So my wow authenticator is not only more convenient in that i dont have to enter it EVERY TIME (but thats another discussion alltogether and I can get past that easier than this)
but it also allows me to have it on my iphone AND my ipad.
Now i may be incorrect, and it may in fact be possible - but I cant figure it out thus far.
Anyone care to confirm or deny for me before I move on?
Software authenticator, seriously locked to 1 device?
Printable View
-
03-29-2019, 12:57 AMklepp0609Software authenticator, seriously locked to 1 device?
-
03-29-2019, 12:58 AMDeceptusThe whole point of an authenticator is it's supposed to authenticate you and you only. If it was allowed on multiple devices they can't be sure it's YOU.Quote:
Originally Posted by klepp0609
As for the having to enter it EVERY TIME, again, that's the point of 2 step verification. -
03-29-2019, 02:06 AMMsQiNo not really. If the same computers on the same IP is logging in it's perfectly fine for it to be occasional.Quote:
Originally Posted by Deceptus
-
03-29-2019, 02:13 AMLegion88And why? It could be different persons on the same PC.Quote:
Originally Posted by MsQi
And with the option to save passwords for convinience it should be necessary to have follow up step to make sure it is the right person trying to log in. -
03-29-2019, 03:15 AMklepp0609
chances of someone not only having my account password, but being at my pc to login without my knowing is nil. Moot point. Id take the convenience any day.
Still - ive sucked that up at this point.
What this is about is the inability to add the auth to my tablet. Ironically blizzard (who i loathe) but who has just as many if not more subs, has been in the game just as long if not longer, who makes just as much, if not more money - seems to have 0 issues with both of the aforementioned (multiple devices and saving auth based on mac or hwid or however they do).
Ultimately not here to rant about it, im sure we're all of sound enough mind to realize that wont get anything fixed. Simply wanted to know if there was in fact a way to avoid having to choose between keeping either my tablet or my phone nearby (cause ironically enough - apple who eclipses them both, is okay with having them linked in every single way) -
03-29-2019, 05:36 AMMsQiBut it doesn't save your password. You have to enter both every time.Quote:
Originally Posted by Legion88
It could be a different person using your phone. These aren't here to protect you from theft, brake in or your own mistakes. -
03-29-2019, 06:44 AMDualgunner
Security and convenience are on opposite sides of a spectrum.
-
03-29-2019, 07:02 AMLadon
Yes, the SE token is poorly implemented. It’s not insecure but it does leave a lot to be desired for usability.
They tie the certificate to the device ID which is just silly these days as not only does this prevent multi-device registration options (which all modern MFA solutions: Duo, Okta, Google Authenticator) but I’m sure many of you have experienced the need to re-register the soft token if you restore from a backup or get a new device.
There are better ways to do this now that allows you to register on multiple devices while making sure it’s a device you own.
I would not be in favor of not prompting for MFA every log in like Blizzard allows. There are plenty of ways this can be exploited though you would have to be part of a targeted attack. However they could implement a MFA push so that you just have to accept to decline a log in rather than having to fire up the token app and put in a code every time. -
03-29-2019, 08:59 PMSamSmootAnd, when it does need to authenticate, your phone's app checks back with the server when it starts to see if there's a request pending, and if so, just lets you tap a button instead of entering a number. (I assume it transfers the number directly, to prove it's you.) If your phone has no internet connection at the time, then the app can still generate a number to enter.Quote:
Originally Posted by MsQi
-
03-29-2019, 09:09 PMKaedanIf it wasn't possible for someone to spoof your device and spoof you IP... which is actually is.Quote:
Originally Posted by MsQi
That's why people who set their 2 step identification for "make his device safe for a month" still get their accounts hacked. And then they wonder how they got their account hacked... -
03-30-2019, 03:08 AMSamSmoot
The stupid thing is that both my game accounts have an authenticator option, but it's nearly impossible to find a BANK that has this..
-
03-30-2019, 03:20 AMtdbSpoofing an arbitrary IP for two-way communications is actually really hard. You basically need to have ISP-level (or maybe deeper) access to the Internet backbone so you can alter routing tables and have the traffic directed to you instead of the rightful holder of the IP.Quote:
Originally Posted by Kaedan
Many ISPs give dynamic IP addresses to their clients, so if you're using the same ISP and are geographically reasonably close to your target (so as to be in the same address pool) it's possible to get the same address they used previously. However it's still damn near impossible to get just the right address at just the right time to take over the target's game account.