of tracking cookies my computers have been clean for viruses and spyware at every scan (much like many other slashdoter's I reckon).

Though as the poster above mentioned if Blizzard does introduce security tokens, and I reckon they will especially since accounts are Battle.net now and not WoW specific, it will probably be packed with the next expansion. Personally I think it might be a good thing all in all, especially if it helps lower account theft. Though it would also help if people in general got some more instruction into how to keep their stuff secret and safe beaten into their skulls. I have family members (don't we all) that use their computers for online banking, among other things, yet fail to update spyware/virus scanners, firewall software, browsers and etc. And no amount of additional layers of login security will ever fully compensate for user ignorance.

Re:No thanks

[Opportunist]

Just to inform you, our banks dumped the one-time code lists when it became obvious that they are anything but secure. We're now at mobile TANs (basically you get a one time code via text message to a predefined phone). Which is secure as long as your phone doesn't get stolen along with your account credentials.

Re:No thanks

[Opportunist]

It would already be a huge leap ahead if Blizzard didn't use the same logon credentials for their user forum that is used to log into the game. That alone is certainly the source of many stolen accounts, given how easy it is to sniff passwords out of a browser.

Re:No thanks

[Narpak]

There are a quite a few variations among security tokens. The one I have requires me to type in a 4 digit pin code before it gives me a random number that I have to use in combination with a password and birth code.

Re:No thanks

[MORB]

I would hate for it to become mandatory. I just don't need it because (and I don't think I'm alone with these reasons):

1. I'm not an idiot and am careful enough that someone stealing my account is unlikely
2. Losing my wow account wouldn't even be a big deal to me, it's not like leveling a character and gearing it up takes ages
3. I don't want to rely on a physical object that I can lose or misplace to log in into a game.

Re:No thanks

[Opportunist]

Explain please how you want to keep a virus (trojan, actually) from accessing a USB key that is plugged into the computer. You don't think people would ever remove it and only plug it in when they want to log in, do you?

Not to mention that reading from the USB dongle and transfering the private key elsewhere should be trivial even if they're only plugged in for a rather short amount of time. If certain software installed in the computer can read it, any malware installed in the computer can.

Re:No thanks

[Anonymous Coward]

The biggest proublem I have with the Authenticator is that it prevents sharing accounts. I know your not "suposed to" but me and a friend have been sharing our WoW accounts with each other since we started, and we shared our Final Fantasy 11 accounts before that. Because my friend lives on the other side of America it will be next to impossible to log him on real quick to cut a few gems for me if Authenticators become mandatory.

Re:No thanks

[Opportunist]

Considering that some people have troubles remembering their ATM pin, 20 different passwords is quite a feat.

I remember passwords easily. Even arbitrary ones. I even know my credit card number including all relevant details. But I also know that it's hard for some people to remember just 4 digits that ain't part of their birthday.

Re:No thanks

[Rakarra]

Do you use Ventrilo or some other voice server? Or even a phone call? The authentication codes the authenticators give are good for 10-15 seconds, so if you still wanted to do it that way..

Re:No thanks

[grumbel]

The USB stick wouldn't just store the key, it would also handle all the encryption and authentication too, so the private key would never leave the USB stick and there would be no way to access it.

The stick could additionally verify that you are really talking to the server you mean to and not to a man-in-the-middle and on top of that the encryption could be protected by a pin, entered on the USB stick itself, to secure against theft and keyloggers.

Such an encryption scheme could be made pretty much rock solid.

Re:No thanks

[PhilHibbs]

They are valid for a 30 second window, and at that point the new code is generated and the old code expires. So over the phone you would probably want to wait for a new code to be generated and then read it out so you have the full 30 seconds to get it understood and entered accurately.

Re:No thanks

[Zencyde]

I'd like to see what you do should you lose your data. :) I keep tiers of passwords depending on how much security I need. I only need 3 or 4 passwords offhand. Decent enough and the passwords increase in strength as security becomes more important.

Re:No thanks

[flimflammer]

It's not limited to the iPhone either. They have apps for many many phones.

Re:No thanks

[thesandtiger]

His complaint doesn't even make sense - it isn't like cutting gems requires anything other than clicking a button, so if his friend has access to his account to do that, he'd have access to do that to, not needing his friend at all.

And even if it did require his friend to log in, IM would be more than sufficient for this purpose.

Re:No thanks

[AlXtreme]

Basically the keyfob contains a psuedo random number generator which generates a new key every few seconds. The authenticating server knows the original seed, and can figure out the currently "valid" number shown on the key.

Wouldn't reverse-engineering the keyfob (or even computing an X number of keys and some background on the algorithm used) reveal the original seed and make the whole process useless?

One of the banks I use provide a cardreader where you have to enter your PIN to generate a key for every login / transfer. Even though I've been using it for many years I've always wondered if it really is more secure than a username / password + one-time SMS codes or the like.

Re:No thanks

[Kjella]

1. Most people who have their account stolen probably think the same
2. That probably works both ways, if you don't care much then maybe you won't
3. It's hardly worse than a CD check (a physical object needed to play)

In general, I disagree about the "no big deal" - at least not to Blizzard. I have lost lots of savegames on occasions, particularly one nasty hdd crash, and the result is that I look at it and go "Meh, I'd have to do all that over again" and end up never getting started. You don't need to be an epic-spec'd god to think it's extremely frustrating going back to fighting lvl 1 creatures with your puny sword of dullness. For a single-player game then who cares, they got their money already and I'll probably find a new one and everyone will tell me I should have taken backups. Lose your WoW account? Straight hit to their revenue, plus other players fear it'll happen to them and there's no easy way to make sure their machine never will be compromised and their login stolen.

Basically, you're not worried because you're not the one taking most of the hurt. Like I don't fear that much that someone will abuse my visa card, unless I've been careless my exposure is quite limited. But visa definitely cares, which is why I got a free new card with chip in addition to the magnet stripe. To be honest, they're probably more worried about losing customers like you that just don't care that much. The wowholics would be back at grinding pretty soon no matter what.

Re:No thanks

[thesandtiger]

1) It isn't a matter of idiocy on the end-user's part when you have major companies releasing extremely exploitable software and patches that introduce even more security flaws. I sure hope you don't run any software that you personally haven't looked at the source, compiled yourself, and know is 100% secure, because otherwise you're an idiot, by your own lights.

And, I have to say, does it make me an idiot that I'd rather spend 5 seconds each time I log in (maybe 10 seconds a day) using something like this, instead of spending 5 minutes (or hours, when patches are completely broken) every day keeping my computer secure? Hm... 10 seconds and I get extremely good (as in, it works to protect banking it'll damn sure be enough to protect my ability to slay Internet Dragons) security vs. 5 minutes (or more) and MAYBE my security is good, but maybe whoever distributed the patch screwed it up... Yeah, I guess only idiots would need or want to use this!

2) Is your time really worth so little that having to re-do something to get back to where you were if your account got hacked isn't a bother? Or maybe you just really like redoing stuff? I liked getting my characters to 80 and getting them geared up, too, but now that they are I'd really rather not have to redo it because someone slipped an ad with malware attached through to a site (slashdot) that I'm trying to support by not blocking ads...

3) Double sided tape. I have mine attached to my monitor because that's the only place I'd use it. I've lost my glasses when I was wearing them atop my head; I've not lost this thing yet because it's stuck to my monitor. I even didn't have a hard time reattaching it to the new monitor I just bought.

Re:No thanks

[MORB]

1. Most people who have their account stolen probably think the same
Which doesn't really matter.

3. It's hardly worse than a CD check (a physical object needed to play)
And indeed CD checks ARE annoying as hell. The first thing I do when I purchase a game that have a CD check is to grab a cracked binary from the web.

Re:No thanks

[MORB]

1) It isn't a matter of idiocy on the end-user's part when you have major companies releasing extremely exploitable software and patches that introduce even more security flaws. I sure hope you don't run any software that you personally haven't looked at the source, compiled yourself, and know is 100% secure, because otherwise you're an idiot, by your own lights.

How do you explain that people seemingly get their wow accounts stolen more often than, say their credit card numbers? Do you really think that hackers target WoW more or that those people just tend to be careless with their accounts?
I don't install much of anything on windows anyway, I use it only for gaming. I do everything else in linux.

2) Is your time really worth so little that having to re-do something to get back to where you were if your account got hacked isn't a bother? Or maybe you just really like redoing stuff? I liked getting my characters to 80 and getting them geared up, too, but now that they are I'd really rather not have to redo it because someone slipped an ad with malware attached through to a site (slashdot) that I'm trying to support by not blocking ads...

I guess that I'm not a very typical wow player. The endgame bores me. I used to have fun at endgame by ganking people, but now the game's all about grinding instances for gear and the only difficult part is winning the loot roll when something drops. Leveling is actually more fun than that because you can still have to play hide and seek with people of the opposite faction from times to times. But indeed, I seldom play wow at all nowadays.

3) Double sided tape. I have mine attached to my monitor because that's the only place I'd use it. I've lost my glasses when I was wearing them atop my head; I've not lost this thing yet because it's stuck to my monitor. I even didn't have a hard time reattaching it to the new monitor I just bought.

I'm not going to tape all kind of crap to my monitor. And what if I want to play from somewhere else than home? I often play wow during lunch breaks with some coworkers, for instance.

Essentially, it should be a matter of personal choice. I should be the one deciding how secure I want my account to be. But of course, as usual wow has to cater to the lowest common denominator and people too stupid to keep their account secure.

Re:No thanks

[insufflate10mg]

Right, right, but his complaint does make sense. I believe in WoW one may have multiple characters per account; one his character's has the ability to "cut gems" and the others have different abilities. As of now, both he and his friend know the account password; when his friend isn't around, he logs in to the account using the shared password and uses the gem-cutting character. If WoW was to implement the fobs/mobile authenticators as a default and mandatory security measure, he would no longer be able to share the account with his friend and it would become far more difficult to use his friend's abilities on a whim. It's an understandable concern (whether WoW account sharing is encouraged or discouraged) because it is very popular for friends to share accounts.

Re:No thanks

[thesandtiger]

You misunderstand - I'm saying that it is possible (easy, in fact) to get your WoW information stolen without you, personally, being an idiot, not that many people who play WoW are not idiots. I do suspect that a large portion of the accounts that have been compromised belong to people who take less precautions giving that information out than they do with their credit cards - but that's not the only way it can happen.

I was objecting to your seeming "all or nothing" categorization of people as idiots or that people who are not idiots cannot get their accounts hacked.

As to the tape - you can get it with velcro, which will let you remove the thing to bring with you. Or get the version for your phone. It isn't like there's "all kinds of crap" taped to my monitor, either. Certainly if your desk is so messy you would be prone to misplace your fob, a thing taped to your monitor will not mess up the space even further!

Re:No thanks

[thesandtiger]

Ah, yes, it makes sense, I see - I thought they were talking about sharing 1 account, not 2 - so the gem cutting character would be on a different account.

I suspect that a lot of the hacked accounts are caused by people sharing, though.

Re:No thanks

[MBGMorden]

I'm guessing that it's probably good for up to a 1 minute window. Think about it - if you press the button 2 seconds before the current window closes you're going to get 1 code and the active one will be different by the time you finish typing it.

Though I have no hard evidence, my guess is that Blizzard will accept either the active code or the one immediately preceding it in the sequence.

Either way, the GP answered his own question: you're not supposed to share accounts. Blizzard doesn't care if they make that a bigger headache than it's worth.

Re:No thanks

[MBGMorden]

The controller is not a good place for it, because the console has access to the controller. The great thing about the Blizzard authenticator is that it's completely disconnected from the computer. You don't plug it in and the computer doesn't read anything off of it. You have to manually press the button and type in the code it shows. That sounds annoying, but keeping it that way ensures that a virus or other malware CANNOT access the information on it.

Re:No thanks

[K-Mile]

That's true, although I think (no hard data though) a large portion of account theft happens through social engineering.

Malware on consoles is a lot less common, so this could at least rule out a significant portion of abuse without bothering users too much. To abuse a gamers account, malware would need to be installed on the console, and be able to login to the game and abuse your account data there, all from the console that the (activated) controller is paired with, while it is turned on, possibly without the player noticing. I never heard of such sophisticated malware for consoles, but it could happen, obviously.

Not as secure as the Blizzard Authenticator (which I use and works great!), but perhaps good enough to prevent password theft.

Re:No thanks

[MORB]

I'm not saying that your account can't get hacked if you're no an idiot, but that I'd much rather risk that than have to use an authenticator.

Re:No thanks

[Graff]

Wouldn't reverse-engineering the keyfob (or even computing an X number of keys and some background on the algorithm used) reveal the original seed and make the whole process useless?

Each authenticator has a unique seed and so you'd need to do this for each account you want to hack. The scope of such an activity makes it so tough to do that it's not economical even if it is possible.

Re:No thanks

[dc29A]

It would already be a huge leap ahead if Blizzard didn't use the same logon credentials for their user forum that is used to log into the game. That alone is certainly the source of many stolen accounts, given how easy it is to sniff passwords out of a browser.

https://us.battle.net/login/login.xml ...

Notice the 'https' in front of that url? This 'sniffing' of passwords is not possible over https, if it were, no e-commerce/banking site would be safe.

However, idiot WoW players who go on WoW sites like Thottbot, Wowhead and other less reputable sites for information and they click on random ad banners flashing boobs and whatnot get infected with keyboard sniffers tailored for WoW players. Guess what? They'll lose control of their accounts. There is also a number of players who give out their account information to guildmates and guess what? Some of those get fucked over by their guildmates whom they trusted. See? No password sniffing involved in https login sessions. Blizzard can't fight this problem with technology. They have many account recovery calls now, but I bet they'll get twice the number of calls from people can't access their accounts because the dongle doesn't work or the people using it have no clue how to use it, or the the users simply lost it.

The WoW account problems have nothing to do with sniffing passwords over https. It's not a technology problem but a human behaviour problem, something technology can't fix. I would even go far as to say that if you lose control of your WoW account because you got keylogged or were stupid enough to give it out to a 'guildmate' who lives thousand of miles from you, and who you never met in person, you deserve to lose it.

Re:No thanks

[Snaller]

It also makes it hard for adults to read the fucking small numbers. God I hope blizzard isn't doing this shit.

Re:No thanks

[V50]

Aye. I have about 4 passwords depending on how much I care about the thing in question. Frankly, if someone hacks my /. account, I'll be more amused than angry. My bank account, OTOH...

That said, I have had my WoW account hacked, because I made the mistake of logging on my brother's computer once, and he is a nub who downloaded a keylogger off MSN Messenger. That was the last time I do that.

It'd probably be a good thing if they require the authenticators, less grief all around. Even smart people (my brother's in a mechanical engineering program, so he doesn't have down syndrome, to my knowledge) can do stupid things and get their accounts hacked.

Re:No thanks

[Anonymous Coward]

Yeah, I noticed that afterwards, wonder where the USB dongle thingie came from. But the point is still quite same - if all online games start to require such, it's really inconvenient. It would be even more inconvenient if my PS3/360/Wii would require it after I have sit down on sofa to play something. Security is good, you should have the option for people to use it to max, but you shouldn't force it down to people. Make it default option, sure. But have an option to turn off the extra security if user wants to.

but you shouldn't force it down to people

Why do you think this will start a trend? Do you even know why WoW accounts are hacked? If you buy WoW gold today, it came from one of two sources: hacked accounts or people using exploits (teleporting automatically to mining nodes, etc.). Why does WoW have such a problem with gold selling? Because it's the most popular. It is (or at least was, before Blizzard started actively engaging in methods to curb gold selling) profitable and easy to do, because WoW commands a large user base of idiots. If it stops being either easy or profitable then gold sellers will stop, which makes the game better for everyone. Less inflation in ingame markets. Less spam in chat channels.

Plus, it's $6.50. People play 15$ every month to play this game, and tend to invest a lot of time, energy, and emotion into their characters. You think it's inconvenient to enter a few extra numbers into your account info? It's nowhere near as inconvenient to Blizzard or you if/when your account gets hacked.

Re:No thanks

[Anonymous Coward]

Our friend was recently hacked and watched (in frustration and panic) over the shoulder of another player as the account was being looted, while on the phone with Blizzard trying to get it stopped.

The friend complied with your item 1, and was not naive or careless.

Item 2 is just outright wrong for an account with multiple raid geared 80s, valuable crafting supplies, and some items that may have taken a year or more to earn the tokens for. In addition, if not detected and immediately blocked, the guild bank can be looted too. Sometimes the guild bank is looted first.
And sometimes it isn't just gear transfered, vendored or DEed, but talent points reset, character move paid for with your credit card of record, and other vandalism.

Item 3 worries me a wee bit (I would like to have more than one authenticator bound to the account or a way to swap in a new one on short notice), but the device appears to be reliable if it works when it arrives. They have been known to be damaged in the mail, but the infant mortality is low.

So if you think you don't need it, maybe not mandatory. How about if you don't use it, you can't request restoration? If you are hacked, and your account data is taken, you have to open a new Blizzard account with a different credit card, and start over?

The irony was that the friend was actually logged in when the hack occurred, was disconnected from the server by it, and during the attempt to relog was confronted with a request for the authenticator code. The hackers had locked the account by binding their own authenticator.

Restoration delays can be days or weeks and are usually incomplete. In the meantime, raiding in your underwear requires some very patient or overgeared companions.

Re:No thanks

[Volante3192]

You can get a mobile authenticator for most models of phones. I think the key requirement is that it needs to support java, but I might be wrong on that. There's a whole list on the mobile.blizzard.com site.

Costs a buck unless you have an iphone.

Re:No thanks

[Late Adopter]

OpenID is web-based. That may work for WoW, but it's a non-starter for a long-term SSO solution.

How about Kerberos or something based on it? Is there a real need to reinvent the wheel?

Re:No thanks

[JoeMerchant]

The long and short of it is that account theft is a big problem, both for Blizzard and for people who play WoW. Not everyone has a locked-down system, and phishers are using tactics formerly reserved for actual banks to try to get account info. Players have to deal with having their account possibly stolen, Blizzard has to deal with perpetual requests (some possibly fraudulent!) to restore characters/items, and the game as a whole suffers from the RMT that goes on.

I have never had a WOW account, but some nefarious character registered one of my e-mail addresses as owning one - not much of a problem for me, but interesting that they managed to link my address to the account without an authentication reply from me... (and, yes, I have since changed my password.)

Re:No thanks

[Jarik C-Bol]

webcam. reading it themselves is way easier than telling it over the phone.

Re:No thanks

[Anonymous Coward]

See here for a token + software solution that does something like what you discribe :
http://www.vasco.com/products/digipass/digipass_pki/digipass_pki_keys/digipass_key_860.aspx

Re:No thanks

[Daswolfen]

I have an authenticator and not the best eyesight and do not have a problem reading the numbers. Of course, I only got the authenticator because they were giving an in-game pet with it and I am such a geek, I had to have it :) I have been playing since launch, and have never been hacked, but when one of the officers of my guild got hacked and the GB cleaned out (and it took weeks to get only 80% restored) I figured that the investment is well worth it.

Re:No thanks

[murpium]

That said, the only time Blizzard could make Authenticators mandatory would be at a game-changing event

They could make the authenticators free. If Blizzard ate the cost of the authenticators and then refused (or made it really hard) to restore accounts that didn't purchase an authenticator, they'd probably save enough money on support to pay for the authenticators.

Re:No thanks

[Snaller]

"This business of every application requiring its own password is a problem in itself. (I've got 400 passwords in my Roboform archive!) That's why so many sites are adopting OpenId."

And the hackers than you - now they only need one password to hack all your sites.

Re:No thanks

[masshuu]

I say that they need to have different login credential for another reason: In fact every game out there should. https://us.battle.net.login.opn.bz/login/login.xm Actually what should happen is anytime someone Tried to login into a phishing site, some British guy pops out of nowhere and beats them with his cane until they learn there lesson.

Re:No thanks

[Ckwop]

That's why so many sites are adopting OpenId.

I'm not sure why people are adopting OpenID. It requires all this extra overhead of going to and from an additional authentication server. It's a complicated protocol and complexity breads insecurity.

If I use OpenID I've gone from one point of failure (the compromise of my computer) to two points of failure (compromise of the OpenID provider and compromise of my computer). There's actually a third potential point of failure in that the OpenID protocol could be flawed in some way, which compromises all OpenID providers.

What's wrong with entering a entering a username, the site replying with a challenge token? I then sign the token with my PGP key and access is granted. You could make this extremely painless by making a browser plugin that handle most of the leg work.

Now I'm back to a single point of failure and the security of the login authentication has been substantially improved. With OpenID I've created a separate point of failure and I'm still stuck using crappy password authentication.

OpenID is a pretty crap solution to this problem.

Simon

Re:No thanks

[Anonymous Coward]

I think that after giving users a chance to buy one, Blizzard should only help restore accounts of people who use the authenticator. That way they aren't forcing people to use them but at the same time don't have to spend time/money restoring accounts of people who choose not to use the authenticator. Then users get to choose (or remain ignorant until something happens). They could still offer account restores to people who use a simple password login but charge enough money to recoup their costs. In my opinion it's a win-win for everyone except for ignorant/cheap/lazy users. Of course most people are ignorant of security, but at least they get the chance to pay money to correct their mistake (and include the cost of a new authenticator in the restore costs so it never happens again).

Re:No thanks

[sopssa]

I'd probably just registered again and tried to only recover the passwords that matter most.

But on that matter, I do backup the (crypted) password container on several locations from time to time, so I do not think that would ever become the case.

Re:No thanks

[mlts]

I have two issues with authenticators. First, what happens if the battery dies? On PayPal, you can have multiple authenticators to prevent having to send faxes and prove you are you, if one of them gives up the ghost. IIRC [1], Blizzard only allows one authenticator, and if that one decides to take a dirt nap, it is very difficult to regain control of an account.

Blizzard's authenticators are OK, they are rebranded VASCO DigiPass Go 6 models (PayPal uses DigiPass Go 3s.) For the money, they are a great buy.

My other issue is that the software authentication is for a number of phones and Java based, but none for Windows Mobile, nor Android. It would be nice to see an Android app that can do this functionality. Combine this with mobile authentication, and this would be a solid winner with some failsafe-ness built in. Of course, if someone loses their phone, that could be a problem, but that is why one would have software authentication as well as a device that gets tucked away somewhere safe.

Best of all worlds would be standard offline authenticator software (OATH compatible, etc) that is built into the iPhone OS, Android, and other phone operating systems. It would be seeded via a SMS handshake, then the user can just pull up the application, enter a PIN to unlock the app, copy the number showing on the screen either into a window asking for it, or append it to one's password, and have secure, standard offline access regardless of application.

[1]: I could be completely wrong, but I didn't find any documentation to state otherwise.

Re:No thanks

[X0563511]

(british guy pops out of nowhere, beating masshuu while chanting "Their! Their! Their!") ...

(please don't hit me!)

Re:No thanks

[mlts]

We already have this: Client certificates. These are a standard function of most Web browsers. Even mobile browsers (PIE for example) handle this without issue. What one does is store one's private client key in a smart card (I use Aladdin eTokens, there are other brands. Make sure you can find a driver and PKCS #11 compatibility for the OS in question.)

What does this give? If malware affects a machine, there is no way to copy the private key out of the smart card (the signing and decrypting are done on the smart card, not on the computer.)

Of course, this ups the malware attack level -- capture the user's PIN and silently use the device if plugged in, but this is a *lot* more intrusive and an active attack than just a passive keylogger which can compromise 99.99% of all site logins today.

You can add a PINpad onto the smart card, but again, how does one know if it was an authentic Web browser wanting access before logging in, versus malware wanting to insert itself in a MITM attack between the browser and the site (IBM's ZTIC is for defending against this.)

The trick is raising the security barrier. A program that does active MITM attacks is a lot easier to find and smash by an IDS than one that just hooks an interrupt and sits in the background spitting packets out every so often to the blackhat's site.

Re:No thanks

[Anonymous Coward]

You would have to get users to accept carrying their PGP tokens to every computer they intend to login from, which is significant extra work on top of remembering a single password (yes, insecure). One major advantage of OpenID is that you can use any authentication method for the OpenID account and the service using OpenID login just needs to support OpenID. You could setup an OpenID server (or maybe one already exists) which uses client certificates for login.

Re:No thanks

[mlts]

I am not a fan of anything mandatory, but I do like having it as an option for these reasons:

1: An account stolen can mean tens of thousands of dollars to a blackhat organization which can be used to make nastier keyloggers. Usually the account is then botted out with mining hacks until it trips a Blizzard sensor serverside and gets autobanned. Of course, said account has any goods that are on it stripped and the cash bounced from account to account in order to "launder it".

2: My account is an identity. There are some people whom I can only reach through WoW (people stationed overseas, for example.) So, in-game mail is usually the best way to keep in contact with them. Having that compromised wouldn't be good.

3: Passwords need to go the way of the dodo when it comes to public authentication. I'd love to see a standard replacement (not just openID, but something that can be used for authentication on standalone servers not dependant on anyone else's) where one can have the card communicate online to trade public keys, then do offline authentication from there on out, similar to how Bluetooth devices get paired up initially, then function securely when separated. Ultimately, client certificates on a smart card would be the best replacement, but this can be beaten by active malware which intercepts browser requests doing a MITM and displaying bogus info to the user.

Re:No thanks

[Wingman 5]

*cough*TPM*cough*

Re:No thanks

[Anonymous Coward]

The point I was trying to make is if my friend is unavailable for some reason or another (sleeping, out of town, in class) then he would be unable to hit the button and give me the number.

Re:No thanks

[pclminion]

Why would you reverse engineer the key fob? If you are in possession of the key fob, just press the fucking button and enter the code. I don't think you understand the "Something You Have" factor of authentication. If somebody gets your key fob, then they have Something You Had. Don't let anybody get your authenticator.

Re:No thanks

[fm6]

The user name is not the problem. The password is the problem. That's why we're having this discussion: Blizzard is finding passwords to be a very weak point of failure. Having only one point of failure is not all that great if the point fails easily. Two-factor authentication is the obvious solution, but like the guy who started this thread, most people are not going to be thrilled about owning a token card for each and every login they use.

Besides, it's very unlikely that Blizzard (or anybody else that has to support logins on multiple servers) has each server do authentication locally. That would be an administrative nightmare. Much better to have a central corporate server. So the only thing that would change would be switching from the internal server to a server run by an external service provider.

Re:No thanks

[Anonymous Coward]

And you'll find a list supported 'phones for the mobile authenticator here;
http://mobile.blizzard.com/shared/blizzard_download.php?cont=401&id=2183&title=Battle.net%20Mobile%20Authenticator&country=us&lang=en

The biggest omission from that is any 'phone on the Verizon network. I believe it's a Verizon issue, not Blizzard. Also, for iPhone users (and iPod touch), the app is free through iTunes.

Re:No thanks

[fm6]

OpenID is web-based. That may work for WoW, but it's a non-starter for a long-term SSO solution.

What, you think that only web browsers can use web protocols? SOAP is a web protocol.

Re:No thanks

[Anonymous Coward]

We've used two kinds of fobs through my workplace. One always showed a six-digit number that changed every minute, and the other generates an 8-digit number when you push a button on the front.

The first would occasionally get out of sync if the clock on the device drifted too far from the clock on the server. I believe that the server will accept a small amount of drift in order to keep things in sync.

The push-button kind would accept up to ten valid codes from the device, because the button can accidentally be pressed in a pocket, or just for fun, without the code being entered for authentication. If you generated more than ten codes without using any of them, you would need to call the IT folks to have your device re-sync'd.

Re:No thanks

[Late Adopter]

No, I think only web browsers can use *OpenID*. The verification works via an HTTP redirect which sends the user's user-agent to their OpenID provider so the provider can verify that the session is originating from the user. This works in practice by looking for a cookie set by a previous login session, or in the absence of that presenting the user with an HTML login form. That's difficult (but not impossible) to do if the user-agent isn't a browser.

Re:No thanks

[netsharc]

Since the idea of the hardware fob is that it's hard to reverse-engineer, why are they providing the same solution as software for phones? What's stopping a good enough hacker to run gdb on the iPhone or a J2ME simulator and to reverse-engineer the authenticator algorithm?

Re:No thanks

[ShakaUVM]

>>I mean seriously, passwords are among the weakest chain when it comes to security today

No, the weakest chain in security today is not the password. I recently found out that the idiot at Verizon typed in my password wrong when I bought my droid, so even though it'd autologin on my phone, I couldn't access my account (I was wanting to pull up the calendar) on my PC. There's no way of resetting the password without not logging in for a while, and my phone (of course), was always logging in, so it mean for going a number of days (weeks?) without having a phone, just to be able to reset my password.

After clicking around for a while, I found the weakest link: the password recovery password. Favorite food? Well... I won't tell you. It's a secret! Only I love these delicious cheese and pepperoni covered delicacies from Italy.

Why on earth we demand ridiculous password strengths on one hand but have the most mind-bogglingly easy to guess password recovery passwords on the other. They're easily the weakest link. IIRC, Palin's email got compromised by a similar means.

Re:No thanks

[fm6]

And where is it written that only web browsers can use HTTP? SOAP is based on HTTP.

I've never used kerberos. I suppose it could make a workable SSO protocol for web applications, though LDAP over SSL is probably better.

I've actually used this setup for an internal corporate Wiki. It works, but it's a pain, because you have to re-enter your password every single time you enter a new application. On any given day, I'd enter my LDAP password to access my own Wiki, the Wikis of other departments that I worked with, the document archive, the experimental CMS that was supposed to replace the document archive, source control servers, the payroll application, the HR application, the vacation application...

And that was with single-factor authentication! If I'd had to use my token card (needed for VPN connections) each time it would have been intolerable. Though I suppose a USB token card could have mitigated the problem.

If we'd had an OpenID infrastructure, I would have only needed to login once a day to the OpenID server. Then the first time I used each application I would need to give the OpenID server permission to share information with it. That doesn't require a password and only has to happen once.

Re:No thanks

[Late Adopter]

And where is it written that only web browsers can use HTTP? SOAP is based on HTTP.

That's not what I said:

This works in practice by looking for a cookie set by a previous login session, or in the absence of that presenting the user with an HTML login form. That's difficult (but not impossible) to do if the user-agent isn't a browser.

OpenID assumes the user is available to communicate with the OpenID provider via a web-browser. That's the problem.

Re:No thanks

[Opportunist]

Notice the 'https' in front of that url? This 'sniffing' of passwords is not possible over https, if it were, no e-commerce/banking site would be safe.

Do I have to show you a proof of concept or can you write a browser plugin yourself? https means jack if the attacker sits between your user interface and the encryption mechanism.

How do you think passwords for PayPal, Amazon or EBay are sniffed? Not to mention keyloggers that don't care what application has the focus.

Yes, this isn't the "classic" MITM attack where some outsider is sniffing. We're talking about infected machines. And while you could in theory write an attack that aims directly at WoW itself, it's not really a viable source of income. It's more a by-product of other, more lucrative, sniffs.

Re:No thanks

[Opportunist]

How do you want to keep me from reading the private key from the USB stick? If it is a standard USB stick it does not compute at all. It provides data. The actual processing is done in the computer. If that computer is compromised, I could simply "ask" the computer for the information when I want to log in. But it would be easier to simply copy all the data on the stick, seed my dongle with it and use it.

Unless you plan to make a little "computer in the stick" thingamajig, this is not going to solve the problem.

Re:No thanks

[fm6]

OK, you're right, you can't dispense with the browser. But that still doesn't mean non-browsers can't use Open ID. They just need an API for accessing browser cookies. That's actually possible now, though there isn't a standard API for it — you have to read the cookie file directly.

Even if that's not workable, OpenID still solves 90% of the problem. That's because fewer and fewer enterprise applications are anything but web-based. That long list I gave before of signons at my old job? Almost all web-based. The only exceptions were a few legacy applications (all of which were planned to transition to the web), my Windows network login, and my Unix command line login.

Re:No thanks

[spinkham]

This is what smartcards do today.
Currently in the US, they are only commonly in use in the military as CAC cards, but some other people are using them also,

Re:No thanks

[EQ]

None for Android based phones. Pretty weak.

Re:No thanks

[LordLimecat]

The point is that every site or service has a different password. It's just stupid to use the same one in several.

I would disagree with that, there are several sites I use the same password with because they are not linked with any credit card or bank, and honestly wouldnt be a big deal to have hacked (especially since I could reset the passwords on them).

Financial or important sites, certainly use different passwords of course.

Re:No thanks

[Sparr0]

What makes you think it's hard to reverse engineer? The algorithms are published. No security through obscurity here. Security through a system that works.

Knowing how the keyfob works doesn't help you predict what numbers MY keyfob is going to display.

Re:No thanks

[SuperMog2002]

Blizzard only allows one authenticator per account at the moment, but I believe they are planning on changing that.

As for losing your authenticator, when you first add the authenticator to your account, they tell you to write down the authenticator's serial number, keep it secret, and store it in a safe place. (For software authenticators, the "serial number" is randomly generated the first time you launch the app). If you lose the authenticator or it quits working, you can supply that number and the answer to your secret question to remove the authenticator from the account without calling support.

Re:No thanks

[mlts]

Good. This was changed from when the authenticators would require a fax of ID info before it would be removed on Blizzard's end. Now, I just wish Blizzard (technically Vasco) could make an Android app.

Re:No thanks

[grumbel]

If it is a standard USB stick it does not compute at all

It is not a standard USB stick, but a computer with a USB plug (just like MP3 Players, mobile phones and plenty of other gadgets we already have).

Re:No thanks

[shutdown -p now]

A "standard USB stick" does compute things. For example, it needs to do some computations to determine when it has read corrupt data. They're also smart enough to reorder blocks to even out the "wear" on flash media.

Re:No thanks

[varcher]

The strength isn't in the fob/app, it's in the data in the fob. To emulate such a fob, you need two things: it's internal clock and it's internal serial number (which is not the serial number printed on it - Blizzard's server has a database that matches the printed number with the real internal seed).

Both of them can be reverse engineered from the fob they come from. But if you have the actual fob at hand, why would you need to break it to steal its code, when it would be easier to simply use it (we're talking about game).

So, the security model boils down to this: to hack a blizzard account, you need to steal a physical object. That will limit the hacking to a close circle around the player (its family, close friends), allowing Blizzard to say "you can police this yourself".

Of course, the authenticator in phones are far more vulnerable. You might be able to sneak in a trojan that gets those two pieces of data (clock & seed) and send them back to you. No need to steal physical stuff.

Re:No thanks

[varcher]

I believe that the server will accept a small amount of drift in order to keep things in sync.

The server for these things resynchs stuff when you enter the code, or when you activate it. That's why you have to enter your code twice in a row when you activate it: it checks which code you entered (to see how much intervals you're ahead or behind), then the second code makes sure it's not a coincidence, and your internal clock is really X*45s ahead.

The Blizzard fob uses 45s clock intervals. Their maker can't use 1mn clock intervals: that's patented by RSA (yup, RSA patented the fob-code-change-every-60s method. An oversight, I presume, I'd have patented every R seconds, where R is a member of the set of real numbers).

Re:No thanks

[PhilHibbs]

I've had codes rejected within a second of the next code appearing on the authenticator.

Re:No thanks

[Kalriath]

Square Enix uses Digipass Go 6 devices, same as Blizzard. Annoyingly, the manufacturer was lazy and didn't develop them to be able to be shared across multiple services using the same hardware (so you can't use the Blizzard tag with Square Enix's services)

Re:No thanks

[Kalriath]

Their passwords are case insensitive, and don't allow special characters. No bloody wonder.

Re:No thanks

[AlXtreme]

If somebody gets your key fob, then they have Something You Had. Don't let anybody get your authenticator.

A bit late for this reply, but I talked about a generic "key fob" where you stick your banking card in. These are card readers that are also available at the bank directly, and anyone can use any card reader from the same bank.

The only thing you then have (that is unique) is your banking card (debit/credit). Thinking about it, they probably store some kind of private key on the card that together with the bank's public key (in the card reader) generates a one-time code. The bank's website has access to both to verify the one-time code (or check if any codes were missed). Probably safe, just as long as no one has access to your banking card.

Re:No thanks

[RivenAleem]

That said, the only time Blizzard could make Authenticators mandatory would be at a game-changing event, like the release of the next expansion. If they go ahead and do that, they'd probably throw Authenticators in the box, to automatically have near-total distribution. Their biggest concern is probably whether they can source a few million of them.

Many people already have it. They probably wouldn't ship millions of them in the expansion box, but more likely in collector edition, or at the time, ship them to the stores where the kind teller asks "Would you like an Authenticator with that".

Re:No thanks

[pnice]

...maybe they weren't being lazy and instead wanted to be able to make money from both Square Enix and Blizzard even if the player used both services. I bet Digipass makes more money when they sell two of them as opposed to just one.

Re:No thanks

[Anonymous Coward]

That's the first clear and concise description I've seen on this whole thread that tells exactly how the authenticator works.

Re:No thanks

[Anonymous Coward]

That's true, although I think (no hard data though) a large portion of account theft happens through social engineering.

And this will curb that as well, as it makes it difficult to share accounts with someone. If you have to give them a password every single time they log in, then it becomes essentially the same as giving them your password and then changing it. It makes sure that you know when someone is logging in to your account (or at least more sure).

The idea is essentially the same as TKIP, or Temporal Key Integrity Protocol, which is used in encrypted WiFi alongside WPA and WPA2. It uses a sequence counter, which has the effect of changing the key periodically without changing the passphrase, which protects against replay attacks (which is, in its essence, what a phishing scheme is -- the attacker is "replaying" the victim's password). It's a different procedure, but the same basic principle.

Any security mechanism can be defeated if someone has enough patience and determination. The trick is to make it so hard to crack that it outlives the attacker's patience and he decides to move on to an easier target.

To put it in D&D terms: You don't need to outrun the dragon to survive -- just outrun the dwarf.

Re:No thanks

[Anonymous Coward]

Don't let anybody get your authenticator.

Sort of like "Don't let anyone get your car keys or credit card".

Re:No thanks

[Anonymous Coward]

Just to inform you, our banks dumped the one-time code lists when it became obvious that they are anything but secure. We're now at mobile TANs (basically you get a one time code via text message to a predefined phone). Which is secure as long as your phone doesn't get stolen along with your account credentials.

How has it been hacked? How are they retrieving the unique PRNG seed? Can you point us to the report that details the attack? Please do tell if this is not as secure as the security industry thinks. If you can provide a link or something, that would be great. As far as I know, and I've been studying security for a few years, an attacker MUST have that unique PRNG seed in order to retrieve any of the authentication codes.

Brute force doesn't work either, because it changes every thirty seconds, which isn't enough time to try all 999,999 possible codes (or even half, which is the "average" time it takes to break a code of that strength). Even if it doesn't, brute forcing can be defeated with a login delay mechanism.

The MITM attack won't go, because of the dynamic nature of the key.

The only avenue of attack would be for the attacker to somehow get hold of that PRNG seed. That means they have to get hold of the authenticator, which would make the argument moot anyway, or they would have to hack Blizzard's servers. I don't pretend to know how well Blizzard secures their servers, but I imagine they're not amateurs.

Re:No thanks

[djnforce9]

I can see how this could be a problem if you had several accounts for different MMOs that used this and had to juggle around all these authenticators. However, most people only play ONE MMORPG and thus would only have one authenticator to worry about. Also, surely if Blizzard even went further and require this for battle.net accounts, they would let you use the same authenticator device as WoW.

I can't see it happening for anything outside of WoW to be honest especially since it would complicate any sort of digital distribution especially when a physical device needs to reach you first before you can play. There's also the problem of hackers reverse engineering and spoofing the device but that's extremely unlikely.

get used to it. this is going to be common

[timmarhy]

it's ironic that 10 years ago many professional applications used dongles for licensing and access. now it's basiclly comming back in.

i think it's a good thing though, if it wasn't for lax security there wouldn't be so many theifing pricks in the world. no we just need to convince credit companies to use the same level of security that a bloody computer game uses and we might all be better off.

Re:get used to it. this is going to be common

[munrom]

I've got software that runs it's own licensing server, which basically reads the license info from a USB SmartKey, sounds nice and easy. How the smeg am I suppose to cluster THAT! You seen how many USB ports a rack mount server have? Not many is the answer. Thats all I need, a fragile USB hub hanging out the back of the server!

Re:get used to it. this is going to be common

[Anonymous Coward]

i don't see the point here, blizzard authenticator is not an USB dongle, it's more like a secureID RSA card.
(yes the blizzard packaging looks like a usb dongle...)

Re:get used to it. this is going to be common

[thenextstevejobs]

Hope it's not flamebait but: You must have some huge balls on you, using 'ironic' on Slashdot and thinking that you're not going to get a firm talking to for your use of the word.

Re:get used to it. this is going to be common

[Bill_the_Engineer]

Dongles were use to curb piracy. Blizzard doesn't have that concern because of the subscription model.

However a large portion of Blizzard's customers access their WoW account from internet cafés and gaming bars. Since some of these public machines have key logging software installed, Blizzard is experiencing a large number of customer service requests complaining about "hacked" accounts. One way to counter the key logger is by requiring an Authenticator.

Currently use of the Authenticator is optional. Blizzard has learned a lesson that if it's optional it won't work because people don't see the need to spend the extra money or download a free app.

Re:get used to it. this is going to be common

[omglolbah]

1. Get a rack mounted box.
2. Install usb hub in box
3. ????
4. profit?

Or nag the vendor to allow some other form of licensing... that system sounds horribly old school.

ps, I know how hard it can be to get the crud running.. I battle with such problems at work all the time

Re:get used to it. this is going to be common

[Chemisor]

Yeah, and where are those apps now? People hated dongles for a reason; they were inconvenient as hell. The same is true of all these ridiculous authenticator fobs; I'd ditch my bank in a second if they required one, and I certainly wouldn't have any qualms about ditching any game that requires one. But, of course, it's not like a large company like Blizzard cares about a few lost customers...

Re:get used to it. this is going to be common

[Snaller]

No, the world is full of thieving pricks still - they'll just have to find other means of doing it - or attack someone else.

Re:get used to it. this is going to be common

[Anonymous Coward]

Good point. I find his use of irony questionable unless you make some kind of assumption that older is worse and newer is better.

Re:get used to it. this is going to be common

[mlts]

I also worked for companies that had this problem. What I did was buy a USB card that had an internal slot, and not just all external ports. I then plugged the dongle into that. This way, if someone wanted to take the licensing controller, they would have to take the machine off the rack (decently secure datacenter, locked rack enclosure, security screws [1],) and crack it open (padlocked and sealed [2] case, intrusion sensors) which would certainly be noticed. [3]

[1]: They are not secure against a determined attacker who would slot the screw with a Dremel tool, but it will slow someone down, and be obvious to the cameras present.

[2]: http://www.americancasting.com/info-padlock-seals-xpc-2.asp is what I use on the back of cases. I could use the plastic seals, but with these, there is no excuse of "accidently" snapping one off. Disclaimer: I am not affiliated in any way with either of these products, but these do the job for the security needs.

[3]: Musicians have a similar issue. People know that certain music products have license key dongles and that if it gets stolen, the software vender will not replace them, so thieves will prowl nightclubs to look for the dongles and yank them out of laptops. My solution to this with musicians who have rackmount equipment is a 2-3U locking drawer that has a USB hub in the back and the cable threaded in such a way that a strong pull only will detach the cable, and not bring along any goodies with it.

Re:get used to it. this is going to be common

[mlts]

The best of all worlds would be having this type of authentication be present on a generic SIM card app. This way, one can replace their cellphone, or swap from the Blackberry used for work to a low-end "phone and SMS only" model for weekends, and still have the unique authentication sequence needed for banks and other things. Since SIM cards already have a PIN mechanism in place that blocks access after 3-10 attempts, this is a perfect place to store authentication credentials.

Of course, there are CDMA providers, but R-UIM cards should offer the same functionality. For CDMA providers that are not using R-UIM cards... well, we can always dream.

Re:get used to it. this is going to be common

[petermgreen]

Personally if I needed a lot of license dongles on a server and wanted to keep them secure and protected what I'd do is try to mount a USB hub inside the case somewhere (maybe cable tie it to something like http://www.startech.com/item/SATA35252X-35-Bay-to-Dual-25-SATA-HDD-Adapter.aspx and mount it in a drive bay). Then just make an adaptor cable to go from the USB hub to one of the motherboards USB headers.

Re:get used to it. this is going to be common

[Anonymous Coward]

Currently use of the Authenticator is optional. Blizzard has learned a lesson that if it's optional it won't work because people don't see the need to spend the extra money or download a free app.

Until they get hacked. I've seen quite a lot of accounts get hacked -- and THEN they get the authenticator. I once saw a guild on Cenarius whose guild leader got hacked, and watched as the hacker took 21k gold out of the guild bank, along with all of the high-end epic items and special enchanting materials (six full stacks of crusader orbs, for you WoW players). The hacker also kicked all of the guild officers (I was one of them). That guild ended up dissolving. For those of you that don't play WoW, 21k gold is like saying about $21 million.

The funny thing is that even with the authenticator, if they go to a phishing site and enter that code, they could still potentially get hacked, because now the phishing site has that tear-off code. Not sure exactly how the authenticator works, so maybe I'm wrong on this one. I would definitely like to see account hacking become a thing of the past, but even with the authenticator, I don't see that happening.

For those of you who think that it's ok to sell WoW gold, that's who's doing all of the hacking. The gold spammers are hacking accounts, stealing all of the gold from them, and then selling it to other players. We found out later that it was a gold spammer that hacked the GL's account. So this is a perfect example that gold spammers should be drawn and quartered.

Re:get used to it. this is going to be common

[Kalriath]

We have software here where the only option is a parallel port dongle. You know how many parallel ports an HP DL385 G5 has? None.

Re:get used to it. this is going to be common

[Kalriath]

The funny thing is that even with the authenticator, if they go to a phishing site and enter that code, they could still potentially get hacked, because now the phishing site has that tear-off code. Not sure exactly how the authenticator works, so maybe I'm wrong on this one.

You are. The code is only usable for about 30 seconds before it expires. And it makes brute force near impossible as you're prompted for the code regardless of whether you got the password right (and for bonus points, they don't tell you which item of information you got wrong - it could be the code or the password).

Re:get used to it. this is going to be common

[Anonymous Coward]

I stand corrected, then. I suppose it's theoretically still possible, but I don't think it's practical at that point.

I do sincerely hope that this does the trick and puts an end to this stuff. I'm tired of seeing guilds lose months worth of work to low-lifes.

iphone app?

[Anonymous Coward]

why not just make it a PC app and get it over with?

Better idea... why not just enforce good password practices and educate your users?

Re:iphone app?

[Microlith]

Why not a PC app? Potential for compromise. A keyfob removes all question.

And why not educate users? Because blizzard doesn't have the time or money to deal with angry children who refuse to remember a random 8 character password. Never mind people who do have a good password and log on via their friends compromised system.

Re:iphone app?

[Opportunist]

1) A PC application would just be hijacked along with the rest of the PC. You either need a second channel to increase the security or, as it is done in this case, two tools at both ends that generate identical tokens for which the generation is not known outside the authorized parties. If that tool would reside on the compromised machine, the generation seed would be compromised as well, rendering the whole system useless.

2) Good passwords mean jack if the attacker knows the password. Those passwords are not guessed, they are phished. You can have a 20 byte random alphanumeric password and it is not worth anything if the attacker knows it.

Re:iphone app?

[BikeHelmet]

I like this second layer of defense. Even under a worst-possible-situation where your password gets sniffed, account hijacked, and password changed... (which would itself take extreme dedication, because of the sub-30s window) nobody can log in again without your keyfob.

This should utterly eliminate casual account theft.

Re:iphone app?

[Snaller]

Heh, I know several people who share their accounts all the time for services from the other character.
They are adults, and wouldn't abuse it (beyond not being "allowed" via the eula) - but if this comes to pass they are all fucked.

Re:iphone app?

[Rakarra]

Better idea... why not just enforce good password practices and educate your users?

Since when has that worked in the history of computer use?

Re:iphone app?

[BigFire]

You can have the most random password know to man, and still won't matter if your computer have a keylogger on it.

Awesome security

[aldld]

Sounds secure. Why don't they use it for our credit cards instead? (or both)

Re:Awesome security

[neokushan]

I don't know about you, but some banks in the UK do in fact use a similar system. It's not perfect, though.

http://blog.jezmckean.com/why-i-might-leave-my-bank-the-natwest-card-reader/

Umm why?

[Anonymous Coward]

Does someone really care about their WoW crap that much? Really?

Re:Umm why?

[neokushan]

Because hijacking accounts and stealing gold and items from players to be sold on is actually quite a lucrative market. If you can't farm gold because the bots are detectable or because that little chinese kid costs too much money to pay, why not just steal it?

Re:Umm why?

[Anonymous Coward]

So, this is not for the players, but because making the game work is too hard for Blizzard. Thanks for the heads up.

Re:Umm why?

[Anonymous Coward]

I've seen bots run in circles killing the same mobs for weeks at a time. The only way I know of that they get "detected" is if someone reports them. Maybe they do have some automated system for catching them, but it can't be that effective.

I talked to a GM about the bots (lots of them hang out in caves in stormpeaks) and he said it would be investigated by their "bot team." He also said that many of the bots you see are in fact from compromised accounts and that they like the caves because of the high re-spawn rate.

So yeah it's a double return, you get a farming toon and you get all the crap in their bank.

Re:Umm why?

[Opportunist]

Because people buy gold for real, hard cash (despite breaking the policy of the game, but ... who cares?). And those accounts can be valuable not only because of the gold they contain (and the items that can be sold for gold). They can be useful to launder that gold (so Blizzard has a harder time finding out who actually finally got the gold and who sold it), they can be used to send spam messages (because only paying accounts can send out mail afaik), they have a lot of value to a gold seller who doesn't have to spend 10 bucks (or whatever a WoW account costs today) to spam and sell his "service".

Yes, 1000 gold cost like 10 bucks (if that). But it's 10 bucks you didn't have to work for, 10 bucks you didn't have to share with the Chinese farmer that usually makes them for you, it's basically 10 free bucks. Would you take 'em?

Re:Umm why?

[thesandtiger]

Is your time worth $0?

Many people playing these games have hundreds or thousands of hours spent playing - a $7 device and 5 seconds each time you log in is a pretty fair price for protecting that time spent.

Even if this were entirely a benefit to Blizzard and completely neutral for the player, it still actually would benefit players: less support staff time spent on "I got my account hacked!" means that players with other problems can get tickets answered more quickly.

Re:Umm why?

[that this is not und]

I know of other games where you are instantly banned if you buy the primary game currency with real money and not through the approved channels.

Maybe Blizzard just needs to crack down on third party sellers.

Re:Umm why?

[Anonymous Coward]

Cracking down's easier than it sounds. If I-the-RMT do nothing but send and recieve gold, sure, that's a red flag, but some games keep guild banks like that. If I launder that gold through several characters, it becomes harder. If I buy predetermined overpriced items the goldbuyer is selling at auction, it becomes harder still. If the heat's really on, and my sales decline precipitously... ... I start mailing 10% or 25% of my gold to whoever I run by on the way to the mailer NPC that has the best gear, or just overbid for high-level shit at auction, and wait for the crackdown to cease. I don't think they'd survive a week of the bad PR.

Re:Umm why?

[Anonymous Coward]

Er, -harder- than it sounds. Harder.
It's also not particularly easy to entrap, as RMT sites grow by reputation for obvious reasons. You can ban later, sure, but the gold's still loose in the economy.

Re:Umm why?

[Joe Random]

So, this is not for the players, but because making the game work is too hard for Blizzard.

"Making the game work" isn't too hard for Blizzard. Rather, people who have their accounts compromised by phishing, trojans, keyloggers, etc place an undue burden on Blizzard thanks to their (the players') incompetence.

The addition of an authentication token is how Blizzard is "making the game work" despite users who manage to have their password compromised.

Re:Umm why?

[petermgreen]

Afaict in most MMOs you get ahead by spending more time "grinding" at the game than other people. Skill helps too at least to some extent.

The thing is some people want to get ahead without the effort and/or get further than they reasonablly could on thier merits alone so they bend or break the rules. This phenomenon isn't unique to computer games, look at how many sportsmen over the years have used drugs to get ahead.

Now in MMOs one of the common ways of breaking the rules is to trade real-world money for ingame money. Of course this ingame money has to come from somewhere. That means either

1: paying people to "farm" for it
2: writing bots to "farm" for it
3: stealing it

Afaict all these techniques have been used by WOW gold-sellers.

Other than completely getting rid of the in-game economy or restricting it so much that everything feels horribly forced or selling in-game currency for real money at knock-down prices (a cure that I think would be worse than the disease) I don't see any real way to stop real money trading.

Waste o'money

[CptChipJew]

Many US banks will text or email you a one-time authentication code. It's certainly a lot cheaper than buying a piece of hardware.

They aren't doing it this way...why?

Re:Waste o'money

[compro01]

You want to have to go through email/text every single time you log in vs. pushing a button on a key fob and typing in 6 numbers?

The hardware in question costs $6.50. This is a game you're already spending $15/month on.

Re:Waste o'money

[slyn]

If you have an iPhone you can get the authenticator for free as an app, and they have said they would like to bring it to more platforms in the future (presumably android, blackberry, minmo and the other major smartphone os's).

Re:Waste o'money

[neokushan]

No doubt if Blizzard made this mandatory, they'd cover the cost of the devices themselves. Its probably not going to go down well if they suddenly prevent players logging in unless they pay an additional, one-off fee. Many people would see it as a bad precedent.
Furthermore, they'll probably either supply them with new copies of the game, or only "enable" it (and send it out) to accounts that are more than say 3 months old (as they're arguably not going to have much worth stealing and by then the cost of the device will have been covered in the monthly fees).

Re:Waste o'money

[NormalVisual]

They already offer it on a number of platforms, but unfortunately the BlackBerry offerings are for rather ancient devices, and they do charge for them.

Re:Waste o'money

[Anonymous Coward]

Or have the phone software version which costs $0.99.
Blizzard says the $6.50 for the hardware version just covers manufacturing costs, they don't even charge shipping.
Haven't heard about, or seen in the Blizzard store, the iphone free version the article mentions.
And those are ONE TIME COSTS, not a continuing amount like the subscription fees.

If someone has ever broken into your account and trashed your characters, you'd think the cost ($0.99 or $6.50) is worth it.

Re:Waste o'money

[Anonymous Coward]

They have it for many phones, the cost is $0.99, or at least it was one month ago when I checked.
(They've had the phone based authenticators for over a year now that I know of.)

Re:Waste o'money

[LordLimecat]

Email would be retarded anyways, if they have your wow account info its not a long shot to assume they might have your email credentials as well. At least using texting relies on "something you have and something you know" rather than "something you know, twice".

Re:Waste o'money

[ZachPruckowski]

That's not cheaper. It's $6.50 for the authenicator (or free on a mobile phone). Versus $0.10 to you and Blizzard every time you log in? No question the text messages are more expensive - for Blizzard and for everyone who doesn't have unlimited messaging. At 65 logins, it pays for itself inside 3 months.

Re:Waste o'money

[Anonymous Coward]

As someone who has had exactly that happen I can safely say that a $6.50 one off to protect my $15/month addiction (I can stop any time I just don't want to...really!) was well worth the peace of mind it provided.

Though hunting round for the damn thing when I miss place it does frazzle the nerves a bit.

This uses the standard Ace / RSA system right?

[AbRASiON]

I wonder if they could give you a soft token, which works for the iphone app.
http://images.google.com/images?q=rsa%20app%20iphone&hl=en
A mate showed me this, pretty damn cool. I'm not an encryption guru so I couldn't tell you how or why it's just as good as the real physical dongle but I'm sure it would be or they wouldn't release it. (Someone here will no doubt reply with more info on this)
Shame my crappy Government remote authentication software is a couple of versions out of date for me to make use of this on my iphone :/

Re:This uses the standard Ace / RSA system right?

[Jthon]

Blizzard does have several soft token schemes which don't require that you purchase a physical authenticator. There's an iPhone app you can get for free and use to do generate an access code. They also have apps for a few other phones available.

The only thing they don't offer is a PC application and this is intentional. Using a PC app means some virus/trojan could run your pc authenticator and capture the code which makes it decidedly less useful.

Re:This uses the standard Ace / RSA system right?

[mlts]

An app is just as good, provided the phone isn't compromised. As of now, malware on devices isn't a major issue, and most devices have a very solid privilige system to ensure that one app can't compromise another (Android's system is the best because each app is signed and has its own UID and unless it asks for the privs on install, it cannot access other app's data.)

Optimally, the best of all worlds would be an app that signs/decrypts a private key on the SIM card (key never leaves the card), and the iPhone, Android, or Java app is just a UI front end to that.

Shoes

[Anonymous Coward]

Of course you have to remove your shoes. What are you, some sort of barbarian?

Anyone with good security practices hacked?

[Anonymous Coward]

i may not have the BEST security practices (duplication on more than 1 site), but i have a pretty strong password (8 random alpha-numeric) that i HIGHLY doubt was brute forced. all my systems check clean (except for some demoscene intros), however my account was compromised.

i wasn't bad off at all. just main's bags emptied, but alts untouched and guild bank unmolested. of course forums and blizzard think i had a virus or spyware.

anyone else have even BETTER security practices and STILL get compromised?

The Authenticator is a good idea

[Oxide]

I have been using Blizzard's Authenticator on my iPhone for a quite a while now and I'm very pleased with it. I can't imagine the devastation I would be in if my wow account got hijacked. I've spent days and nights developing my characters and It would be a huge loss if I lost them to some script kiddie.

The iPhone Authenticator is like you holding a physical key to your account. Good idea.

Re:The Authenticator is a good idea

[upuv]

So you loose your phone and you are screwed?

Re:The Authenticator is a good idea

[Mascot]

For a while. You can jump through a number of hoops with Blizzard support to get the account unlinked from the authenticator.

I think it took about 48 hours when I had to do it back when my authenticator decided it no longer wanted to turn itself on.

A word of caution to any in a similar boat: CALL Blizzard. They can take a week or two to get to the email, you probably don't want to wait that long.

Re:The Authenticator is a good idea

[Dachannien]

It's not really script kiddies who are doing this anymore. It's all tied to the RMT "industry" - essentially, organized crime.

Re:The Authenticator is a good idea

[cyber-vandal]

The word is lose.

Re:The Authenticator is a good idea

[TriezGamer]

If only Square-Enix was so fast with their Security Token (purely optional, but incentivized in-game through a 100% increase in inventory space) -- It took nearly a month to resolve a guildmate's issue with a malfunctioning token. Mine has never had problems, and I'm happy with it, but the horror stories I've heard...

Possible application to internet anonymity?

[Anonymous Coward]

I hope other Slashdotters agree in that it would be truly great to be able to browse the Internet with some sort of guarantee-able anonymity. At the same time, sometimes you want to be able to more firmly identify yourself before performing an action online. It seems this sort of authentication could provide much greater, though still penetrable security than the standard password model. I hardly think it will be too long until you're logging into online stores through this sort of system than using a password.

That said, how much incentive to online stores have to counter fraud? The more it benefits them, the more likely we'll see it.

A little off-topic on the anonymity side but perhaps is still something appropriate to discuss here. Is there any way that you can browse for information on the Internet from home in which the traffic couldn't be personally identified to you? It would also seem if that could be offered that it would be very popular. I understand that the Tor network is a step forward, but still not making it easy to browse and interact with the Internet in an anonymous manner.

There are just too many crimes that are too easy to commit these days on the Internet. I don't think we should have to be looking over our shoulders all the time. Also, anonymity just seems like it'd be liberating.

Re:MORE money?

[Anonymous Coward]

And NOW I have to spend even MORE money to buy some device to keep my account secure because Blizzard has no clue how to keep accounts secure from hackers.

It's not like Blizzard are having the user/pass stolen from their systems, the people who get "hacked" got hacked because they fell for phishing scams or they downloaded something dodgy of their own accord.

Re:MORE money?

[jo_ham]

Blizzard knows exactly how to keep people out of the game, and tells you how to do it. It has extensive FAQs on account security and how to prevent it happening. What they cannot do is control whether users read and follow these tips, or keep spyware off their machines.

The simple fact is that all you need to log in the account is the user name and password, which are trivial to acquire from dumb people wither by technical or social engineering methods.

The authenticator prevents this, and is free for many mobile phones or costs €6.99 from the store if you don't have a compatible phone. Alternatively you can just use the current system and be smart. I had a WoW account since the original release of the game and have never been compromised: I don't share my account details, I keep my machine up to date, I have no virus/keylogger/spyware issues and I don't go to gold selling websites. I have never needed the authenticator.

I have known people in game who have had their accounts taken - some more than once.

If you think Blizzard "has no clue how to keep accounts secure from hackers" then you are sorely mistaken. The introduction of the optional authenticator immediately dismisses that assertion right off the bat. The fact that people still choose not to use it and then wail about long GM response times for restoration of their stolen accounts is hardly Blizzard's fault.

Re:MORE money?

[Calydor]

The fact that accounts could be linked to a battle.net account without providing anything other than the username and password was stupid.

The fact that after making battle.net mandatory, battle.net accounts could be linked to an authenticator in exactly the same way is completely moronic.

You need a TON more info to get back control of your account (CD keys etc.) than to steal one in the first place. Why not require the CD key to add to battle.net/authenticator in the first place? People who willingly give that out anywhere else but to Blizzard themselves deserve what they get.

Send confirmation emails to add to battle.net/authenticator. Send confirmation emails to change your registered email address. Force a call to the CS call center if you have no access to your email. Keep logs of the IPs that have connected to an account, use those to get a rough idea of where in the world people are connecting from, then use that to confirm if it's the actual account owner who's on right now. Etc., etc.

THIS is forcing the people who actually KNOW how not to get hacked to pay for the stupidity of little children who go "OMG, Blzzrx is giving me a free mount for no reason whatsoever!!1!!!1!" I'm sorry, but that's just as stupid as any previous attempt at security.

Re:MORE money?

[Anonymous Coward]

And NOW I have to spend even MORE money to buy some device to keep my account secure because Blizzard has no clue how to keep accounts secure from hackers.

It's not like Blizzard are having the user/pass stolen from their systems, the people who get "hacked" got hacked because they fell for phishing scams or they downloaded something dodgy of their own accord.

^^^^ This. You're not paying because of Blizzard's failing.

You're paying because:
-user stupidity (user fail)
-poor application security (coding error fail*)
-poor library security (coding error fail*)
-Microsoft OS (coding error fail*)

user fail -> haxx0rd
coding error fail -> haxx0rd
haxx0rd -> pwnd account
pwnd account -> PITA for Blizzard

*These refer to the situation where you click a link in your browser and BAM you're the proud new owned of a keylogger because you simply followed a link that led you to some sort of exploit where you don't even have to download and run anything.

Not going to solve your problems

[selven]

2008: Oh no, I forgot my password! I need to call Blizzard for help!

2011: Oh no, I lost my authenticator! I need to call Blizzard for help!

Re:Not going to solve your problems

[Anonymous Coward]

Lost your password? Have fun with your nekkid and broke account for the 1-3 weeks it takes to get fixed. Oh... and all your gear doesn't have gems or enchants anymore.

Lost your authenticator? Odds are you lost it (not someone stole it). Now no one can log into your account. So in the short time it takes to get a new authenticator, you have a fully functional account still.

If you lose the bet and somehow a Chinese hacker got your authenticator? Well... your just as screwed now as you would have been previously. Reset password, change email and get a new authenticator... nothing too different than normal.

Also: This is going to nip power leveling services in the bud HARD. So you want my account info AND my authenticator? Good luck with that. Gold farmers? Woops, the shipment of devices to China got lost... dam... there goes THAT problem as well.

Re:Not going to solve your problems

[LordLimecat]

Luckily thats not the problem theyre trying to solve, but good job reading the summary.

So...

[stonedcat]

How will this affect Linux WoW players? Don't let Blizzard tell you there aren't any, there are thousands of us.
They better make sure they have their shit together first before fucking people over or they'll lose customers.

Re:So...

[oberondarksoul]

At present, they don't support playing WoW on Linux. Afterwards, they won't support playing WoW on Linux. If you play, good for you, but they're really not under any obligation to make it work.

Re:So...

[Anonymous Coward]

Which part of losing paying customers did you not understand?

Re:So...

[Anonymous Coward]

Every linux user quitting over this would be a drop in the bucket, frankly. Blizzard doesn't support Linux; playing WoW on Linux means you accept that they don't support your OS and are willing to deal with it.

By all means, though, stop paying for the game and observe the reaction from Blizzard.

(none)

Re:So...

[goodmanj]

So what, a keychain fob is going to suddenly stop working if it gets near a Linux device? Open source is a powerful thing, but if it now has an aura that destroys all non-GPL devices in a ten foot radius, I'm really impressed.

Also, "thousands of you" means there are as many of you as there are level 80 female dwarf subtlety rogues wielding Quel'dalar. You'd be insignificant even if you *did* all quit the game rather than play on another platform... which you won't.

Re:So...

[Anonymous Coward]

It won't affect them at all.

The key fob is a separate hardware device that is never connected to the machine.

Re:So...

[Anonymous Coward]

Actually, it won't. I'm currently playing WoW on Linux, with an authenticator -- no problems here.

Re:So...

[jo_ham]

I think I have seen one female dwarf rogue - not sure if she was Sub. I waved to her from my female dwarf holy engineer/tailoring priest. I kid you not.

I once pugged an UB run back at 70 and was asked in all seriousness why my dwarf was smaller than a normal dwarf - I had to point out she was female.

Re:So...

[Volante3192]

The authenticator code is punched in after the L/P as part of launcher.exe or wow.exe (i forget which). If the game works, I don't see why that shouldn't.

Re:So...

[Anonymous Coward]

Making authenticators mandatory has absolutely nothing to do with the platform WoW runs on. It just means that on the login screen you will not have to type your password anymore, but the random number displayed on the authenticator device.

The authenticator device does not connect to your computer and does not need any installation. It just displays numbers when you push its button.

Re:So...

[Anonymous Coward]

So what, a keychain fob is going to suddenly stop working if it gets near a Linux device? Open source is a powerful thing, but if it now has an aura that destroys all non-GPL devices in a ten foot radius, I'm really impressed.

Yeah, but you should see what the devs gave the MS EULA... :-(

Re:So...

[Anonymous Coward]

Not in the slightest as far as I know. The WOW client runs through WINE and I can't imagine why the authenticator wouldn't work.

Certainly haven't seen a mention of it.

Re:MORE money?

[thesandtiger]

Lest anyone think you're insightful or interesting or informative (because your post indicates you are none of these things):

Blizzard is eating the cost of shipping on these inside the US and Europe. They are charging less than $7 for them, which, in addition to the shipping, has got to be pretty near break even. I sourced tokens a couple of years back and we were quoted $10-25 each depending on the supplier.

They are also offering a free version over the iPhone/iPod and for a variety of other devices like Blackberries.

The end result is about 4-5 seconds added to your time to log in, you don't get your account (that you've spent hundreds/thousands of hours on) stolen, and when you do have a legitimate issue in game that requires support there's a better chance someone will be able to help you sooner rather than 3 days from now.

Of course, I suspect based on your post that you don't actually play this game, and probably came in here just to be smug. Is "I won't pay MORE money to play a game I ALREADY paid for" the new "I don't own/watch tv"?

very wrong

[ccozan]

• I think you have never played WoW. So you don't know how much work is put into building a char and keepup with the challenges. Losing this because your Windows allows malicios code to run equals to a cataclysm ;).
• Blizzard has _nothing_ to do with incompentence of users which allow keyloggers and stuff on their computers. The fact that Blizz allows the recovery of your items/gold on _their_ costs, is a fact that you will never find anywhere else.
• 3. the authenticator is 7 euro. This is two beers. I find it acceptable if i can keep my account thus protected.

Re:very wrong

[pilot1]

Blizzard has _nothing_ to do with incompentence of users which allow keyloggers and stuff on their computers. The fact that Blizz allows the recovery of your items/gold on _their_ costs, is a fact that you will never find anywhere else.

That's a bit extreme. Plenty of MMOs handle theft the same way. Customers tend to not resubscribe when their stuff is stolen and never returned.

Blizzfail!

[Naaythann]

I have to admit this is quite funny, in the last few days i had my battlenet/WOW account banned for gold farming. Not played it in about a year, so i went throught the process of trying to establish what happened. Got passwords and so on reset but the git attached the said "Blizzard Activator" to my account and i'm back at square one and locked out of battlenet/WOW.

Click here for gold!

[Anonymous Coward]

Click here for gold!

World of Warcraft is running a special promotion! Click here to see if you've won! Note: You will have to log in, in order to see if you are a winner. Please type in the following information:

Username:
Password:
Six-Digit Lottery Code:

Thanks and good luck!

crap

[Anonymous Coward]

I'll cancel my account before I pay for an aunthenticator. It's only $6.50, but it's an expense I wouldn't pay if I had an iphone. I don't have that luxury.

There's other financial motivation for the authenticator as well. With the authenticator, pretty much nobody else can use the account. No more borrowing accounts, no more selling accounts.

I see this as more the incentive for the authenticator than peoples' accounts getting "hacked". If you log into a website with your account uid and pwd, have a keylogger installed via your addons, or use your main's name and your uid and pwd, you deserve what you get.

Re:crap

[omglolbah]

Meh, you can still sell an account. You just have to sell the dongle too :-p

And um... borrowing and selling accounts is already against the TOS and could get the account closed so... why are you upset? :-p

Re:MORE money?

[Calydor]

Technically no, I don't play. I quit after getting a hunter to level 70. Your assumptions fail.

I still think it's ridiculous to pay more and more and MORE to play a game I, in my mind, own, but I'm probably just an old fogey like that, so get the f*** off my lawn.

Re:No thanksRe:No thanks

[Snaller]

And again, us intelligent people have to suffer because of the morons who play wow - now what would be good if we could get rid of the morons instead.

Re:MORE money?

[thesandtiger]

You must have missed the part where I pointed out the free version that's being offered, eh, grandpa?

Don't let that get in the way of a good rant, though! Tell me about how you used to have to walk uphill both ways in the snow or about how you beat up Japs in the war!

Arms race

[Snaller]

No, it just means the hackers upgrade their ways of attack.

The bigger view....

[santax]

I think this idea is great in achieving what it is intended for. Less abuse/hacking of accounts. But what if more games take this up. Is it smart to buy a new cabinet to store all those devices now, or should I wait a bit, see if prices of cabinets drop?

Lastpass uses free paper printed Grid

[silviuc]

Lastpass, uses a unique generated grid that one can print on paper. It asks for certain points on that grid identified by column and row as an added security measure. Why the heck Blizz did not think of something like this beats me. Watch this youtube vid to see how it works http://www.youtube.com/watch?v=jcgzf1KvZlg

and of course

[Snaller]

Eyesight can be a problem for some of us. As in not being able to read the small dark letters.

The real REASON for authenticators

[ukyoCE]

Let's not forget the real reason authenticators are becoming mandatory. It's because accounts are getting hacked, sure, but why are accounts getting hacked?

Because there are idiots paying real life $$ for in-game money, which they get by hacking accounts and selling off their stuff. The customers of these websites are paying these hackers to take over people's accounts, effectively.

Do away with the monetary incentive, and accounts wouldn't be getting hacked.

Re:The real REASON for authenticators

[chickenarise]

You don't have to hack an account to sell gold. Many gold-sellers use bots to farm for gold. However, it is true that the in-game advertisers of gold-selling are all hacked accounts.

Re:The real REASON for authenticators

[ukyoCE]

Yeah, I think Blizzard must have cracked down on bots a little too well, and hacking is now much easier for stealing accounts. Especially with all the flash keylogging opportunities they've had :P

Re:The real REASON for authenticators

[Anonymous Coward]

So essentially what you're saying is, solve a much more difficult problem and this one will go away? Uh huh...

Re:The real REASON for authenticators

[ukyoCE]

I'm encouraging individuals to stop funding account hacking, not encouraging Blizzard to "solve" people buying gold. (which they already try to do)

Re:The real REASON for authenticators

[Anonymous Coward]

I'm encouraging individuals to stop funding account hacking, ... (which they already try to do)

. . . which is a good thing to encourage, and you *should* encourage it, but the odds of it happening are slim. People are people, they're lazy, and they're greedy. They're going to buy gold no matter where the sellers get it. I think this is going to be a good move on Blizzard's part in curbing account hacking, gold farming, account sharing, power levelling services, and probably a lot of other idiocy that shouldn't be in the game.

As a four-year veteran in World of Warcraft, I'm in favour of this.

But the anti-database folks will complain

[Anonymous Coward]

There are a lot of ways to do this. For example, the ID cards we have here in Finland (You can get one from a police stations) have the public and private keys (one pair for e-mail encryption, other for digital signatures which can be used to sign contracts, etc., though you naturally need a six digit pincode for that in addition to the card). The USB reader for such a smarcard is cheap, the software and drivers you need to install are provided by the government, free and open source. Anyone can design a system to allow authentication with those cards. That or similar system could well be used for WoW auhtentication, too. No need for additional cards, etc.

Yet, Slashdotters tend to complain about any plans to implement similar systems (or any kind of national databases). Too Orwellian, etc..

Re:But the anti-database folks will complain

[mlts]

I wouldn't mind a smart card attached to US driver's licenses worked as a US DoD CAC, or like the Finnish design.

Believe it or not, cards like this could make a whole privacy ecosystem. Picture if once the government CA certifies the card is yours, then all they have to do is stick a signed certificate that you are over 18 or 21 on it. Then, all you do is swipe the card at a bar, and the bar not just assured that they are not breaking laws, but they don't have to know your birthdate, name, or any other info.

Similar certificates can be used too. A college can sign someone's key saying they graduated with a B. S. in chainsaw fencing. The accreditation agency can sign the college's cert ensuring that at the time the degree passed standards. A police station could scan someone's criminal record and issue a SLC (short lived certificate) saying that for these 30 days, an application has been proven to have -no- criminal history.

This would improve privacy tremendously. Just have a certificate stating the critical piece of information, no more. Of course, giving the user the ability to show/hide certificates on a key would be good as well.

Yeah but they were over $80 at one point...

[Mashiki]

They were ~$80($6.50+shipping and taxes on top) in Canada at one point. That left a very sour and bitter taste in my mouth, I have no want, need or desire to get one when they cost that much. I don't care that they're $6.50 now, if they want me to use one then they can give it to me with the next expansion. My cousin says they're still up over $20(somewhere around $25, aka $6.50+shipping+taxes), still don't care.

And if you live outside of any of those normal shipping zones you can still get them through 3rd parties. Or Ebay, at 400-4000% the markup.

Re:MORE money?

[Volante3192]

You don't own the servers the game runs on, and the client's pretty much useless without them.

forget about Teeman...err MTAN

[Anonymous Coward]

Actually, a certain mobile phone is making insane value on the used market, because it can sufficiently impersonate another cellphone and apparently grab SMS' off the network... MTAN has been essentially broken from the start...

What gives Blizzard the right?

[Anonymous Coward]

What gives Blizzard the right to do that? It's not a copyright thing and you're allowed to USE the product.

One of MANY reasons I don't play online games, especially one with levelling up. It's all Bullshit.

Re:What gives Blizzard the right?

[BigFire]

It's their game. You are only leasing it from the at $14.99 a month. Read the EUA.

Non-story

[ildon]

For those not familiar with wow.com, previously called wowinsider.com, it's basically like a supermarket tabloid for WoW. I mean seriously, an anonymous source says that "serious consideration" is being given to maybe possibly some time in the distant future making authenticators mandatory?

Anyway, having said that, the easiest way to do this would be to use the Cataclysm expansion purchase to subsidize it. Each purchase would give you a coupon for one free authenticator. Putting an authenticator in the box would just be a waste of money (and wouldn't help the people who purchase it online).

Their real problem right now seems to be manufacturing them fast enough to keep up with demand. I know people who ordered one around or shortly after Christmas who still haven't received theirs (despite the confirmation email stating "2-3 business days").

Until they can solve the inventory problem, making them mandatory is still out of the question.

If you can install a keylogger, you've already won

[JeffL]

I'm not sure that adding the authenticator will fix the problem of hacked accounts, it will just put things off until the thieves come up with a new system to break in.

If they can install a keylogger on your computer it should be easy enough for them to install a fake WoW login app. Put up the login screen, pass the username, password, and authenticator value to themselves, and give the hacked user a login error, realm is down error, or some such. Take the information and login to the account in the minute or so before the authenticator value expires.

Once the thief is in, it only takes a few minutes to sell gear and mail the gold. Login and realm servers being down occurs frequently enough that most players wouldn't suspect anything was going on if they're locked out for 30 minutes, which is more than enough time to for the thief to wipe out an account.

This is not a new idea, but one that has been floating around for quite some time as a method to access bank accounts, etc. which require some sort of authentication token.

BTW, if you put an authenticator on your WoW account you get a nice in game pet. If you remove the authenticator from your account, Blizzard removes the pet from your characters.

Re:MORE money?

[ildon]

In other words, you have not sunk several hundred dollars into this hobby like so many others. When your investment so far has been that large, an extra $6.50 worth of insurance to save you a potentially big hassle is nothing.

more expenses

[Snaller]

They still cost money - and the users have to pay the money of course, blizzard is not going to eat this.

So we are all being punished by the idiots children who can't figure out how to protect their account

(touch wood!)

Re:If you can install a keylogger, you've already

[Anonymous Coward]

So you're going to pay someone to sit there waiting for a 30 second window in which some random compromised account logs in? That just doesn't make sense. Even at Chinese farmer rates.

Re:If you can install a keylogger, you've already

[JeffL]

So you're going to pay someone to sit there waiting for a 30 second window in which some random compromised account logs in? That just doesn't make sense. Even at Chinese farmer rates.

Why pay somebody to sit in front of a computer? It can all be automated. The receiving program automatically logs in, and then pages, messages, whatever, the person to come clean out the account. Also, there are bots to automatically clear out guild banks, sell things, etc. I don't think that the thieves consider themselves bound by Blizzards ToS. This just makes their lives a bit more difficult, but nobody said gold selling was easy.

It ain't just location that puts them at risk

[Shivetya]

the number of people who share account information in many guilds is very high. Sharing account information with internet friends is just stupid.

Throw in my favorite idiocy, people who use the same account information including password on fan or guild sites.

I wish my Credit Union had one of these Authenticators, as it is they have a pattern/challenge type arrangement which seems pretty good.

Another case of morons ruining things for everyone

[Anonymous Coward]

By capitulating to morons who play WoW on unsecure public networks, Blizzard is creating a precedent for sinking to a level just under the lowest of common denominators. Yes, that's right, you're no longer required to be responsible in your computer usage when gaming; Blizzard will be responsible for you. And everyone else pays for your incompetence.

Blizzard fails.
Run along and die now.

When can I put TWO on the SAME account?

[cfalcon]

I want two or more authenticators, and I want them both to be recognized as valid. For instance, if I were to buy an authenticator and then try to log in, it would look at my username, my password, and then do the calculation based on the key- if it matches, it lets me in. If not, it does not. I would like to check my username, my password, and then calculate all the keys I have tied to the account (perhaps there would be a max of five, or ten). If the input matches ANY of them, it lets me in.

Currently, I don't have an authenticator because I travel all the time and I normally wherever I go, I at least remember to include my brain. Currently I could:

1- Lose an authenticator.
2- Bash it into a wall while tripping over anything.
3- Fall into a fountain- probably it wouldn't get too wet in that time, but hey!
4- Have it stolen- it wouldn't be useful to a thief, but they wouldn't know that.
5- Have the battery be bad or rot.

I've gone through a few cellphones, and a few days with no cellphone can really be bad. I would definitely not want to be on travel for two weeks and be unable to use my fancy laptop to play WoW! Especially given that with a cellphone I can go to any mall and be chatting again in a few hours if it becomes important, but for WoW you have to call up some hotline and identify yourself using whatever secret question I thought would be a great idea 4.5 years ago. The few times I've tested this hotline (granted, not in the last year), I eventually hang up because I'm bored and I can't talk to a human. I would sure hate to be doing that dance for real.

I also don't like the loss of user freedom- currently I can call any of four RL friends up and give said friend my login info if there's something that needs to happen in game, and a few guildies would also probably work. A single authenticator would shut that down unless I was on the phone with them. Blizzard might see this as a feature: according to their extensive ToS, not even your *spouse* is allowed to log into your account.

Outside of the USA/EU

[nzAnon]

In New Zealand for instance.

# Subtotal: $6.50
# Sales Tax: $0.00
# Shipping & Handling: $20.68
# Grand Total: $27.18

Where 27.18 USD = 36.87 NZD

Re:Outside of the USA/EU

[Kalriath]

You should see what they actually ship them in. Tiny little 3cm x 1cm boxes (two of them, Blizzard can't count and sends more than you order) inside a 40cm x 25cm Fedex Worldwide Express pack. It's like they're trying to beat HP's record (good luck - they ship individual mice on pallets).

Finally

[kronchev]

They were already mandatory to anyone with more than 3 brain cells. No matter how careful you are, the chances of you logging in on a compromised machine are just too great. An authenticator removes absolutely any chance of a compromised account.

And for anyone who doesn't want the physical fob, it's quite easy to just load the cell phone based authenticator on a cell phone emulator.

Re:Finally

[kalirion]

They were already mandatory to anyone with more than 3 brain cells.

Do you use online banking? Do you make online purchases? If so, do you use an authenticator for every bank, credit card, mortgage, shopping cart, that you manage online?

I think it's great

[pclminion]

I really don't know why so many have a problem with this. If we can start getting people used to using two-factor authentication in a popular online game, maybe it will be easier to convince them to use it for banking or other personal security reasons. The inconvenience is not that much in comparison to the security you get.

The people worried that it will create a killer culture where people are being assassinated left and right to get their personal authenticators is just total paranoia.

No, No, and No I will NOT use this

[Ka D'Argo]

As I posted on the WoW forums;

I will NOT pay for an authenticator because OTHER people cannot keep their shit protected. Use Firefox, use a firewall, don't download suspicious files, don't visit suspicious websites and use a decent anti virus.

If Blizzard decides to make us ALL pay for the mistakes of a FEW, then when they try to charge me $5 or 6 or whatever, they can cancel my account to at that point.

I can afford the $6.50, it's a matter of principle and integrity at this point, we shouldn't be punished for the actions of others.

Re:No, No, and No I will NOT use this

[PaganRitual]

As I posted on the WoW forums

It definitely reads like a standard WoW forum post.

Re:No, No, and No I will NOT use this

[Macgrrl]

Can I have your stuff?

Re:No, No, and No I will NOT use this

[Genocaust]

Can I have your stuff?

Re:No, No, and No I will NOT use this

[Jedi Alec]

Aww jeez, they do that in WoW as well? Thought it was an EVE thing. Should have known better I guess.

Banks?

[Urza9814]

The authenticators function the same as ones provided by most banks

What? What banks? I've _never_ heard of a bank using these things. My bank just uses account number, pin, and password...

If this comes to pass...

[Godskitchen]

It will certainly make it easier to identify WOW players in the wild as they will all inevitably wear these proudly attached to their keychains. Still, since the majority of this cohort rarely venture out into "the place with no ceiling," perhaps it will only have a limited relevance as a wow-marker in daily life.

Good timing

[wwphx]

I manage two guilds on one server, one each faction. One of our members got hacked. His account got cleaned out to the tune of over 4,000 gold. Both guild vaults got hit, several items and some 430ish gold.

We got everything back.

The only bad thing was it came in the form of an in-game mail message, so lots of arranging of items needs to be done.

The sad thing? The guy who got hacked has an authenticator, just hadn't activated it yet. The curious thing? He doesn't know how he was compromised.

My hack experience and thoughts

[Anonymous Coward]

I previously was hacked. No keylogger no public use. No gold buying. I don't understand the need to buy gold bliZzard has done everything short of click here and get 500 gold a day. It takes an hour tops. Plus play the auction house and your hooked up. Anyways It was more of using an email address now that blizzard requires that is used on other sites and a relatively simple password. Brute force took care of the rest.

I feel I was at fault because of the shared email addy and easy password. But I waited over my week for restoration.

My point is too many people assume it's keyloggers or gold buying (which if someone sends gold to your char how do they know your login?). There is still good old fashion brute force going on.

Also I work for a company that issues rsa securid devices. Granted we don't order the quantity blizzard does but these cost us around us 75 each. Now blizzard is not using rsa (as rsa would require their name on them) but they are customized with software option. I now have the authenticator for iPod touch and it's free. I would argue blizzar makes nothing on them or even takes a loss. It reduces their call center and helps retain customers longer. Easy case to take the loss.

Hardest thing in mandatory is they should wave the fee. To ramp up that kind of production would be difficult but if anyone could do it it is blizzard.

Re:MORE money?

[Anonymous Coward]

Lest anyone think you're insightful or interesting or informative (because your post indicates you are none of these things):

Blizzard is eating the cost of shipping on these inside the US and Europe. They are charging less than $7 for them, which, in addition to the shipping, has got to be pretty near break even. I sourced tokens a couple of years back and we were quoted $10-25 each depending on the supplier.

They are also offering a free version over the iPhone/iPod and for a variety of other devices like Blackberries.

The end result is about 4-5 seconds added to your time to log in, you don't get your account (that you've spent hundreds/thousands of hours on) stolen, and when you do have a legitimate issue in game that requires support there's a better chance someone will be able to help you sooner rather than 3 days from now.

Of course, I suspect based on your post that you don't actually play this game, and probably came in here just to be smug. Is "I won't pay MORE money to play a game I ALREADY paid for" the new "I don't own/watch tv"?

While I'm not sure about the iPhone version, the other versions of the Mobile Authenticator isn't free, it's $0.99 here in Canada atm ( http://mobile.blizzard.com/shared/blizzard_download.php?cont=401&id=2183&title=Battle.net%20Mobile%20Authenticator&country=ca&lang=en ). While that isn't much, add it to the what? Maybe 9 million players who will want it, turns into an cool $9 million dollars. Or am I to believe that the dollar charge is to pay for all the bandwidth I'm going to use to download it? If they just want to make sure it's only to be downloaded by users make them log into their account before downloading. Till then I'm more leaning that a mandatory need for these is just another way of bumping up their profits.

This is a necessary evil.

[Kyokugenryu]

I have only ever accessed my WoW account from my gaming PC, which has Firefox and a hardware firewall. I don't share my account info, and I'm a stickler for having strong passwords. My account was hacked back in November, and everything cleaned out. The only person who knows my credentials are my best friend, and I'm the only person who knows his credentials. He uses a Mac and the same stringent security lengths, and he was ALSO hacked just two days ago. I'm assuming there's a security breach somewhere that Blizzard can't patch up, so this would be a way to fix it. Way, way too many accounts are being compromised as of late. Out of our 30 or so constant raiders, well over half have had account security breaches in the last year. Something's going down at Blizzard, and I for one welcome the mandatory Authenticator.

The problems it will solve

[jonaskoelker]

2008: Oh no, someone who's not me knows my password! I need to call Blizzard!

2011: Oh no, someone who's not me stole my crypto widget! I need to call Blizzard!

Malware keyloggers can steal WoW passwords. They can't steal your other computer. Not even if that computer is called an authenticator and is rather special-purpose.

It's not like people are going to forget their World of WarCrack passwords, they type it every day </snarky> ;)

Use SSL client certificates

[jonaskoelker]

What's wrong with entering a entering a username, the site replying with a challenge token? I then sign the token with my PGP key and access is granted.

If I had it my way, I'd point my browser to ~/.gnupg/pubring.gpg or ~/.ssh/id_rsa.pub or somesuch (or ~/.online-identity/pubkey) and use SSL client certificates. You know, where instead of just the server proving to be who it claims, the client does as well. Then I would have zero-typing logins, securely.

Unfortunately, crypto takes a lot of CPU horsepower. For that reason, most server operators will want to do as little as they can get away with (which is less than what is required for good security), and the uninformed public won't know that it should scream about this. The informed public will scream and cry, but will be derided as lunatics or ignored (as is the case here on /.).

But you're going to need an auxiliary computer (smart card or usb fob or something) to plug into computers that aren't your own (or rather that you shouldn't trust). And you need to be sure that the alien computer can talk to and understand your auxiliary computer.

Will most people want to pay for this? Or will they prefer to use passwords, because they are free, and to hell with the second-order effects, we don't want to think about the consequences of our actions!

What gives Blizzard the right to do that?... Well.

[Petersko]

If you are a player of WoW, You agree to the terms of service. That means you and Blizzard "agreed" you wouldn't share/sell the account.

So, in essence, if you play the game, you, specifically, gave them the right.

Re:Bliz

[Anonymous Coward]

Authenticators are not the problem, blizzards password scheme is.
You are limited to 8 characters two of which must be numbers and at least one non alpha numeric character that is limited to !@.

Blizzard could just add a virtual keyboard and make everyone click the letters and characters of their account password.

My Concern Would be

[sleeponthemic]

That with such quantity, there would likely be now, an introduced percentage of support requests regarding faulty / non working devices. Furthermore, the emails will cease to be kindly worded requests for account reclamation aid from Blizzard and take on the air of (in some cases) "addict rage" as the realisation that the account is locked until the authentication device arrives X days after.

Dear Lord...

[Anonymous Coward]

Thank god I quit this game when I did.

Though it is terrifying to see the number of comments here ACTUALLY SUPPORTING this kind of mood. It really shows the level of obsession that your average MMO player experiences.

I can't believe people are willing to pay BLIZZARD because BLIZZARD can't keep their account information secure. They bring in over 150 million MONTHLY on account fees and they can't afford a decent security scheme?

Re:Dear Lord...

[Macgrrl]

I can't believe people are willing to pay BLIZZARD because BLIZZARD can't keep their account information secure.

In the vast majority of cases the security breach is happening at the client workstation - not Blizzard's servers.

When Blizzard provide a locked down workstation with packet checking of all downloads you can hold them responsible for client security.

Re:Bliz

[Kalriath]

Case insensitive, by the way.

And you're allowed "!" and "@" now? Nice.

Re:What gives Blizzard the right to do that?... We

[Anonymous Coward]

When I bought the game I didn't hand the cashier a signed contract in addition to swiping my credit card as a form of payment.