Blizz WTF !!!!!!

[Bollwerk]

At this point, paying without some type of authenticator (if the option is available in your country) is simply foolish, IMHO. Especially now that they have the toll-free phone option (which I'm now using and love).

[ebony]

they can find out if you was hacked.

Then they give you accont char/gear back and some gold or even give you the "care pack" as you did not have the tocken on but sounds like you more peaed about the pets that you get back if they give you acconts back that you sould.

[Ñightsham]

Accounts are being hacked everyday, it just make good sense to purchase an authenticator. (or get one free for your phone/pda device) My account got hacked earlier in the year (I was fortunate to be alerted within just 5 hrs via email) Within a few days, got all my items/gold returned)

First thing I did after getting my toons back was get an authenticator, then I set up a totally separate email account for use with Blizzard (not used for any other communications)

Been fine ever since

[Sbrowne55]

Sadly, like myself we all seemed to have undergone being hacked before buying an authenticator... Those CS reps must hate us.

[Tonuss]

Not exactly 'fool proof'. Enough 'tools' out there that turn your computer into a proxy. That is with regards to the 'ip changing' of course, I don't comment on the authenticator part.

The authentication is what makes it foolproof*, or at least as useful as the keyring authenticator. If you try to log in from a new IP, you have to call them from the phone number that you registered the service with and provide two numbers- a four digit PIN that you created when you signed up for the service, and a random number shown on the screen.

As someone else stated, the best part about using this service is that you can log in all of your accounts at once again. I no longer have to spend five minutes entering separate authenticator codes. Hallelujah...

* I hate to use the term foolproof, as it implies that it's impossible to get around it, and time and experience show us that people find ways around anything. But for securing your WOW account, the authentication options at least make it so that your account becomes more trouble to hack than it is worth, IMO.

[kate]

The authentication is what makes it foolproof*, or at least as useful as the keyring authenticator. If you try to log in from a new IP, you have to call them from the phone number that you registered the service with and provide two numbers- a four digit PIN that you created when you signed up for the service, and a random number shown on the screen.

As someone else stated, the best part about using this service is that you can log in all of your accounts at once again. I no longer have to spend five minutes entering separate authenticator codes. Hallelujah...

* I hate to use the term foolproof, as it implies that it's impossible to get around it, and time and experience show us that people find ways around anything. But for securing your WOW account, the authentication options at least make it so that your account becomes more trouble to hack than it is worth, IMO.

What they're saying is that someone can fake the IP address of your computer when doing a login - it won't seem to Blizzard like it's coming from a different IP address so they won't trigger the authentication call-in procedure. If someone can log your keystrokes, it's not difficult for them to get your IP address and then fake it.

The keychain fobs are, IMO, the best bet - if someone finds a way to hack those they won't waste their time on WoW accounts, they'll just hack bank accounts (my bank issued me a fob when I signed up for online banking).

[Tonuss]

What they're saying is that someone can fake the IP address of your computer when doing a login - it won't seem to Blizzard like it's coming from a different IP address so they won't trigger the authentication call-in procedure. If someone can log your keystrokes, it's not difficult for them to get your IP address and then fake it.

Ah, I understand now. I'm wondering if that is possible, though, or at least easy enough for your garden-variety gold farmer or account thief to pull off.

[Fef]

Sadly, like myself we all seemed to have undergone being hacked before buying an authenticator...

Been there ... done that ...

[Ualaa]

I've got five addresses, made specifically for the authenticator.
Don't use them for anything else, and once I've set them up have never even logged into them.

Running Firefox with Noscript, etc.

Not 100% secure, but fairly happy with the security.



I'm really interested in the phone based authenticator.
That will get rid of the need to even enter an authentication number to log in, which is one less hassle.

And if anyone tries to log in, not from my location, they cannot do so.

I think that is likely stronger security.
People have been key logged, and had their authenticator code intercepted.
It is rare, but good luck finding then breaking into my house, to log into my wow account.

Definitely looking forward to the phone based authentication.

[Noids]

I agree the phone in authenticator is open to hijacking through means of proxy. It seems the only advantage of this over the keychain/iphone authenticator is ease of use though. It would be nice if they could make it so that a single authenticator code worked across all accounts on the one battlenet account if used within a minute of each other or some such. It is really only having to wait for 5 unique numbers to come up which slows down log ing with these authenticators.