I think its time we get an update to the security token and launcher.

A lot of players have a security token whether its mobile or a physical key fob. This is all well and good and a great addition to the game but as it stands its actually quite a huge annoyance when you have to log in multiple times. With 4.1 a lot of people got smacked by the dreaded lobby error that for some reason drops you completely out of the game and forces you to relaunch the launcher and log in yet again.

Every time you have to re-open the launcher you have to input your info plus the OTP...every time! There are actually some days, such as the great housing crisis of 4.1, where I wonder why I even have the thing because anyone without it can log in much faster than I can and get a jumpstart while I'm still inputting the OTP. Yes this part is frustrating but taking a page from Blizzard I think its time the launcher is upgraded to allow for a timed OTP freeze on login.

What I'm suggesting is if the OTP is entered on your current IP address you have 30 minutes where you can skip the OTP itself as long as you aren't trying to log in from another machine or IP, or even just skip the login altogether if you get booted.

I know I used housing as an example but it isn't the only time it happens, in fact its quite a regular occurrence for some players and I imagine my own frustrations might be mirrored by them.

This goes against what dual factor authentication is designed for. If you don't want the extra layer of security, disable the token. I believe there are options to disable this. Next time you know you will need to login quickly disable your token for the day and put it back on at a later time.

Quote:

---

Originally Posted by Blindheart

This goes against what dual factor authentication is designed for. If you don't want the extra layer of security, disable the token. I believe there are options to disable this. Next time you know you will need to login quickly disable your token for the day and put it back on at a later time.

---

It doesn't even come close though. Blizzard has the same dual-factor authentication and unless you log in from a new machine or IP address your account is flagged to skip it. If someone attempts a login from somewhere else they can't get in without you accepting it on whatever device you use for the authenticator or if you input the code given by the key fob.

Quote:

---

Originally Posted by Blindheart

Next time you know you will need to login quickly disable your token for the day and put it back on at a later time.

---

If you use the actual token, disabling it completely removes the item and cannot be reused. Your account warns you about it.

Quote:

---

Originally Posted by Stillwaters

If you use the actual token, disabling it completely removes the item and cannot be reused. Your account warns you about it.

---

That's only the physical token. Software one you can add/remove as much as you want.

This is a security feature. Some games have less secure sign ins that allow a longer time between having to put in your one time pw this one does not. If it bothers you that much just remove it from your account.

Quote:

---

Originally Posted by Zarabeth

This is a security feature. Some games have less secure sign ins that allow a longer time between having to put in your one time pw this one does not. If it bothers you that much just remove it from your account.

---

Please read my response to the exact same comment made earlier and then read Stillwaters's response. Other companies are using this exact same security feature except with better implementation. There isn't any reason to have it locked down in a restrictive manner when other companies who do the same thing are just as secure even with the bypass feature.

Quote:

---

Originally Posted by Unaki

Other companies are using this exact same security feature except with better implementation

---

No... they're using a similar implementation, but with weaker security that they probably consider acceptable for their product.

Quote:

---

Originally Posted by Unaki

just as secure even with the bypass feature.

---

If you have any sort of bypass feature, it's not as secure.

OTP literally stands for One Time Password. It's only supposed to work... ONE TIME.

Please don't try and lower the security of our accounts because you don't like how it works. As others have said you can always disable it if it bothers you that much.

Quote:

---

Originally Posted by worldofneil

That's only the physical token. Software one you can add/remove as much as you want.

---

Yeah...the token that costs $11.

Removed my token in preparation for the housing war. Glad I did, but I'm not happy with the fact that I basically flushed $11 down the toilet to do so. It's silly that we can't re-use the same token that we paid real money for. And since not everyone has a smart phone, using the software token isn't always a possibility...

I truly am sorry to tell you this as the information is clearly too late, and sorry that your token no longer works, but maybe it'll help for 4.2. You don't actually need to login when the servers come up, you can comfortably login 5+ minutes before hand.

Yes it says about how the game is down for maintenance etc, but all you need to do is just click the "World" icon in the bottom left corner and when that page appears, hit close. It will then refresh the main page and if the servers are up, you get the usual green button (as you're already logged in), if not, repeat.

I appreciate this doesn't help you now, but using this technique I was 57th in queue for my server and I hope it can help you next time!

Quote:

---

Originally Posted by worldofneil

No... they're using a similar implementation, but with weaker security that they probably consider acceptable for their product.

---

Oh yes, the incredibly successful company, Blizzard, that has a 12 year old MMO much more successful than this one has terrible security. /rolls eyes

Their security is so much better that they've created an authentication system that doesn't require you to type it in EVERY single time you log out - from the same IP, within 3 minutes of you last entering it. In fact, they have one tap authentication for the mobile app, where it shows both the number and a button that you can press to be let into your account when the client asks for authentication. Stop condescending people when you don't even do your research!

Gotta admit I love just tapping "Approve" with Blizzard's authentication app, dont even have to unlock my phone.

Quote:

---

Originally Posted by Fyana

Blizzard, that has a 12 year old MMO much more successful than this one has terrible security.

---

I never said terrible. I said weaker.

Quote:

---

Originally Posted by Fyana

doesn't require you to type it in EVERY single time you log out

---

Quote:

---

Originally Posted by Fyana

Stop condescending people when you don't even do your research!

---

Please do YOUR research. Any system that caches your authentication is inherently weaker that one that requires it every single time. I'm not really sure how you can disagree with that.

While the risk of someone coming from the same IP address during that time period is extremely minimal (unless you're somewhere public or in a building where everyone uses the same Internet connection/IP address...), my point is it's still a weakness that SE does not have because they require you to type in a code every time. Blizzard are doing it simply to make it more convenient with a risk they probably consider acceptable.

Great as push notifications like you're describing are (and yes I have the Blizzard one too), the advantage is that code generation does not require an active Internet connection, receiving a notification does. Amazing as it sounds there are still people that don't have mobile data on their phones and aren't always in areas with Wi-Fi.

Yes I'm aware that you can generate a code manually using the Blizzard app, and sure SE could support both codes and push, but from their point of view, why bother. What they have works and it integrates well with their physical token solution.

I would prefer any relaxation of the security on OTP to be limited to the same IP. This is risk-based security that is gradually being promoted in the business world as well. It's fine to relax a security measure if and only if the risks associated with the relaxation is insignificant.

if it is saved on the PC then it is hackable.
That is the whole point of the One Time Password. To have a password that change everytime and that is not hackable by keylockers. Or a normal 2nd password, where the player is forced to change it once a month, would do the same.

Quote:

---

Originally Posted by Unaki

It doesn't even come close though. Blizzard has the same dual-factor authentication and unless you log in from a new machine or IP address your account is flagged to skip it. If someone attempts a login from somewhere else they can't get in without you accepting it on whatever device you use for the authenticator or if you input the code given by the key fob.

---

my WoW account was hacked a few time already I no longer play.. but i keep getting e-mails about cash shop purcheses. I had a token on it............. just saying. someone even bought the silly sparkle pony that was on the cash shop around early cata/mists of pandara age.
i never bought money, never gave my account info out, had a random password that no one would understand.

i never had my SE account hacked.

Quote:

---

Originally Posted by worldofneil

physical token solution.

---

Might want to ask RSA if you think keyfobs and software tokens are actually secure. Theoretically producing fewer keys is actually more secure by reducing your attack surface.

Anyway if you are really this worried about the security of your token then your token would not be your primary concern anyway tbh as your authentication is only as secure as how it is transmitted. Without being privy to any of the details of their system architecture talking about it doesn't mean anything.

I disabled the token for housing and just got a new one afterward. With the software token, it's super easy to do. Although I was salty about the fact that when I moved and left my token in America by accident I had to remove the token to play and it was the limited collector's edition token and I could never use it again after that. Bleh. But with software tokens, it's no big deal.

Using Blizzard as your primary example is a poor choice given the extensive hacking issues they've had over the length of WoW's lifetime thus far.

Quote:

---

Originally Posted by enthauptet

Might want to ask RSA if you think keyfobs and software tokens are actually secure.

---

That's not really the topic at hand, but SE aren't using tokens from RSA, they're using rebranded Vasco DIGIPASS GO 6's.

Quote:

---

Originally Posted by enthauptet

Theoretically producing fewer keys is actually more secure by reducing your attack surface.

---

I'll be completely honest, I don't know if that's the case or not. I'll take your word for it!

Quote:

---

Originally Posted by enthauptet

your authentication is only as secure as how it is transmitted.

---

It's transmitted over HTTPS to ffxiv-login.square-enix.com. Their server could be locked down a bit more, but given that we have to provide the OTP each time, personally that's good enough for me. Your mileage may vary.

Quote:

---

Originally Posted by Felis

if it is saved on the PC then it is hackable.
That is the whole point of the One Time Password. To have a password that change everytime and that is not hackable by keylockers. Or a normal 2nd password, where the player is forced to change it once a month, would do the same.

---

Quote:

---

Originally Posted by Unaki

...if the OTP is entered on your current IP address you have 30 minutes where you can skip the OTP itself as long as you aren't trying to log in from another machine or IP.

---

I boldened and enlargened the parts you and other people are completely ignoring from the original request, Felis.

Quote:

---

Originally Posted by Unaki

It doesn't even come close though. Blizzard has the same dual-factor authentication and unless you log in from a new machine or IP address your account is flagged to skip it. If someone attempts a login from somewhere else they can't get in without you accepting it on whatever device you use for the authenticator or if you input the code given by the key fob.

---

Wildstar has the same dual-factor system in place. It's been a while since I logged in but as I remember it was for five or seven days. Worked amazing really and I never heard of an issue or complaint.

Quote:

---

Originally Posted by Blindheart

This goes against what dual factor authentication is designed for. If you don't want the extra layer of security, disable the token. I believe there are options to disable this. Next time you know you will need to login quickly disable your token for the day and put it back on at a later time.

---

You can have dual factor authentication without having to input the OTP every log in. Look at GW2, gmail, discord, and even iCloud. All of them only require input after so many failed login attempts, a certain amount of time passes, or a new IP. The OTP and the launch are archaic at best and need some serious updating.