Any of You Get One of These?

[Solon]

I would have one except Blizzard wont ship to a PO Box, and where I live I have no other option. The post office does not deliver to my address, and things addressed to my street get RtS. Free post office box FtL. ;(

[Skuggomann]

i just make my password my zip code and then never let anyone know my address. that way i know both me and my account are always safe.

If some one finds out his pasword, send it to me so i know where he lives and can pay him and his family a "visit"

[entoptic]

SWEET more junk for the landfilll. Put your ipods and iphones in that pile as well.

[Vyndree]

Plus, well, it is illegal to put them in the trash or take them to a landfill (computers, monitors, televisions, and cell phones).

Get off your high horse. Not everyone contributes to landfills.

IMO, if you don't use green transit and recycle yourself, you have no business criticizing others. In fact, let's just cut the crud and shorten it to "you have no business criticizing others". Lead by example -- say "Hey, guys... When you're done with your authenticators, remember to recycle them!". Much more appropriate than "You all suck because I used psychic powers to determine that all of your authenticators are going to be landfill trash in some 3rd world country so I have the right to judge you all for something that I have no proof that you did or will do".

The latter is forum troll behavior.

[bigp3rm]

Wow what happened in here?

[Ken]

I don't trust the authenticator, because by using it the weakest element becomes the Blizzard helpdesk:
http://www.wowinsider.com/2008/07/24...users-permiss/
http://www.wowinsider.com/2008/08/05...ard-responds/4
.. and from experience, I never trust helpdesks :)

[Naylix]

Ken:

You don't trust the authenticater, because the weakest element "becomes" the Blizzard helpdesk ?

I believe that logic is flawed, the Blizzard helpdesk doesn't become weaker, it is as it has always been. Authenticator or no authenticator.

And if you read Belfaire's comments directly in the associated threads, you will find that: The authenticator was never removed from the account in question, the password was changed on the account by a person calling helpdesk and providing personal information AND the serialnumber from the Authenticator, and that the account most likely was accessed by someone other than the account-holder. Only the last bit is a little vague, but that is understandable.

You don't weaken a chain by adding a stronger link. The chain is the same as before. However, now you can be fairly certain the chain won't break where you added the stronger link.

/Naylix

[Ken]

Ken:

You don't trust the authenticater, because the weakest element "becomes" the Blizzard helpdesk ?
I believe that logic is flawed, the Blizzard helpdesk doesn't become weaker, it is as it has always been. Authenticator or no authenticator.

Now there is another bit of information that someone could get his hands on, to make the helpdesk believe you're the owner of an account.

And if you read Belfaire's comments directly in the associated threads, you will find that: The authenticator was never removed from the account in question, the password was changed on the account by a person calling helpdesk and providing personal information AND the serialnumber from the Authenticator, and that the account most likely was accessed by someone other than the account-holder. Only the last bit is a little vague, but that is understandable.

You don't weaken a chain by adding a stronger link. The chain is the same as before. However, now you can be fairly certain the chain won't break where you added the stronger link.

/Naylix

This is the only thing that matters to me related to this issue: someone found another means of breaking through *a* security level and these means were assisted by the authenticator.

"the password was changed on the account by a person calling helpdesk and providing personal information AND the serialnumber from the Authenticator"

If a system is compromised (e.g. by a keylogger), it 's easy to get the Authenticator information. You enter the serial number of the authenticator to register it, so this information could be logged by an external program. The only benefit is that you only have to do this once and don't enter it every time you log in.
In fact, if a system is compromised, it wouldn't be difficult to just inject webpages into the browser(that look like the blizzard account pages) to ask the user to re-enter his serial number, just like they do with bank account hi-jacking.
If you have an idea of how social engineering works(or just know how to look for info on the internet), you will understand how it is not that difficult to find personal information.

[edit] In the end, the validator adds 'some kind' of indirect protection, since you don't have to re-enter your password constantly, but it also adds another piece of information (its serial) that someone could get just as easily as a password.

[Tynk]

if people are still falling for phishing email scams I think you can see the logical fallacy[/url].

Just to supply some further information, while training is one of, if not the most important factories when it comes to security of any type, Mac's do have some advantage over windows specifically in training the users.

Windows has always been about ease of use over security, in doing so they have allowed the third party programmers to get away with a lot of sloppy coding. The habit had been to just access anything they wanted at any time, hence the reason so many people just ran as local administrator. So their applications would work.
With this happening users were never given notice when stuff was installed, this is bad. With Vista came a couple changes, first the default user is no longer the local admin. Second, any time an application requests access to something that requires admin rights, the UAC will alert the user and give them a two button press to choose. The problem here lies with so many applications living in the days of being able to do anything they want that everything asks for permission. This desensatizes the user who no longer cars, they just want their system to work.
OSX works a little differently, here the first thing has always been to create a non-admin account to be used on the system. Applications have never had free reign to do what they want, so they work within their allowed access. So their applications would work. OSX has always had a UAC style functionality, but again it only activates when something requiring admin privlages requests access. This is a LOT less frequently because applications are simply not allowed free reign to the system. In addition to this when access is requested, it does ask for the full admin password, this keeps others from installing malicious software on your system, and makes you at least give a second thought to what you are doing.

With all this in mind, I am not saying OSX is better because the software has no holes, I am saying that it has been integral in conditioning both the programers and users int a better focus on security. Windows has always forgone security for ease of use.

[Ken]

@ Tynk:
Another benefit for OS X users is that there are a lot less virusses/trojans/keyloggers made for that OS.