/ev/null

Battle.net Authenticator

Account security in massively multi-player games is a big concern. If you play World of Warcraft, you know how often accounts are compromised. In the last 6 months we’ve had our guild bank emptied twice when high-ranking members had their accounts compromised, and a handful of our lesser ranking members have had their hacked characters’ inventory and gear liquidated and traded to, presumably, gold resellers. Blizzard isn’t alone in this problem, of course. Even NCSoft’s Aion, a very recent MMO release, is having major issues with this. Simple truth of the matter is no MMO account is safe from being hacked, phished or brute forced and compromised when all we use is traditional username/password schemes.

However, there is a solution to this; authenticators. Blizzard and Square Enix both sell a hardware key fob solution to secure accounts (in the case of Blizzard, there is a free iPhone app that does the same thing.) Essentially, it adds a second, randomly generated password to your account that changes every ~30 seconds. So, you login with your traditional username/email and password, press the button on your key fob, and enter the code to login to the game or access your account management settings.

If you’re familiar with Paypal’s Security Key program, it’s essentially the same thing.

Obviously, there are great benefits towards using security tokens like these to secure online accounts. Someone could lift your username and password from a phishing scam, but they still couldn’t access any important element of your account without the random token. No two key fobs will generate the same code at the same time, so it’s nearly impossible to brute force. Even a keylogger installed on a player’s computer is rendered useless, unless the hacker is somehow watching your input in real time and enters your token as you do within that 30 second window (not likely.)

Continue reading →