Battle.NET account + Blizzard Authenticator + today = fail

[aboron]

ugh, just when i was thinking about farming the headless horseman's mount...

as a point of interest

the keyfob authentication server is most likely separate from WoW's login servers

basically, when you login, the generated number is passed off to the keyfob auth server along with your keyfob serial number for verification

the main login server confirms your password and waits for the authentication response from the keyfob server, if both pass, then it lets you in

the way they had it set up before, the keyfob server would return a "pass" at any time during the 30 seconds when the generated number is valid

what they have now is the keyfob server would forcibly invalidate the key once it is used

the keyfob server technology is likely external proprietary and blizzard would have no direct control over the code

the best we can hope for is probably a "per keyfob serial number" option to turn the forced invalidation on/off

Bliz could also just cache a valid pass on a number from a given keyfob for 50-150 ms to allow the other 1-39 requests that hit right around the same time to clear on it's coat tails.

[mmcookies]

Bliz could also just cache a valid pass on a number from a given keyfob for 50-150 ms to allow the other 1-39 requests that hit right around the same time to clear on it's coat tails.

The reason I mention the per keyfob serial override option is because I know it exists on some keyfob security architectures, therefore possibly requiring almost no extra work and testing on Blizzard's part.

I'm really not sure if the scant multiboxer population would warrant any additional development resources unless you guys can pull some higher-up strings.

[Ghallo]

Wow, I must really be out of it. I've been flirting with the idea of coming back to WoW, but after reading this thread I think I must have missed something. I have no B.Net accounts - do you have to have one now to play WoW? And I don't care about "security" this is a video game, not my stock portfolio. I don't install keyloggers on my computer - I've played since November of 2004 and never had my account hacked - so is it even possible to avoid security garbage like this?

Finally, why doesn't Blizzard just do smart cards with USB smart card readers? You need to insert the smartcard, type a PIN and as long as that card is connected to that PC your account can authenticate. No additional numbers to type etc. MS (and several other large companies) use that method - very secure and much more user friendly.

[Ualaa]

On Nov 11th, you will need to have each wow account associated/merged with a B.Net account in order to log into the game. Prior to the 11th, there is no restriction.

It is free to merge accounts, you just need one valid email per B.Net account you create. Each B.Net account can have up to 8 wow accounts merged into it.

If you don't use the Authenticator, then one or multiple B.Net accounts is the same thing. Enter the B.Net email address (in the place of the wow account name) and then the password.

With an authenticator for increased account security, there are log in issues to be aware of for multiple wow accounts on the same B.Net account.

[Ghallo]

What about moving toons? Why would they put restrictions on moving toons once they are associated with a bnet account?

[Ualaa]

My understanding is that you cannot move toons on to (or off of) a B.Net account for 60 days after merging an account onto it.

Once all the accounts are on a single B.Net account, you can move toons from one account to another very easily and quickly. Moving toons between B.Net accounts will work fine (as it currently does), once you get beyond the 60 day window.

[Slats]

My understanding is that you cannot move toons on to (or off of) a B.Net account for 60 days after merging an account onto it.

Once all the accounts are on a single B.Net account, you can move toons from one account to another very easily and quickly. Moving toons between B.Net accounts will work fine (as it currently does), once you get beyond the 60 day window.

I can confirm all of this is correct and I have done all of it several times. I can also confirm there is an 8 Account Limit for WoW Products per Battle.NEt Account for all you 10 boxers out there.

[Ghallo]

So if I were to move all of my accounts to a BNet, but not get the dongle, I would not be impacted except for changing the account name on the login? How does WoW know which account I am trying to log into?

[Slats]

So if I were to move all of my accounts to a BNet, but not get the dongle, I would not be impacted except for changing the account name on the login? How does WoW know which account I am trying to log into?

This is correct. Once you have multiple accounts the first time you login to the battle.net account and have SAVE ACCOUNT INFORMATION ticked - it will display a popup box and let you pick the old account name you used to use from the list.

Once you login once, next time it will show your e-mail address in the account name box and a small drop down box with the one you used last saved.

[Prepared]

Here's something I noticed today. I log in using my battlenet account name and password for all accounts. I then put it the authenticator code one at a time using a new code for each account.

The first account logs in fine. I let the authenticator refresh and enter the code, it fails to log in. The only way for me to do it is to do the entire login process separately with each account using new authenticator codes. Does that make sense?

Any way, I'm wondering if the issue is not with the authenticators at all, but with the battlenet login. Can anyone without an authenticator, but with battlenet confirm that you can login simultaneously?

I think the problem you're experiencing here is that if the Authenticator Code box remains up too long. Maybe 60 seconds or two minutes, not sure of the exact time, but the password that was previously entered becomes invalid. You have to cancel the authenticator box and re-enter the password and then new authenticator code.

According to the last page of this post made by a WoW player, the change makes sense to stop the keyloggers from getting access to your account with your authenticator code within 60 seconds:
http://forums.worldofwarcraft.com/th...sid=1&pageNo=2

Maybe it is for some other security reason that Blizzard has in place but with a ton of accounts like I have, this battle.net authenticator change really causes me a long time to login now. Apparently the change made with battle.net accounts and the authenticator was made on purpose to stop the keyloggers from gaining access to accounts within 60 seconds. That is, a different code for second login was necessary from the same authenticator to login to the battle.net account. It makes sense to me as this could cut down on support calls to Blizzard when someone loses their account with authenticator access to a keylogger. Multiboxers are in a far less number than the normal 1 account login with battle.net. So it would make sense from Blizzards perspective to reduce unauthorized access at the expense of a small number of players inconvenience.