Battle.NET account + Blizzard Authenticator + today = fail

[Svpernova09]

Pushing the button just causes the Display to turn on, the code that is displayed is an encription of the Time of Day (likely rounded to 30 sec) and the Fob serial number.



I suspect it is the Time of Day tracking on the Server side that is issue. When the servers decript the code they get the Time of Day on your Fob. On the Servers they are keeping up with the drift from real time for each Fob on each account in their system, other wise your FOB would stop working when the internal clock drifted too far off real time.

I am thinking that when you log into one Battle.NET account 5 times, it does not like five different FOB time of Day updates in a row with the same TOD, and rejects them. The drift calculation may not like Zero time difference from the last log on. Where as when the accounts were seperate they got a single FOB time of Day Update on each account accross your Five acounts, and then they where keeping up a seperate Drift calculation on each account.

You could be right, but the issue here is this WAS working. Something broke, or someone changed something to no longer allow this.

[Vecter]

A co-worked (and part-time dual-boxer) wondered if you could use one keyfob with multiple bnet accounts. I'm curious about that as well. Maybe it wouldn't cause this issue since you would be logging into 5 seperate Bnets at the same time.

Food for thought.

So have any of you 10boxers (with 2+ Bnet accts) able to use the same Keyfob?

Prior to yesterday yes I was able to use 1 keyfob for 2 different Bnet accounts, even logging in at the same time.

[Ess]

double post never mind me.

[Phanes]

Prior to yesterday yes I was able to use 1 keyfob for 2 different Bnet accounts, even logging in at the same time.

Vecter are you saying it no longer works? Or are you just saying that last time you were on which was a few days ago it was working.

Cause if that works I will just merge each of my accounts to one b.net account each and just log them in like that.

[Khatovar]

A co-worked (and part-time dual-boxer) wondered if you could use one keyfob with multiple bnet accounts. I'm curious about that as well. Maybe it wouldn't cause this issue since you would be logging into 5 seperate Bnets at the same time.

Food for thought.

So have any of you 10boxers (with 2+ Bnet accts) able to use the same Keyfob?

I have 5 accounts under my own Bnet setup. My husband has his 5 accounts under his own Bnet setup. We didn't move them the Bnet accounts until this past Monday. When we created the individual accounts, we put them all under the same authenticator. They still use the same authenticator now, so yes, separate bnet accounts can use the same authenticator.

As to whether or not the separate Bnet accounts will jiggle around this new annoyance, I couldn't tell you, though.

[Dor]

had 2 guildies that use auth get "hacked" over the last 2 weeks... thought it was a fluke, but maybe the loggers/hackers have found a way to quick log into someones accts now and blizz stopped that from happening? just a guess

[moosejaw]

had 2 guildies that use auth get "hacked" over the last 2 weeks... thought it was a fluke, but maybe the loggers/hackers have found a way to quick log into someones accts now and blizz stopped that from happening? just a guess

O.o

Details are needed. This is very interesting.

[Dor]

http://forums.worldofwarcraft.com/th...317391&sid=1#8
http://forums.worldofwarcraft.com/th...sid=1&pageNo=1



just did a quick search on forums found these 2 posts also

in that second link this was posted (not by a blue) ...might be the reason it was changed:

I'm an IT professional and the VASCO system used by Blizzard is slightly more vulnerable than the RSA SecurID system used by most corporations and financial entities... or the problem lies in how they have it configured.

When using my authenticator I can login twice using the same OTP (one time passcode) from the token. This is bad because in that 60 second window that token is valid for someone could login to your account IF and only IF they intercept the token code AND use it within the 60 second time frame it's valid for.

Most businesses have this feature disabled to prevent the security breach- IE as soon as the OTP is used you can't login again until it changes to the next code in however many seconds you have remaining.

It'd be really great if someone from Blizz could comment on if this was intended with your deployment .

[Tonuss]

"I'm an IT professional and the VASCO system used by Blizzard is slightly more vulnerable than the RSA SecurID system used by most corporations and financial entities... or the problem lies in how they have it configured."

This attitude drives me crazy. I understand that Blizzard's login security isn't as good as that of my bank, or my job. I can live with that. Having my WOW account(s) hacked would suck, but my concern would be with my WOW account(s) and nothing more. I wouldn't even be in a hurry to recover them, to be honest. Having my bank info hacked could be disastrous and could affect a lot more than just the bank account. It could affect my finances, which are a hell of a lot more important than a video game. Having the servers at work hacked could be disastrous. It could cost my company millions of dollars in damages over the long term, and could cost me my job.

I do not need for Blizzard's login security to be as good as that of "most corporations and financial entities." They are two completely different levels of importance for people. It's like complaining that your XBOX isn't built to the same safety standards as your car. If having your WOW account hacked is as bad for you as having your bank info stolen, then you are either too young to have any money or you seriously need to get your priorities in order.

I can live with the annoyance of having to log in five separate times for that same reason-- it's a video game. And an extra two minutes, while a pain in the ass, won't kill me. And if it turns out that Blizzard did this because thefts of authenticator-enabled accounts had risen to an alarming level, I'm cool with it. But if it was changed because some idiot wants world-class security for his fucking MMO fix because his self esteem is tied to the fact that he's top 5 in DPS on his PuG raids... that's just really retarded. It's stupid.

[moosejaw]

If its an American car, the XBOX is probably built better....

Zing!

10 characters....