Thank you SE for adding Google Auth support

I now feel even more secure being able to use the Google Auth (or compatible app) rather than your own one time password app. This means I can have the one time password on my primary phone, on a second device that sits on my computer desk 24/7 AND I can backup my codes incase I need to restore it to another device later. I no longer have to deal with using the emergency removal code. It's literally a last means effort to get back into my account now.

Now if only you could add an optional "remember me" for the PC login so I don't even have to enter my password each time I want to play the game.

Quote:

---

Originally Posted by Krojack

I now feel even more secure being able to use the Google Auth (or compatible app) rather than your own one time password app. This means I can have the one time password on my primary phone, on a second device that sits on my computer desk 24/7 AND I can backup my codes incase I need to restore it to another device later. I no longer have to deal with using the emergency removal code. It's literally a last means effort to get back into my account now.

Now if only you could add an optional "remember me" for the PC login so I don't even have to enter my password each time I want to play the game.

---

Hooray added security! Now let me disable it.

It's not 2fa if you can disable it. Not really anyway.


Besides, it takes like, 5 seconds to log in.


Also, definitely recommend using something other than Googles. Not because it's bad, but because it's tied to your Google account. And if anything ever happens to that, poof.


I've never understood the complaint of having to log in every time. It doesn't take that long. I've had the physical token since 2010 and never felt the need to use the digital one. Push button type code play

Quote:

---

Originally Posted by Valkyrie_Lenneth

Hooray added security! Now let me disable it.

It's not 2fa if you can disable it. Not really anyway.

---

I never disabled it.

Quote:

---

Originally Posted by Valkyrie_Lenneth

Also, definitely recommend using something other than Googles. Not because it's bad, but because it's tied to your Google account. And if anything ever happens to that, poof.

---

100% false. Google wrote the code and made it open source. The app I use that stores all my codes doesn't even have access to the Internet. It's not even coded into the app to use the Internet. Also the app is open source.

Please learn about a system before making claims about it.

Quote:

---

Originally Posted by Krojack

I never disabled it.




100% false. Google wrote the code and made it open source. The app I use that stores all my codes doesn't even have access to the Internet. It's not even coded into the app to use the Internet. Also the app is open source.

Please learn about a system before making claims about it.

---

I didn't say the app you use, I said the Google token specifically.

And not requiring it on login is basically disabling it.

I see most people recommending Authy.

Quote:

---

Originally Posted by Valkyrie_Lenneth

I didn't say the app you use, I said the Google token specifically.

---

What does that even mean? Again using this on your FF14 account in no way links it to your Google account at all.

SE generates a unique code that's linked to your FF14 account. You input that code into the authenticator app of your choice. BAM you're done. Google is no where in the loop.

I've literally implemented this system into my own personal web sites and my companies administrative systems.

Here, go read how TOTP works. https://tools.ietf.org/html/rfc6238

Quote:

---

Originally Posted by Valkyrie_Lenneth

And not requiring it on login is basically disabling it.

---

Take a lesson from other good providers. If I want to remember my login on MY OWN COMPUTER it's not any less secure. The one time password is to prevent people from logging into your account from other locations. I'm pretty sure some hacker isn't going to break into my house to use my computer and get into my FF14 account. Even then the OTP is still needed to log into my mog station account.. I'm referring to the game login. Consoles have the option to remember their passwords so they don't have to enter it every time.

P.S. Having to manually enter your password every time on your PC is a bigger security risk than remembering your login. Those that don't have the OTP on their accounts are more likely to get hacked this way if they get a rootkit virus on their PC.

Quote:

---

Originally Posted by Krojack

What does that even mean? Again using this on your FF14 account in no way links it to your Google account at all.

SE generates a unique code that's linked to your FF14 account. You input that code into the authenticator app of your choice. BAM you're done. Google is no where in the loop.

I've literally implemented this system into my own personal web sites and my companies administrative systems.

Here, go read how TOTP works. https://tools.ietf.org/html/rfc6238



Take a lesson from other good providers. If I want to remember my login on MY OWN COMPUTER it's not any less secure. The one time password is to prevent people from logging into your account from other locations. I'm pretty sure some hacker isn't going to break into my house to use my computer and get into my FF14 account. Even then the OTP is still needed to log into my mog station account.. I'm referring to the game login. Consoles have the option to remember their passwords so they don't have to enter it every time.

P.S. Having to manually enter your password every time on your PC is a bigger security risk than remembering your login. Those that don't have the OTP on their accounts are more likely to get hacked this way if they get a rootkit virus on their PC.

---

If you use the Google authenticator app. The common one people will use seeing that it's easily available and has Google in the name, the app is tied to your Google account. (people commonly call otp applications "tokens")

If you then use that app as your XIV authenticator, and you lose access to your Google account, you lose access to XIV unless going through support of course.

I don't think you were reading what I was saying, only what you thought I was saying.


And if you have a rootkit, your XIV login is the least of your worries at that point.


I know what totp is. I was mostly just making a comment for people reading to be careful with the Google app.

It's a common issue if you read Google Auth app reviews.

Quote:

---

Originally Posted by Valkyrie_Lenneth

If you use the Google authenticator app. The common one people will use seeing that it's easily available and has Google in the name, the app is tied to your Google account.

---

Again NO IT DOESN'T. It doesn't link to your Google account at all. You CAN add OTP to your Google account but the app does not sync anything to your Google Account. It is not linked to your Google Account in any way.

You don't even need a Google account to use the Google Authenticator app. You can side load it on your phone. There is even one on the Apple store.

Please stop spreading misinformation and scaring people.

Quote:

---

Originally Posted by Krojack

Again NO IT DOESN'T. It doesn't link to your Google account at all. You CAN add OTP to your Google account but the app does not sync anything to your Google Account. It is not linked to your Google Account in any way.

You don't even need a Google account to use the Google Authenticator app. You can side load it on your phone. There is even one on the Apple store.

Please stop spreading misinformation and scaring people.

---

OK, I'll just ignore the Google app reviews then. Clearly you know more than me.

You could always, you know, install it and see for yourself.

Either way I still don't use it mainly because of other lacking UI features.

Imagine seeing a thread thanking SE for adding extra security support and using it as an opportunity to talk down to or argue with someone. These forums are really something.

Quote:

---

Originally Posted by Doozer

Imagine seeing a thread thanking SE for adding extra security support and using it as an opportunity to talk down to or argue with someone. These forums are really something.

---

And thats why these forums are best ^_^ /s


but going back on topic. I really like that added that as an option. The more options the better.

Thank you so, so much for adding third party Authenticator support!

The official Software Token was major liability and massive inconvenience on mobile devices that can switch carriers on the fly. Carrier switching resets the Software Token, requiring the Emergency Removal Password to access your account. This would happen several times a week on my device, making it impossible to log into the game without digging up the Emergency Removal Password, removing the Software Token, and re-registering the Software Token.

Thank you, thank you, THANK YOU!

There are many 2FA you can use aside from Google Auth. I am using 1Password with built in 2FA.

Using 1Password with built-in 2FA defeats the purpose really hard. Now anyone would only need your account password and has everything he needs.

Hi All

As I have to use the Google Authenticator for Work and several other important websites.
I thought I would give it a whirl with FFXIV :)

Boy I am I glad I set an Emergency Password :mad:

Even after checking that both my PC & Mobile are synchronised on time, on average I have to enter at least 3 x 'One-Time Passwords' due to 'Wrong Password Error'

Twice I have been timed out of my account, though it is nice that SE send an email warning that multiple attempts at logging in have just taken place.

So why is FFXIV Launcher so un-reliable with 'One-Time Passwords' compared to Websites I have to log into multiple times per day???

honestly if you're going to use a google compatible authenticator I suggest Winauth on your PC and use it to add to Authy on your Cellphone/tablet. I haven't used the google garbage for years, it's old/clunky an has no way to backup incase something happens to your device. you can do a encrypted backup of Winauth and put it wherever you know you will have access to it should something happen and Authy is cloud based encrypted(if you lose your password for it you lose all the authenticators in it)

Quote:

---

Originally Posted by Denzyl

why is FFXIV Launcher so un-reliable with 'One-Time Passwords' compared to Websites I have to log into multiple times per day???

---

Because it's very specific about the time and only allows the password for the 30 second window you are in. Technically it's more secure, but it doesn't allow for any time skew and increases the potential errors for clients if their clocks are slightly out.

Although other websites will have their own rules, in my experience it's common that anything requiring a one time password would accept the current password, but also the password before AND the password after (so increasing the login window size from 30 seconds to 1 minute and 30 seconds). This is why with other websites you can still submit as password as it's about to change, but with XIV as soon as the password changes, it's instantly denied.

It'd be nice if SE would change their system to do this as well, but I'm just happy they're using a standard authenticator now so I'll live with it. If your password is about to timeout, just wait for it to change first :)

Edit: Also just adding, whatever software you're using to generate the code might not be looking at the current time and rather generating the password right now and just showing a 30 second timer. The password should be changed at :00 and :30 seconds in the minute, but some software just ignores that.

You can check by loading up your software to generate a code and then also watching the clock. If it changes at anything other than :00 or :30 then the software is wrong and that's why you get the login problems. As mentioned above with other websites this isn't a problem as they accept the passwords that come before/after, but XIV is more picky.

Quote:

---

Originally Posted by Valkyrie_Lenneth

I didn't say the app you use, I said the Google token specifically.

And not requiring it on login is basically disabling it.

I see most people recommending Authy.

---

I believe the feature he wants is part of Blizzards launcher.

If your device and IP address do not change, you don't have to log in again. When I load the app I'm auto logged in and don't need to use my authenticator again until I manually log out of the app.

It's no less secure from outsiders, as a different IP or device throws up a "enter authenticator code" message, but it is less secure from inside. Like your pissed off sibling can log in your computer while you're not there just to screw with you for example.

If I didn't fully trust my husband, I'd not use that option, and if I had kids around I'd *certainly* not use it, but it is definitely convenient.

It's basically protection from brute force hacks. No more, no less.

Quote:

---

Originally Posted by worldofneil

Although other websites will have their own rules, in my experience it's common that anything requiring a one time password would accept the current password, but also the password before AND the password after (so increasing the login window size from 30 seconds to 1 minute and 30 seconds). This is why with other websites you can still submit as password as it's about to change, but with XIV as soon as the password changes, it's instantly denied.

It'd be nice if SE would change their system to do this as well, but I'm just happy they're using a standard authenticator now so I'll live with it. If your password is about to timeout, just wait for it to change first :)

---

That.. sounds pretty dangerous. The longer the window the more likely that those phishing sites would get hold of the victims’ accounts, which defeats the part of the point of having 2FA.

I actually switched from the SE’s own app to Microsoft’s Authenticator in hopes of a shorter window, because SE’s own one felt pretty long.

Quote:

---

Originally Posted by Seleni

That.. sounds pretty dangerous. The longer the window the more likely that those phishing sites would get hold of the victims’ accounts, which defeats the part of the point of having 2FA.

---

Absolutely, although this is only a problem when users copy/paste links and give their information out without actually checking if they're official... Maybe SE had enough of people of falling for this hence the made it only a very short window.

Quote:

---

Originally Posted by Seleni

I actually switched from the SE’s own app to Microsoft’s Authenticator in hopes of a shorter window, because SE’s own one felt pretty long.

---

i can't remember how long the SE official app was for their OTP, but anything based on Google Authenticator's OTP system is in 30 second intervals so using another client doesn't make any difference as they're all still generating 30 second codes.