35 replies to this topic

[Khalija]

Tonight, Mike Lewis has announced that ArenaNet is "making a mobile two-factor authentication solution available for beta testing, effective immediately."

Quote

Mobile two-factor authentication is an alternative means of securing your Guild Wars 2 account, and like e-mail authentication, is optional but strongly encouraged. Rather than sending you an e-mail when unauthorized login attempts occur, the game (or any of our online web sites) will prompt you for a six-digit number any time you log in to a Mobile Authenticator-protected account. Using a freely available app on three major smartphone platforms – iOS, Android, and Windows Phone – you can obtain the correct six-digit number unique to your account. These numbers change every 30 seconds and can only be used once; this ensures that without your mobile device, an attacker would not be able to compromise your Guild Wars 2 account.

Mike reminds the user that this new feature is still considered in beta and are still working on its development.

Quote

We have already identified two major improvements to the feature that we will complete before releasing this system for general use:

• To increase security of your account, unlinking the Mobile Authenticator will require additional six-digit codes.
  
• We will be introducing an option to “remember my current network” so that you will not have to authenticate every login from trusted environments.

[Dove]

<--BlackBerry user

[Orici]

Nice to see this excellent feature coming to gw2

[metalsazz]

<-----Also a blackberry user

[yahikodrg]

I'd rather be able to order a $5 key chain authenticator because if you upgrade phones you have to call customer support to remove the authenticator just to log on to reapply it.

[Jentari]

Give me a key chain authenticator.

[FSnake]

Well, it's about time that Anet is getting serious with online security.  They should have this feature available since go live back in August which would have reduce a lot of the accounts hacking in those early days.  However, better late than never.

Now, where is the iOS tablet app Anet was talking about for GW2 a year ago?

[Azure Skye]

<--- doesn't have a cell phone and uses common sense.

[st0rmie]

yahikodrg, on 10 October 2012 - 09:49 PM, said:

I'd rather be able to order a $5 key chain authenticator because if you upgrade phones you have to call customer support to remove the authenticator just to log on to reapply it.

What? No you don't. You only need to do that if you forget to unlink the authenticator before you sell/trade/return your old phone.

Unlink authenticator using app on old phone; switch phones; re-link using app on new phone.

Certainly it would be nice to have a physical option as well as the iOS/Android/WP7 apps, but this problem you describe is not really a problem.

[HawkofStorms]

So, if you lose/brick your cell phone, you're screwed (since you also need it to decouple your account).

Eh, staying away from this one.

[Reiden221]

It is a move in the right direction based on all the concerns, complaints, and whining from the community, but there are flaws...

- You don't have a cell phone
- You don't have one of the cell phone types mentioned
- Your cell phone breaks/stolen/melts/etc

[ogrejd]

Meh. All this effort to secure accounts when a single, simple, in-game change would wipe out most of the reasons why people would attempt to steal accounts.  Sure, some people who would want to twink out their friends and alt accounts would need to do so by sending items, but most of the goldsellers (ie, the ones stealing accounts) would disappear overnight if it became impossible to directly transfer gold between accounts (some simple monitoring of the Trading Post, which they almost certainly do already, for unusual transactions would get rid of most of the rest).

[lazykoala]

Nice to see the mobile security app almost ready, especially with all the account hacking that initially occurred. Next we need the mobile trading post and general in game app!

[ArlanKels]

And for those of us who don't have cellphones?

[joeobowyer]

the authenticator just to log on to reapply it.

[Xephyr]

aww.. I want a keychain authenticator. :/

[Merryham]

Worked for me! Now I feel secu---- *authenticator hacked*

._.


Seriously though, nice.

[ThiaTheMuse]

<~~~~~ Samsung flip-phone owner. "App? What's that?"

I hope they have a key-chain option when it goes live.

[Lordkrall]

ArenaNet does not have extra authentication - People complain
ArenaNet does enables extra authentication - People complain about them adding the "wrong" kind of autentication.

How come this is more or less what always happens to everything ArenaNet does?

They are not patching enough!
*patch* OMG WHY DID YOU NERF MY PROFESSION!??!?!

I remember a time when people were actually happy when a company did something good.

Edited by Lordkrall, 11 October 2012 - 06:47 AM.

[solariz]

Oh Realy People, the introducing such a great thing ans you complain? Over 60% of the US Population have a smartphone. In EU its over 75%  Those ppl without a capable smartphone are still free to use the email methode.


The Methode of Authentication is damn right and exact the right choice. I know people always complain no matter what you do but really I dont see the point in here. Why should I be forced to spend another $10 for a Authenticator key chain device, this is so yesterday. I have to carry it around and the possibility that I loose this one compared to my beloved Smartphone is rather high.

Thank you Anet this was the right choice!

Edited by solariz, 11 October 2012 - 06:44 AM.

[GotDamned]

HawkofStorms, on 10 October 2012 - 11:05 PM, said:

So, if you lose/brick your cell phone, you're screwed (since you also need it to decouple your account).

Eh, staying away from this one.

Nope, you can use the Authenticator also online afaik. (at least for user with an android phone)

Reiden221, on 10 October 2012 - 11:32 PM, said:

It is a move in the right direction based on all the concerns, complaints, and whining from the community, but there are flaws...

- You don't have a cell phone
- You don't have one of the cell phone types mentioned
- Your cell phone breaks/stolen/melts/etc

Flaws? You don't need to use the authenticator, so you don't necessary need a smartphone.
an extra keychain for a few bugs would be nice, but no reason to complain about the current auth

Lordkrall, on 11 October 2012 - 05:54 AM, said:

ArenaNet does not have extra authentication - People complain
ArenaNet does enables extra authentication - People complain about them adding the "wrong" kind of autentication.

How come this is more or less what always happens to everything ArenaNet does?

They are not patching enough!
*patch* OMG WHY DID YOU NERF MY PROFESSION!??!?!

I remember a time when people were actually happy when a company did something good.

Lol, exactly.
I love that arena decided to give as a mobile authenticator.
I also have never seen anything i'd really complain about.
DR? Read lots about it, never happened to me so i can't judge
Necro-Bugs? Ok, there are a few, but they're fixing them
havn't seen anything gone worse through patches.

solariz, on 11 October 2012 - 06:44 AM, said:

Oh Realy People, the introducing such a great thing ans you complain? Over 60% of the US Population have a smartphone. In EU its over 75%  Those ppl without a capable smartphone are still free to use the email methode.

I live in germany, and i would say, we got about 90% Smartphoneusers (if you just look at the people who play mmo's)

solariz, on 11 October 2012 - 06:44 AM, said:

The Methode of Authentication is damn right and exact the right choice. I know people always complain no matter what you do but really I dont see the point in here. Why should I be forced to spend another $10 for a Authenticator key chain device, this is so yesterday. I have to carry it around and the possibility that I loose this one compared to my beloved Smartphone is rather high.

Thank you Anet this was the right choice!

Right. Sure, as another option, it would be no problem.
But why complain about an optional free authenticator?
Don't complain about not having a physical you need to buy, just ask them about it.
Start a discussion in the forums and ask politely for it.

[solariz]

HawkofStorms, on 10 October 2012 - 11:05 PM, said:

So, if you lose/brick your cell phone, you're screwed (since you also need it to decouple your account).

Eh, staying away from this one.

Well Sir you a totaly uninformed guy. Maybe first inform before complaining?

In Short: To setup your Authenticator you receive a QR Code, just print it and put it in a secure place. So if you loose your phone or whatever you have to lose the QR Code too. With this QR Code you can easy retrain every smartphone. And Still if you lose both, there is a manual way to unlink it over the support by proving several things.

[Belechael]

ArenaNet is not Bioware (thank god for that!), so I expect them to NOT mess things up with this.

However, in SWTOR, my iphone got stolen and I had to call customer service, who kept me online for 10 or so minutes in order to learn from someone at their IT department that it is not possible for me to deauthorize my old authenticator in my stolen phone and authorize a new one. They had to manually do it themselves and they warned me that I could no longer use an authenticator, 'cause the system would try to find the one in my stolen phone.

Now, if you had a different experience than mine in a different game it doesn't invalidate some people's fear that things can become messy. I will wait and read comments about this before I install it on my iphone this time.

[Lordkrall]

Belechael, on 11 October 2012 - 07:42 AM, said:

ArenaNet is not Bioware (thank god for that!), so I expect them to NOT mess things up with this.

However, in SWTOR, my iphone got stolen and I had to call customer service, who kept me online for 10 or so minutes in order to learn from someone at their IT department that it is not possible for me to deauthorize my old authenticator in my stolen phone and authorize a new one. They had to manually do it themselves and they warned me that I could no longer use an authenticator, 'cause the system would try to find the one in my stolen phone.

Now, if you had a different experience than mine in a different game it doesn't invalidate some people's fear that things can become messy. I will wait and read comments about this before I install it on my iphone this time.

Quote

What should I do if I lose or want to unlink the mobile device linked to my account?

Visit Account Recovery to unlink your authenticator. You can also unlink the authenticator at any time by logging in to Account Management and proceeding to the Security section. Please note that to log in while two-factor authentication is configured on your account, you will need to have access to your mobile device.

From https://en.support.g...etail/a_id/9238

[solariz]

Belechael, on 11 October 2012 - 07:42 AM, said:

Now, if you had a different experience than mine in a different game it doesn't invalidate some people's fear that things can become messy. I will wait and read comments about this before I install it on my iphone this time.

As I said, this is a normal Google Authenticator and this is perfect. You receive a page with a QR Code to activate it in the phone. Just save the QR Code local in a safe place and you be good even if your phone explodes, stolen or whatever.

This is the most simple way, no need to rely on a account recovery because you can reactivate it by yourself at anytime. Got no Phone ? Download the Android SDK there is a Android emulator included, perfectly to run the authenticator on your PC. So super simple.

Edited by solariz, 11 October 2012 - 08:18 AM.

[yahikodrg]

st0rmie, on 10 October 2012 - 10:51 PM, said:

What? No you don't. You only need to do that if you forget to unlink the authenticator before you sell/trade/return your old phone.

Unlink authenticator using app on old phone; switch phones; re-link using app on new phone.

Certainly it would be nice to have a physical option as well as the iOS/Android/WP7 apps, but this problem you describe is not really a problem.

its not just upgrades tho, phone getting stolen/lost/broken all cause this problem... upgrading is just the more common. Plus since ArenaNet wants us to play how much we want, quit, then come back. People may forget they had this authenticator attached to their account when they are taking a break from GW2

[solariz]

I just want to add this Good Article I found:


Use Google Authenticator without the Phone


http://www.labnol.or...-desktop/25341/

[ThiaTheMuse]

solariz, on 11 October 2012 - 08:51 AM, said:

I just want to add this Good Article I found:


Use Google Authenticator without the Phone


http://www.labnol.or...-desktop/25341/

Cool! I still hope they have a key chain option, but this looks like it could be pretty handy. Thanks!

[Belechael]

Awesome then, anything for more security.

I'd hate to see something like what is regularly happening in WoW happen to us.

Edited by Belechael, 11 October 2012 - 09:18 AM.

[Tellia]

its a step in the right direction. we can only hope more options become available once they roll out this and iron out the bugs in this app.