Breakfast Topic: Why Blizzard should make authenticators mandatory on Battle.net accounts

Blizzard can make authenticators a mandatory feature on all Battle.net accounts.
There are many pros and cons such a move would bring about. Let's examine the cons first since everyone likes to complain about stuff. The largest con would be that people would be required to have a physical piece of equipment specific to WoW and other Blizzard games. Some people would obviously not be okay with this and cancel their subscription, and others would not understand how to push a button and punch in numbers (I'm not kidding). There would be a large cry from people around the net, particularly people who enjoy scamming others out of gold and their accounts, but those are easily enough ignored.
Blizzard could get around these negatives by simply giving away authenticators to everyone who doesn't have one -- make it part of the $15/month subscription. You have a subscription, you get an authenticator to keep no matter how long or short your subscription lasts. For those that don't have a subscription of some sorts or are playing on a trial account – you play on a separate server that is jailed from the rest of the servers. It would be a large one time buy on the part of Blizzard for all its customers, but it would be worth it in the returns of lessened customer service (all those GMs don't have to deal with "OMG my accounts been haxors!" emails).
And really, seeing a little authenticator in every WoW box on store shelves would send a clear and unmistakably loud signal to the rest of the gaming industry -- your products need to be secure. You need to keep your customer's accounts safe, and this needs to be a top priority.
Some might say that another con is the hardware and software required to service millions upon millions of players -- however such hardware is already in place in banks and government agencies. Your authenticator is little different than what they use, and the backend serves are even similar.
Now for the pros -- we've already outlined two major ones; leading the gaming industry and decreasing GM work load. In particular these days the amount of work GMs are doing has clearly become more than Blizzard can currently handle. Tickets are in queues for days right now, and you're one in a million if you actually get to talk to a GM in any reasonable amount of time.
Another added pro to this idea is that the amount of gold selling and account selling would drop dramatically. I don't have much fear of giving virtual items away when it comes down to it, even my whole account if I were so inclined (note: read carefully, I am in no way supporting account selling). But I do have a big problem with sending someone an authenticator I don't know -- and I sure as hell would never give my address to some random guy that owns a WoW account I want to buy.
Creepy guy living in his mom's basement can give me all the gold and accounts he wants. But touch something he's touched? Yuck, no thanks.
Of course this is only a 50,000 ft. overview of the situation, and there are a lot of details that would have to be worked out. But it's something that I hope Blizzard seriously considers. Use this opportunity to make WoW and all the Blizzard properties the safest and most secure form of virtual interactive entertainment out there.
What do you think? Would you be okay with Blizzard making authenticators mandatory?
Filed under: Analysis / Opinion, Breakfast Topics, Account Security
Patch 5.3 interview with Ghostcrawler
Mystery of the Unborn Val'kyr
The latest patch 5.3 news
All of the latest Mists of Pandaria news





Reader Comments (Page 2 of 15)
Darias.Perenolde Sep 12th 2009 9:28AM
*If* it were enforced, I think this would be the way to do it.
However, I don't want it to be enforced. I properly keep track of my passwords. I don't share my account. I don't visit sites like www.honduranmonkeyse.cx either.
I don't want to *have* to have an authenticator on hand at all times just to log in.
Angusailde Sep 12th 2009 11:36AM
That's a good idea. I just recently ordered one just to be safe, but including them in the cost of Cataclysm would assuage some of the complaints about it (and the inevitable complaint about the cost of the expansion itself). Plus, I'd much rather have a Cataclysm themed authenticator than the SC2 themed one I will be getting in the mail.
MountainLynx Sep 12th 2009 11:30AM
@Darias
I agree with you, and take most of the same security precautions, however I was still hacked a couple of months ago. It turns out one of my addons included a keylogger, and that slipped by the folks over at Curse.com. Think you're safe? Think again.
I wholeheartedly support the idea of mandatory authenticators bundled in a future expansion.
daan.leijen Sep 12th 2009 11:37AM
@Darias:
While i would've agreed with you 2 months ago, i got hacked in the meantime, there was a keylogger in the TomTom addon for QuestHelper i downloaded from curse. It took blizz 1 week to restore gear to my druid alt and another week before they gave me back my deleted death knight main, without him having any enchants on his gear and my maxed JC & Mining both reset to 1. That was a true pain to restore afterwards. A authenticator would've kept my account secure.
K Sep 12th 2009 12:36PM
And the places like the country where I live in would be fucked.
We aren't even on the map, I can't use half the options in my wow account (Resurrection scroll, recruit a friend). This would be a NIGHTMARE for us.
K Sep 12th 2009 12:38PM
Sorry, you are free to downrate me, I didn't mean to reply to this message...
A bundled authenticator would be awesome.
mrdonut125 Sep 12th 2009 12:54PM
daan.leijen
You can not get key logged through an addon. In order to be key logged through an addon you have to manually run a file in the addon you downloaded over the internet. Chances are you didn't actually download it through TomTom, or if you did, you ran an exe file yourself.
Yakuko Sep 12th 2009 12:59PM
@MountainLynx: You cannot get keylogged by an addon. Addons are run sandboxed in WoW and their syntax doesn't even allow for that type of functionality to begin with. Only way for an "addon" to keylog you is if you download an exe from some shady site. Please educate yourself before spouting nonesense about addons and Curse. You were probably keylogged because you use Internet Explorer or don't use Adblock/NoScript and got infected by a compromised ad or went somewhere you shouldn't have.
Zeplar Sep 12th 2009 1:19PM
Daan speaks truth.
Bundle it with Cataclysm, then you have an easy way to get it OUT to the end-game people (without, what, shipping it?), you only spend money on the people WITH large amounts of gold who will get hacked, and people who have spent $100 on WoW expansions plus monthly fees for years, aren't probably going to quit over a mandatory authenticator.
I've never been hacked, don't really like the idea of peering at a tiny screen for numbers whenever I log in... but if it really makes the GM queue times go down, I'm all for it.
daan.leijen Sep 12th 2009 1:21PM
@ Mrdonut125:
I ran a spybot detection after i got hacked, both panda and Spybot S&D only found one spybot in my entire system: in the Questhelper folder were TomTom was located. Mind you i installed both QuestHelper and TomTom using the curse client (the free version), So i can't think of another location it could've been, except if both Panda and Sybot S&D didn't know the coding.
MazokuRanma Sep 12th 2009 4:29PM
There is one solution for all these people claiming they are teh invinciblez and can never be hacked: Just allow for people to turn off the authenticator option, but in so doing you forfeit your right to GM support for a hacked account.
Problem solved. Now you don't need your authenticator, but if you get hacked, you're screwed and no one will be obliged to feel any sympathy for you because you intentionally reduced your own level of account security.
I for one am quite happy to have my authenticator. $6 to protect an investment of $15 a month, plus whatever value you place on the time you play is well worth it to me. I would hope that if it's mandatory with Cataclysm that they do offer a version without the authenticator cost factored in for those who already have one though.
Rollo Sep 12th 2009 9:53PM
Daan, addons are not executable files, they are only instructions for the limited lua interpreter embedded in wow. This interpreter cannot listen to your keyboard and it cannot communicate any information to a third party.
If you were hacked, it was not through the addon, although there might have been a malicious executable file in the addon directory (an "installer" or "updater" perhaps.)
Daniel Sep 12th 2009 8:26AM
I just got hacked this morning. So yes I would fully support this. If only I bought one sooner.
Knob Sep 12th 2009 8:57AM
You didn't get hacked, you got keylogged. As one of the people on the forums once said, "Hacking implies intelligence on part of the attacker, getting keylogged implies the lack thereof on part of the victim."
Daniel Sep 12th 2009 9:06AM
Honestly I just have no idea. I used the term hacked because I really don't know how this has happened. I assumed it wasn't a keylogger because I only built this computer last month and the only programs I have on it is Steam, Firefox, Foobar2000, MSN and WoW. I keep this as strictly a gaming computer, and I have a seperate computer for any other programs, even photoshop.
How does someone even get a keylogger? I thought it was from downloading something dodgy. Plus would they not have accessed other things such as my e-mail, my facebook/twitter acounts if they did have a keylogger? (I used the same password for everything, but I just went onto a different PC and changed everything).
The great news is that I received an e-mail saying my account has had a 3 hour suspension for disrupting the in-game chat. It said it would e-mail me a new password within an hour of that e-mail and I haven't received it yet and the suspension ran out 8 minutes ago. I've already filled in a webform to Blizzard Account support, but im just really lost on what to do.
Angus Sep 12th 2009 10:06AM
How does someone even get a keylogger? I thought it was from downloading something dodgy. Plus would they not have accessed other things such as my e-mail, my facebook/twitter acounts if they did have a keylogger? (I used the same password for everything, but I just went onto a different PC and changed everything).
You DID get keylogged, just not on that computer.
The machine you changed things on just let them know the new passwords, FYI.
If you use the SAME passwords as everything else, they can tell by looking. At that point it is pretty darn easy to assume the WoW account uses the same password too. And you just changed those passwords and they are all the same again, you haven't gotten any further. Heck, if you joined a forum or some site that uses the same password, the site might have been hacked or a front and that's just giving them the info.
Find a malware scanner and use it. Change the WoW password to something very different from the ones you just made and change those AFTER you check. Do not make them same and use good password schemes. Strong passwords are basically phrases with shorthand and characters.
Im@uRB4s3d00d
k1lL1NURd00dz!
Neither password is all that easy to hack, yet both are easy to remember if you know what they mean. (No, I don't use either anymore)
And the authenticator is a good idea, it is very difficult to defeat.
Heimdallw32 Sep 12th 2009 10:09AM
"I thought it was from downloading something dodgy." Every time you access a website, you're downloading. Images, text, etc. It's entirely possible (and does happen) for someone to hide a keylogger/trojan(which then downloads a keylogger itself)/virus/malware in that data, so even just 'viewing' a website can potentially infect your computer.
Daniel Sep 12th 2009 10:31AM
@Angus: The only place I play WoW is this PC right here. Which I am pretty certain has no keylogger on it. Then again I can never be sure, I only have AVG Free on this PC. Maybe it just isn't detecting it?
As for the PC I changed my passwords on, its my dads PC that has norton (or mcafee, i forgot which) fully paid for. Its completely clean after a virus/spyware/malware scan. That is why I used that PC. And thanks for the advice :)
@Heimdallw32: Yes I do know that, just from what I know it is very uncommon, and not something you'd find easily while just visiting reputable sites (Kotaku.com, Wow.com, wow-europe.com, twitter.com, facebook.com, know what I mean?) I have been thinking of reformatting my HDD on this PC, I have Windows 7 on it but when I installed it I didn't format the HDD so there is like 100GB that I can't use.
EZ Sep 12th 2009 11:36AM
you used the SAME password for every site?
ouch
let me guess, it was something like your name or birthday too?
Daniel Sep 12th 2009 12:12PM
No, and I would appreciate it if you didn't take me to be an idiot.
I used the same one out of pure convenience, however the password itself is strong, and I am confident that the password itself was not the method to get into my account, it is impossible to just guess without taking years to do so.