Authenticator failure revisited, Blizzard responds

Reader Comments (Page 1 of 1)

8-05-2008 @ 4:09PM

Jamesisgreat said...

I don't really know much about keyloggers and the like, though I understand that they record what buttons you press on your keyboard and hence record your password. I was thinking, wouldn't a simpler way around this problem to have an on-screen number pad that you use the mouse to click on to enter, say, a 6 digit security code? That way there would only be mouse clicks to keylog and they wouldn't be of any use to anyone.

I'm sure this has been thought of before and been shot down, but was just curious as to why this wouldn't work?

8-05-2008 @ 4:15PM

Thorn said...

If the keylogger can record your keystrokes, it can record your mouse movements and clicks too. (Of course, then it wouldn't just be a keylogger, but that's just semantics.) But your point is good, since Blizzard could randomize the characters on screen as well, thus making the "mouselogging" largely irrelevant.

8-05-2008 @ 4:16PM

Thorn said...

Bah, I should've read the whole thing before replying. You pretty much said what I said. I'm having a slow-brain day....

8-05-2008 @ 4:57PM

Verit said...

Even if you had a key-logger installed on your machine and it read the one time password off the blizzard authenticator it wouldn't matter because next time its a different password.

Nothing negates physical access though - which it sounds like the person who compromised the account had.

All I could think was there's a gang of burglars running around hacking wow accounts for profit.

Add your comments

Your comments:

Remember me

E-Mail me when someone replies to this comment

Please keep your comments relevant to this blog entry. Email addresses are never displayed, but they are required to confirm your comments.

When you enter your name and email address, you'll be sent a link to confirm your comment, and a password. To leave another comment, just use that password.

To create a live link, simply type the URL (including http://) or email address and we will make it a live link for you. You can put up to 3 URLs in your comments. Line breaks and paragraphs are automatically converted — no need to use <p> or <br /> tags.