WoW Auth (and other crap)

[Chickensoup23]

So for the first time in a few weeks I log into WoW.

It didn't ask me for my authenticator. I read somewhere in the blue posts that sometime in the future they would implement a feature where your auth code is not asked when logging in to the same computer over and over again with a Bnet account. The only thing I played before is SC2, it asked me, then I never got asked again in any other blizzard game.

Should I worry, or it's normal and the feature got implemented?

[BicycleMafioso]

I was quite surprised as well, but ayako assured me that they had already implemented the thingymajingie you mentioned.

[Chickensoup23]

I was quite surprised as well, but ayako assured me that they had already implemented the thingymajingie you mentioned.

Sick. Well, thank you

[Mass0wnage]

Just an FYI it will at random times ask you for your authenticator. So make sure you keep it handy. I log in from 1 PC ever, and since they implemented this I have been asked twice.

[Fuzzykins]

Took mine off and changed my password. Took way too long to log in and out of Starcraft. x3

[Deleted]

im asked nearly everytime, because i change my ip a few times a day, for several reasons .

so it has something to do with your ip for sure.

[Djinni]

im asked nearly everytime, because i change my ip a few times a day, for several reasons .

so it has something to do with your ip for sure.

Yeah? Becuase that's how they track weather you're logging in from the same location all the time. You have the same IP 8-)

[Chickensoup23]

Yeah? Becuase that's how they track weather you're logging in from the same location all the time. You have the same IP 8-)

They said it would be based on much more than simply the IP, cuz "Its so hard to fake one, right?"

You get what I mean. And I do hope they ask me at random times. I know it still asks me every time on b.net. Idk, there should be an option to ask everytime. I'd feel more secure, for some reasons.

[Djinni]

They said it would be based on much more than simply the IP, cuz "Its so hard to fake one, right?"

You get what I mean. And I do hope they ask me at random times. I know it still asks me every time on b.net. Idk, there should be an option to ask everytime. I'd feel more secure, for some reasons.

I haven't really read up about it too much, becuase I can't even play WoW at the moment.

But my guess would be its based on IP + GeoLocation.

To explain: An IP doesn't always point to the same GeoLocation, So for example, one day your IP could point to a Server in China, the next it could point to a 10yr olds computer in America. (Not typical, but i'm using extreames as examples) Coupling the IP with GeoLocation would tell you that the destination of the IP has moved, in this case changed countries. Therefore you would be prompted for an Authenticator code even if you did have the same IP. Conversely if you're in 1 Location, and your IP changes you therefore have a different logical location, so you would again be prompted for an authenticator code.

If however as with most 24/7 broadband "always on" setups your IP will typically only change maybe once a month, maybe every fortnight. Thus you would be prompted that often.

---This is what I suspect happens, as this is the easiest way (as far as I know) to implement such a security measure.---

To sum up:
Location unchanged, IP unchanged: No prompt
Location changed, IP unchanged: Prompt
Location unchanged, IP changed: Prompt
Location changed, IP changed: Prompt

It is "possible" although unlikely that the MAC address could be used instead of the IP address. (Before you cough becuase your MAC address is only used locally, it doesn't mean an external source can't request it.)

[Djinni]

That's not how IP addressing works. ISPs have address blocks from which they give out addresses to their customers. In reality IPs will strongly indicate geographic locations. Second, there's no magic way of doing "GeoLocation" if all your server sees is an incoming TCP connection from a WoW client.

I did point out that that was an extreame example, and CAN happen, I didn't say it does happen. (at least not on a regular basis for the average user)

[BicycleMafioso]

So! Who likes pies?!

[Chickensoup23]

To sum up:
Location unchanged, IP unchanged: No prompt
Location changed, IP unchanged: Prompt
Location unchanged, IP changed: Prompt
Location changed, IP changed: Prompt

This would be the best way to describe it, but there are probably even other factors (so assume the list is even longer).

[xotrem]

Yeah, most home internet has changing IP addresses, so every so often you will have to put it in. Since that change I have had to put in the authenticator code once. Also, I think it puts some code on your pc as a secondary recognition thing, so if something happens there it could prompt the request also.

[Djinni]

And I'm saying that it cannot happen. In fact, the whole global routing system is based on the assumption that it does not happen.

Lol... its really not.

if you think otherwise though, you're welcome to prove me wrong.

[Chickensoup23]

Lol... its really not.

if you think otherwise though, you're welcome to prove me wrong.

K guys, shhh here. Stay on topic :|

[Drunkenvalley]

Likelihood is that WoW establishes an IP and computer "challenge". If both of those are correct then there's no longer a need to further verify is the idea, ergo no authenticator.

Better than Steam and Rift certainly. Keep getting asked to check my email with those...

[Drunkenvalley]

Hide yo comp, hide yo WoW, dem girlfriends be in town?

[Djinni]

There's not much point in checking the IP if you have a "challenge" mechanism. What I don't like about this change is that it no longer protects me against people that have physical access to my computer. My girlfriend can now log into my WoW account when I'm at work, whereas previously she couldn't since the authenticator is in my phone which is in my pocket.

Firstly, if you don't trust your girlfriend with your virtual goods, why does she have your password?
Secondly, this is what Parental Controls are for,
Thirdly, Blizzard isn't likely to change this becuase they don't see it as a problem, due to said parental controls which is the only reason in their eyes there would be one person paying for the account and someone else using it. Otherwise this is deemed as Account Shareing.

[Djinni]

Never lived with a girl, have you? They have means of finding out your passwords...

Yeah I have, I just never had a problem with her using my machine 8-)

Parental controls are not for this. I would have to use them to block all access every time I leave the house and then disable them when I get back. Compared to that entering an authenticator code every time I log in sounds very easy.

You work pretty much set hours right ? so you set the parental controls for those hours....

[BicycleMafioso]

Never lived with a girl, have you? They have means of finding out your passwords...

*snorts with laughter* Girlfriends and boyfriends in particular.
How the hell does one manage to have the patience to solve my (then)password without a keylogger? D: The password being //dr5uw!=gZrb4d/
I'm still impressed.