Silly Authenticator Observation #1

Silly Authenticator Observation #1 – I’m only asked to authenticate now when my mobile is at the bottom of a bag or in another room. How does it know?

Yup, its Tuesday maintenance.

Free Windows Authenticator OS

Warning: This app is not sanctioned by Blizzard, or tested in any manner – use at own risk! Blizzard have stated a stance of accepting that it works, but they prefer customers use the real sanctioned tools.

As the app runs on a pc, that app can be compromised as much as any other.

Wandering through the D3 and Blizzard discussions on security, I found a free Windows app which emulates the authenticators. Basically it is the same app as used on the mobile devices, except it is Windows software. And it is open source, currently v1.7.1314 and appears to be updated regularly.

Refs:

• Blizzard’s Official Stance (http://eu.battle.net/wow/en/forum/topic/2569217651#5)
• Comment in D3 forums by author of the application (http://us.battle.net/d3/en/forum/topic/5150113315#2)
• Promo for it in the forums (http://us.battle.net/d3/en/forum/topic/5730074075)

Wow, a pretty impressive give away of a useful function!

WinAuth uses the same algorithm as the Mobile Authenticator for Android and iPhone, and so generates the same codes when using the same serial number and secret key. One of the initial reasons to write it was to remove the dependency on having the phone available, but still use the same codes.

Whilst you cannot directly read the Mobile Authenticator’s private keys from an iPhone or non-rooted Android, you can now use the new Restore feature to copy your authenticator over to WinAuth.

Impressive, and now even less excuse not to have an additional line of account security for Blizzard games.

Real$AH WTB Authenticator

Apparently the Real Money Auction House will be up for play tomorrow, and restricted to people who have authenticators. Shucks, I think that is good news.

Why? – Well security, and knowing that the cash transaction is far more likely to be the real people involved, not a hacker exploiting. The only barrier I can see if those people who cannot afford or desire either a dongle authenticator, or a mobile device authenticator, and I seriously think that if you are willing to risk your game account by not using the almost free tools then you are not really invested in the game(s) at all.

Wanted: Account Setting Lockout – I still won’t be using the real money AH though, my real money is far too valuable to see being spent on golden pixels, and I have not interest in selling gear for cash. I would like an account setting in the Battle.Net profile to block all Real Money AH type transactions. This way even if my account is compromised, the hacker needs to make a setting change, and kids and partners cannot buy/sell “by mistake“.

FYI Authenticator change already applied

If you’re wondering why you were not asked for your Authenticator on login, the game now looks to see if the IP and Etc are all typical, and if so – does not ask.

I freaked a little, as I thought it was being applied with patch 4.2. and almost expected to see my toons naked.

Less WoW Account Security Flaws

So WoW’s account security got a shot in the arm today, with the forums requiring the authenticator.

Isn’t this more of a “sorry it took so long” situation? This was so bloody obvious that it surprises me that it has taken till now. Maybe there were technical reasons why this could not be done, and as a consumer I do not appreciate the work involved. Maybe.

But maybe it is also not unreasonable to expect this level of forethought when a feature like the authenticator is introduced, and expect a change to the systems we use within a good timeframe. Say less than two years after the press release.

I think the change was implemented to help slow down account hacking. If you think about it the forums are the perfect place to brute force attack a username/password combination; as its a web based delivery system that has to be tollerant to many different interfaces, and has been around a very long time. That means it was probably installed to be a basic solution, and became the juggernaut before anyone really saw what was happening.

The follow-up question is why now rather than later or much earlier; and only Activision-Blizzard could tell you that; the cynics will say its because hacks cost too much (meh), but it could also be that it will be a legitimate and substantial improvement to the forums systems, that has been planned for a while. If the changes for RealID were being planned, it stands to reason that this was part of it.

So yes, it is a very good move, and something that has been asked for a long time.

Update 8 Aug 2010:

Further to the account security, the WoW login screen now recommends some security measures, like letter and numbers – but still fails on the upper or lower case for those characters.

Authenticate iPhone or Keyring, not both.

There is much rejoicing about the iPhone based authentication recently released, and why not? Its a free version of the keychain. I said previously:

This little app has the potential to help every one of the millions of Blizzard clients, and if done well will help change our expectation of online services.

But they’ve got it 90% right. I tested the sign-up process and have found two things that I don’t like.

Software authenticator announced

A software based authenticator for mobile devices has been announced. Good god, that is an interesting idea!

I think the employee who thought this up, or even the team who wanted it should be taken out to lunch. Somewhere nice too, with white tablecloth. This little app has the potential to help every one of the millions of Blizzard clients, and if done well will help change our expectation of online services.

• Can you reverse engineer a iPhone/mobile/whatever app? Probably, but how hard. Does the delivery to so many platforms make it easier to get security flaws, as there are so many difefrent platforms?
• Connection only needed the first time it runs, to setup the account link. Obvious, but important.
• I wonder if I can put in the serial of my physical keychain, and then use my iPhone for authentication. This way I have two devices linking to my account. Why? So that if my iPhone crashes, or I drop my keychain into the toilet by accident I can still play wow.
• It won’t be free (nothing good is) but hopefully its no more expensive that the keychain model.

This is also a great sign of what online games, apps, links, and services all over the place should be doing if the proport to have “high security”. 10/10, but it remians to be seen if its safe. The early adopters will be taking a few risks, so I’ll stay with the keychain till after the first few rounds of release.

ps. I wonder if the Apple App Store will give the Devs grief to get the app approved. Afterall you can talk about rude things while playing the game….

Authenticator arrived

The postie delivered the batch of authenticators today, and I’ve hooked up my account, and logged in. I must say its a good feeling to think that the extra layer of protection is there, and I can see why folks were so keen for these. The odds of getting hacked now has to be so much lower. By a major factorial reduction.

It was easy to add to the account, and easy to use when logging in. 10pts Blizzard, you win the round.

…where did I put my keys?

Authenticator Postage Update

The postage fees for shipping to Australia have been decreased significantly (down to $20 USD), and I have ordered 3x authenticators. We’ll see in the next week or so how fast they arrive, and if its worth it.

I ordered 3 as I expect to offload the two spare units to people in Adelaide. Now waiting for the postie.

Also check out: PvE Raid based Arenas, and MMO Champion’s Raid Composition tool. Good distractiosn from whatever you’re supposed to be doing.

Authenticator for sale in AU, LOL!

Got a comment from Cynra letting me know that Blizzard is now selling Authenticators to Aussies. I was ecstatic and signed up straight away.

– Blizzard Authenticator: $6.50
– Postage and handling: $77.81
– Overall cost: $84.31
– Feeling that you get: Ripoff.

What a total joke! I honestly had to look at the screen a few times to make sure I wasn’t being dumb. Then I took a look through the website for justification of price, or different shipping options….nothing.

Shipping an item to Australia does not cost $77.81, and they need to take a very good look at theselves. This is one of my first very bad experiences with Blizzard as a company, and I intend to make a stink about it.

They can take the delivery fee and post it to hell. Talk to me when you have a system that is not totally arse-backward.

Update

• Ebay postage to Australia is $22