Would you use an authenticator fob?
By
Aggelakis,
Posted on: 2010-01-09 11:59 in CoH and CoV General Discussions
Quote:
I like to track WoW's customer service forum to see what people say when their accounts are hacked, and I think that collapsing people to these two groups is a bit simplistic - I've seen people who appear to be in the first category get hacked again and again, and I've seen people who appear to be in the second category never lose a thing. I've also seen many people in Guild Wars get hacked, and I'm kind of past the assumption that everyone who is hacked is an idiotic noob who can't handle computer security.|
Originally Posted by Ironblade
The problem is this:
The people who have good security on their computers, scan them regularly, and use strong passwords recognize the value in them but don't see the need. And rightly so. They already have sufficient security. The people who are utterly clueless about computer security are the ones who need them. But they don't recognize that. They're noobs and believe that "only idiots get their computers compromised" but they ARE the idiots. |
To be honest, I simply don't believe that the first category can block everything that can get to you. It might only take one moment of inattention while googling for information, or it might only take five minutes of someone else using your computer to look at pr0n or something stupid. I don't think CoH is at risk to the same degree that WoW or Guild Wars is, and it's pretty easy to dismiss that risk if it's not something you're subjected to.
Elsegame: Champions Online: @BellaStrega ||| Battle.net: Ashleigh#1834 ||| Bioware Social Network: BellaStrega ||| EA Origin: Bella_Strega ||| Steam: BellaStrega ||| The first Guild Wars: Kali Magdalene ||| The Secret World: BelleStarr (Arcadia)
Quote:
^^^|
Originally Posted by KaliMagdalene
To be honest, I simply don't believe that the first category can block everything that can get to you. It might only take one moment of inattention while googling for information, or it might only take five minutes of someone else using your computer to look at pr0n or something stupid. I don't think CoH is at risk to the same degree that WoW or Guild Wars is, and it's pretty easy to dismiss that risk if it's not something you're subjected to.
|
THIS
I've mentioned before that I work in the financial industry, so I'm exposed to various scams from time to time that seem so legit that I am in the habit of carefully scrutinizing just about everything I do that involves any kind of 'key' information. It's made me pretty paranoid.
For example, one of the ways that people steal credit card numbers is referred to as 'Skimming'. A person takes a magstripe reader and places it over another reader, with or without a passthrough to the 'real' reader, and lets people swipe their own cards away. It takes literally a second of inattention to give away your credit card number.
The information-only version of this (usually lumped in with Phishing) is to present a web page to the user that LOOKS like the UI for a login screen or something similar. Again, if you just happen to be running on automatic the day you see one of these, you've given away a password.
I've had a few occasions in the last couple months to both doubt NCSoft's internal security and frantically recount my own actions to see if I'd been careless. When you get the 'this account is already logged in' error, you want to go around looking for things missing. I've also had friends report, 'Someone just logged in to my account and disconnected me!' (To which everyone usually shouts, 'Change your password right away!'.)
The post stickied at the top of the forum swears up and down that NCSoft's security hasn't been compromised. I'd personally like to see more information about that.
Two-factor authentication protects the user rather than the server. (Although it can protect the server legally.) So if NCSoft offered an optional fob, I'd grab one right away. Not only would it protect my account against the occasional slipup, but it'd also ease my paranoia. If my account got cracked, I'd know it wasn't my own fault.
I'd personally encourage NCSoft not to make them mandatory, just to avoid annoying the people who prefer to make the other tradeoff - the convenience of single-factor authentication over the security (not to be confused with safety in this case) of two-factor authentication.
Quote:
Easily explained... The people that appeared to be in the first group clearly were not, and those in the second group that never lose a thing don't do stupid things online that put them at risk... they generally just use email chat with their friends and login to the game.|
Originally Posted by KaliMagdalene
I like to track WoW's customer service forum to see what people say when their accounts are hacked, and I think that collapsing people to these two groups is a bit simplistic - I've seen people who appear to be in the first category get hacked again and again, and I've seen people who appear to be in the second category never lose a thing.
|
As to WoW specifically, is it not true that by default, your username is your email address? That right there is probably half the reason so many people are hacked. Their password shared between the forums and game as well? It's really no wonder the gizmo protects players in that game, because the security in place to protect the players is abysmal.
If these companies actually wanted to secure their games without relying on stupid and expensive gimmicks, they could very easily do so. I blame Blizzard and NCsoft more for hacked accounts than I do the user. Just recently NCsoft finally made it so we have to enter our current password to enter a new one on master accounts... Basic security that should have been there from the beginning. Hopefully they'll add the same to individual accounts. Of course, one good security policy begs a stupid one preceding it, like tying our own forum passwords to our game passwords.
Seriously, a gizmo like this won't protect users any better than if NC actually took security seriously in the first place.
Quote:
Sorry, this is just too pat an explanation. It's more likely to me that things are more complex than you think, and my own experiences and observations tend to support that over your overly simplistic assumptions.|
Originally Posted by Tradok
Easily explained... The people that appeared to be in the first group clearly were not, and those in the second group that never lose a thing don't do stupid things online that put them at risk... they generally just use email chat with their friends and login to the game.
|
Quote:
| As to WoW specifically, is it not true that by default, your username is your email address? That right there is probably half the reason so many people are hacked. Their password shared between the forums and game as well? It's really no wonder the gizmo protects players in that game, because the security in place to protect the players is abysmal. |
I also want to point out that CoH also uses the same username and password for the forum and the game.
Quote:
| If these companies actually wanted to secure their games without relying on stupid and expensive gimmicks, they could very easily do so. I blame Blizzard and NCsoft more for hacked accounts than I do the user. Just recently NCsoft finally made it so we have to enter our current password to enter a new one on master accounts... Basic security that should have been there from the beginning. Hopefully they'll add the same to individual accounts. Of course, one good security policy begs a stupid one preceding it, like tying our own forum passwords to our game passwords. |
Quote:
| Seriously, a gizmo like this won't protect users any better than if NC actually took security seriously in the first place. |
Seriously, are you listening to yourself? You're honestly claiming that effectively requiring two passwords - one of which is newly generated each time you log in - doesn't really add more security than a single static password? Do you really believe this?
Jesus christ, no wonder so many people get hacked.
Elsegame: Champions Online: @BellaStrega ||| Battle.net: Ashleigh#1834 ||| Bioware Social Network: BellaStrega ||| EA Origin: Bella_Strega ||| Steam: BellaStrega ||| The first Guild Wars: Kali Magdalene ||| The Secret World: BelleStarr (Arcadia)
Quote:
I'll only respond to these two points, because there really is no point in debating the rest if it's just going to get you so hostile.|
Originally Posted by KaliMagdalene
I also want to point out that CoH also uses the same username and password for the forum and the game.
The fobs aren't stupid or expensive. They're actually rather cheap (although Blizzard sells them at a loss). |
Yes, our game also uses the same username and pass for game and forums, and it's ridiculously stupid to do so. At least in the old forums we could have separate passwords for the two, which was far better from a security standpoint. As to the username/email bit being recent, I guess I was ill-informed... but it's still one hell of a step backwards. But it's all about convenience these days, I guess.
As to the cost issue, I'm sure the infrastructure Blizzard set up was not cheap, I don't really care about the cost to the end users for the gizmo.
But I think I'm done here. I think it's a stupid waste of money when compared to the other things they could do to increase security and raise awareness.
Quote:
You really need to read up on Two-Factor Authentication, Tradok. RSA's implementation is relatively inexpensive, fairly easy to integrate into just about any other code-base, and EXTREMELY effective.|
Originally Posted by Tradok
But I think I'm done here. I think it's a stupid waste of money when compared to the other things they could do to increase security and raise awareness.
|
In fact, I'd recommend it to all but the smallest businesses on price and bang-for-the-buck.
It's generally extremely difficult to crack these sorts of authentications.
Imagine that you are issued a mechanical device something like this that constantly rotates its own wheels. Back wherever you want to log in, they also have a device that rotates its wheels in step with the one you were given. It doesn't have the same symbols on its wheels, but it knows how to derive what your wheels should look like for any given position of its own wheels.
Whenever you log in, you first use your ID and password to say who you are. Then, you type in the symbols on your wheels. Since the remote system knows who you are, and how to translate its wheel symbols into what yours should read, it can use this to determine if that's really you logging in. If you got the ID and password right, but the wheel symbols wrong, it can reject your login.
To break this sort of thing requires either access to your symbol device or some very detailed knowledge of the home system's symbol wheel machine. If the login transaction is poorly encrypted, it's potentially possible for attackers to garner this information by observing a sufficient number of tapped logins. How hard this is depends on how many wheels and symbols are involved, and how different each user's symbol devices are from the master and from each other.
Of course, there aren't really any gears involved; that was just for ease of illustration. But systems like this use digital versions of the same ideas. The devices are intended to produce what appear to be very random number sequences (a geared device would actually be very bad at this) as their passwords. Of course the sequences aren't random at all, because the fob and the home system need to know what they are. But the more random they appear, the harder it is to determine the sequences involved.
Blue
American Steele: 50 BS/Inv
Nightfall: 50 DDD
Sable Slayer: 50 DM/Rgn
Fortune's Shadow: 50 Dark/Psi
WinterStrike: 47 Ice/Dev
Quantum Well: 43 Inv/EM
Twilit Destiny: 43 MA/DA
Red
Shadowslip: 50 DDC
Final Rest: 50 MA/Rgn
Abyssal Frost: 50 Ice/Dark
Golden Ember: 50 SM/FA
Quote:
I set up an e-mail address that I use for literally nothing else (and never log into) for my battle.net account. |
Originally Posted by Tradok
I'll only respond to these two points, because there really is no point in debating the rest if it's just going to get you so hostile.
Yes, our game also uses the same username and pass for game and forums, and it's ridiculously stupid to do so. At least in the old forums we could have separate passwords for the two, which was far better from a security standpoint. As to the username/email bit being recent, I guess I was ill-informed... but it's still one hell of a step backwards. But it's all about convenience these days, I guess. |
Quote:
| As to the cost issue, I'm sure the infrastructure Blizzard set up was not cheap, I don't really care about the cost to the end users for the gizmo. |
Quote:
| But I think I'm done here. I think it's a stupid waste of money when compared to the other things they could do to increase security and raise awareness. |
And seriously, my hostility comes from people in this very thread claiming that an added layer of security adds no security at all. I feel like I've walked into a physics class and had someone earnestly explain how sometimes apples will fall into the sky.
Elsegame: Champions Online: @BellaStrega ||| Battle.net: Ashleigh#1834 ||| Bioware Social Network: BellaStrega ||| EA Origin: Bella_Strega ||| Steam: BellaStrega ||| The first Guild Wars: Kali Magdalene ||| The Secret World: BelleStarr (Arcadia)
Quote:
That's a really good analogy. Since so many people have seen it, I usually go for comparing two-factor authentication to the scene out of 'Goldeneye' where 007 (Pierce Brosnan) forces Jack Wade (Joe Don Baker) to not only use the Challenge-Response phrase, but also to display a hidden tattoo. |
Originally Posted by UberGuy
Imagine that you are issued a mechanical device something like this that constantly rotates its own wheels. Back wherever you want to log in, they also have a device that rotates its wheels in step with the one you were given. It doesn't have the same symbols on its wheels, but it knows how to derive what your wheels should look like for any given position of its own wheels.
|
The challenge-reposne is 'Something you know' and the tatoo is 'Something about you'. out of the three kinds of authenticating factors. The third being the 'Something you have'. The 'Have' can be any unique possession, so long as it's able to be identified uniquely and is difficult to forge. It could be something as simple as the key Bond uses to access M's MI6 office or as complex as a RFID tag hidden inside his badge.
The tradeoff between using 'About' and 'Have' is that 'About' is generally unkind to your privacy. In the movie, it was Jack Wade's tatoo. In the real world, it'd be something like a retina scan or a thumb print.
If you wanted to disassociate yourself with the game for some bizarre reason-- say an unscrupulous company known to sell personal information purchased NCSoft in a hostile takeover-- you couldn't very easily throw away your thumbprint without major surgery. An authenticator can be simply tossed in the garbage disposal or a furnace.
Sure. It'd cut the risk that a new keylogger that gets past my security compromises my account to practically zero, and it'd help make up for the fact that I have a horrible memory and am loathe to change passwords as often as I should.
Having Vengeance and Fallout slotted for recharge means never having to say you're sorry.
Nope, my account is pretty damn secure. I have a username that's totally different from any of my online account names and different from my global name, and a password that is quite unique.
I don't need a fob. I R SMART!
Quote:
As someone who works in the IS/IT field I can confidently say that adding a layer isn't necessarily adding security.|
Originally Posted by KaliMagdalene
And seriously, my hostility comes from people in this very thread claiming that an added layer of security adds no security at all. I feel like I've walked into a physics class and had someone earnestly explain how sometimes apples will fall into the sky.
|
Also, security is NOT about "keeping the other guy out". Anyone who's trying to tell you this is SELLING YOU SOMETHING. Security is a deterrent system, but it doesn't stop people from getting in. At it's root, a system is designed to be accessed and used.
Ideally security should
- Make it tough enough that an unauthorized user trying to break in gives up and moves on to greener pastures
- Makes the unauthorized user have something spectacular (and highly visible) to get in and sets off alarms, getting them noticed.
- Takes so long to get in, creating an anomalous usage pattern, that they get noticed before they can do any damage.
Clicking on the linked image above will take you off the City of Heroes site. However, the guides will be linked back here.
Quote:
This for me. I do not want one and would not accept being forced to use one. Multiple accounts would make this a total pain.
|
Originally Posted by Techbot Alpha
If they were optional, it'd be ok. I personally wouldn't want to use one (I can lose my room key in a bag with nothing else in it >_<)
Optional: Understandable Forced: Unacceptable |
total kick to the gut
This is like having Ra's Al Ghul show up at your birthday party.
Quote:
More or less this^^^ goes for me as well.
|
Originally Posted by Kelenar
Sure. It'd cut the risk that a new keylogger that gets past my security compromises my account to practically zero, and it'd help make up for the fact that I have a horrible memory and am loathe to change passwords as often as I should.
|
There are no words for what this community, and the friends I have made here mean to me. Please know that I care for all of you, yes, even you. If you Twitter, I'm MrThan. If you're Unleashed, I'm dumps. I'll try and get registered on the Titan Forums as well. Peace, and thanks for the best nine years anyone could ever ask for.
Thoughts...
GREAT for security but, as a general rule, it's a PITA currently to keep track of all the various security questions I have to keep straight for online transactions. Now, factor in potentially physical devices I have to manage as in sheer quantity or conivenience if I'm away from home...ugh. That's the user-side.
From a corporate side, fobs can hinder the possibility of instant gratification of online sales and immediately playing.
@Texarkana
@Thexder
Quote:
And yet, adding the authenticator is added security, given the methods typically used to steal accounts. Keyloggers can't beat authenticators. Someone who wants to get into such an account needs to have access to more information and a technical support or billing guy who will buy their story when they call. |
Originally Posted by Hyperstrike
As someone who works in the IS/IT field I can confidently say that adding a layer isn't necessarily adding security.
Also, security is NOT about "keeping the other guy out". Anyone who's trying to tell you this is SELLING YOU SOMETHING. Security is a deterrent system, but it doesn't stop people from getting in. At it's root, a system is designed to be accessed and used. |
Are you seriously going to argue otherwise, or will the generalities continue?
Elsegame: Champions Online: @BellaStrega ||| Battle.net: Ashleigh#1834 ||| Bioware Social Network: BellaStrega ||| EA Origin: Bella_Strega ||| Steam: BellaStrega ||| The first Guild Wars: Kali Magdalene ||| The Secret World: BelleStarr (Arcadia)
Quote:
Thanks for the link, but I'm aware of what it is... I'm just of the opinion that this is a relatively low population game, with low interest from those that would like to exploit us. If this were my banks website and they were offering it, sure, sign me up.|
Originally Posted by AmazingMOO
You really need to read up on Two-Factor Authentication, Tradok. RSA's implementation is relatively inexpensive, fairly easy to integrate into just about any other code-base, and EXTREMELY effective.
In fact, I'd recommend it to all but the smallest businesses on price and bang-for-the-buck. |
But I honestly don't see where this would be better than improving the lax security measures already in use, it looks like pure overkill in our situation. No matter how cheap this system is, it can't be more affordable than just fixing what we have. I believe that if it's an optional system, that not enough people will sign up to make it worth the effort. I believe that if it's mandatory, there will be a measurable drop in subscribers. No, not from the rage quitters, but from people unable to get them, unwilling to pay extra for them, or unwilling to deal with support to get a replacement when theirs is lost/stolen.
I just don't believe that this has merit in CoH, that the effort would be wasted, and that it's just not needed here. It'd be a gimmick that would quickly become annoyance. But that's my opinion on the matter, maybe I'm just getting old in my old age... I don't see the point in a technological solution when a decent policy would do.
Quote:
As one of those generalizations everyone tosses around at cocktail parties, this is true. But when it comes to brass tacks, two-factor authentication using token generators almost always is, for the simple reason that (and not all two-factor authentication systems have this property) they prevent replay attacks.|
Originally Posted by Hyperstrike
As someone who works in the IS/IT field I can confidently say that adding a layer isn't necessarily adding security.
|
No safety precaution available to end users can protect them against replay attacks; in other words nothing can stop something from simply recording their password and then reusing it. Token generated codes cannot be replayed (not in the general case) which makes them immune to any data-collection attack on their systems.
Theoretically, good security practices can mitigate some of these attacks, but nothing has a 100% success rate here. And because increasingly these forms of malware attacks are being generated by well-funded criminal organizations rather than the general goofballs of the past, they are becoming far more sophisticated than we used to see even just ten years ago.
[Guide to Defense] [Scrapper Secondaries Comparison] [Archetype Popularity Analysis]
In one little corner of the universe, there's nothing more irritating than a misfile...
(Please support the best webcomic about a cosmic universal realignment by impaired angelic interference resulting in identity crisis angst. Or I release the pigmy water thieves.)
Quote:
Two-factor tokens are the most straight-forward, simple, and cost-effective way of addressing the specific security issues they have been having. No password policy can protect against password harvesters by definition, and they are specifically being targeted by password harvesters.
|
Originally Posted by Tradok
If these companies actually wanted to secure their games without relying on stupid and expensive gimmicks, they could very easily do so. I blame Blizzard and NCsoft more for hacked accounts than I do the user. Just recently NCsoft finally made it so we have to enter our current password to enter a new one on master accounts... Basic security that should have been there from the beginning. Hopefully they'll add the same to individual accounts. Of course, one good security policy begs a stupid one preceding it, like tying our own forum passwords to our game passwords.
Seriously, a gizmo like this won't protect users any better than if NC actually took security seriously in the first place. |
[Guide to Defense] [Scrapper Secondaries Comparison] [Archetype Popularity Analysis]
In one little corner of the universe, there's nothing more irritating than a misfile...
(Please support the best webcomic about a cosmic universal realignment by impaired angelic interference resulting in identity crisis angst. Or I release the pigmy water thieves.)
I think the folks bringing up an additional device to use are vastly overstating the situation for most. A fob can be easily stored physically nearby the PC(s) used to play the game and accessed only when needed. It doesn't need to be carried around (except for people who play in different locations, of course, and for them the physical inconvenience argument holds some water).
Sure, I'd happily use and even pay for an authenticator, given the relatively low cost and, since I play only at home on my own PC, the lack of any inconvenience whatsoever. I'd just hang it off the monitor or something and there it would be whenever needed.
More security just can't be a bad thing in my opinion.
Leader of Legion of Valor/Fallen Legion (Victory server)
http://legionofvalor.guildportal.com / http://fallenlegion.guildportal.com
StainedGlassScarlet - L50 Spines/Inv Scrapper | Badges: 1,396
Avatar detail taken from full-size piece by Douglas Shuler here
No, I don't feel like being inconvenienced by extra steps that I don't need just because some stupid people can't be trusted with their own information.
Quote:
I think that they should make them available, but optional. I can see the protest if you assume they're going to make them mandetory, but there are plenty of people who just aren't good with their own security measures and know it, or are just inclined to worry anyways. Offering an authenticator would help relieve the concerns of those people, and making it optional would allow people like you to continue on without the "inconvenience". There's really no reason at this point that it needs to be all or nothing. With something like this, they would probably want to introduce it as optional at first anyways and see how it impacts their support queues.
|
Originally Posted by Lazarus
No, I don't feel like being inconvenienced by extra steps that I don't need just because some stupid people can't be trusted with their own information.
|
I should mention, in reference to the OP, that if NCSoft offered an authenticator token, I'd probably take it if it was a software token running on something like an iPhone. If it was an actual hardware token, maybe. It would depend on the reliability of the specific token vendor, and what NCSoft's customer service mechanisms were for granting access to the accounts if the token fails. In other environments where I use hardware authenticators, there are specific procedures for duress**, emergency access, and general replacement. I would assume anyone who knew what they were doing would implement such procedures and make them well known. If I don't see those procedures, I'll assume whoever implemented didn't know what they were doing, and probably steer clear.
** okay, duress procedures might be a bit overkill for CoX. But not the other two.
[Guide to Defense] [Scrapper Secondaries Comparison] [Archetype Popularity Analysis]
In one little corner of the universe, there's nothing more irritating than a misfile...
(Please support the best webcomic about a cosmic universal realignment by impaired angelic interference resulting in identity crisis angst. Or I release the pigmy water thieves.)
Quote:
Account stealers are becoming more aggressive and clever all the time. It's way too simplistic to just say that everyone whose account is stolen is stupid.
|
Originally Posted by Lazarus
No, I don't feel like being inconvenienced by extra steps that I don't need just because some stupid people can't be trusted with their own information.
|
Elsegame: Champions Online: @BellaStrega ||| Battle.net: Ashleigh#1834 ||| Bioware Social Network: BellaStrega ||| EA Origin: Bella_Strega ||| Steam: BellaStrega ||| The first Guild Wars: Kali Magdalene ||| The Secret World: BelleStarr (Arcadia)
The problem is this:
The people who have good security on their computers, scan them regularly, and use strong passwords recognize the value in them but don't see the need. And rightly so. They already have sufficient security.
The people who are utterly clueless about computer security are the ones who need them. But they don't recognize that. They're noobs and believe that "only idiots get their computers compromised" but they ARE the idiots.
Paragon City Search And Rescue
The Mentor Project