One time password /sigh

[Souljacker]

The amount of people complaining about this is quite silly... Once you attach a one time password they even tell you that you need to log on to your mog-station and write down the recovery password in case you lose your one time token or your phone app resets for some reason.

You didn't follow their instructions properly and now you're complaining about it. Unfortunately now that you've put yourself in this situation you have no choice but to call Square-Enix. Good luck.

Except that this feature didn't always exist, and if it did, it wasn't communicated well because I didn't find out about it until very recently when I switched to the software token from the hardware one I got back when it was first offered in XI.

Other games handle this in a much more efficient way. If you reset your phone, you have to remove the token and reattach it. Other games have a process to just recover the token to the new device that doesn't leave you vulnerable (I realize it's a very short time, but it's a vulnerability nonetheless).

[DragonFlyy]

snip

Just because it hasn't happened to you, doesn't mean it doesn't happen. The biggest use an account is to be compromised is for botting. They take your account and farm daily on it, sending that gil to another account that they did buy. Store it there, then make a level 1 character on your account and start advertising gil until the account is closed. Then they take the next account they stole and do the exact same thing. It really has nothing to do with your gear, and more to do with how fast they can make money off the account by botting before the account is cancelled.

[kidvideo]

I really doubt it happens this way. Strong passwords, common sense.

Also, SE makes you link you account to the software license. Any changes or updates to the SE account generate an email notification. For a "hacker" to be that determined to hack the account, register THEIR copy of the software to my account, intercept the notification email... just so they can rmt, bot or merch my gear? You'll never convince me it's worth all that effort.

[Morsmordie]

Except that this feature didn't always exist, and if it did, it wasn't communicated well because I didn't find out about it until very recently when I switched to the software token from the hardware one I got back when it was first offered in XI.

Other games handle this in a much more efficient way. If you reset your phone, you have to remove the token and reattach it. Other games have a process to just recover the token to the new device that doesn't leave you vulnerable (I realize it's a very short time, but it's a vulnerability nonetheless).

If you looked through the thread properly you would have noticed that I actually said something like this on page three. I even gave an example of other games and how they handle the recovery process of phone apps.

[TeganLaron]

Jeez, all the people having a go at the guy. I use the one time password set up and never at any point was I informed about this emergency removal code (and yes I read all emails etc.) It's definitely something I'll look into now though.

As for OP, hope you get things sorted.

[Taylor-MadeAK]

I really doubt it happens this way. Strong passwords, common sense.

Also, SE makes you link you account to the software license. Any changes or updates to the SE account generate an email notification. For a "hacker" to be that determined to hack the account, register THEIR copy of the software to my account, intercept the notification email... just so they can rmt, bot or merch my gear? You'll never convince me it's worth all that effort.

Only for the PSN version. The PC version has no such restriction. You can take your username and password that you use with your PS3/PS4 version and login with the PC client on any computer anywhere in the world the authentication system doesn't care. No e-mail is generated. No red flag is raised. No alarms are sounded.

Just because you don't think it's worth the effort doesn't mean that it doesn't happen. Over, and over, and over, and over. Being a console gamer does not protect you.

[ispano]

Only for the PSN version. The PC version has no such restriction. You can take your username and password that you use with your PS3/PS4 version and login with the PC client on any computer anywhere in the world the authentication system doesn't care. No e-mail is generated. No red flag is raised. No alarms are sounded.

Just because you don't think it's worth the effort doesn't mean that it doesn't happen. Over, and over, and over, and over. Being a console gamer does not protect you.

Uh, actually you can't. It won't let you log in with the PC client unless you have a PC code on said account.

[Tashigi]

Is this thing really worth the trouble? For some reason the phone app has reset. In order to reactivate the phone app you need a password provided by your ?Mog Station account? To get into your Mog Station account you need your one time password.

This isn't the first time this has happened, I'm pretty sure the only fix is to call SE and play 20 questions unless there's something I don't know about. Which of course is during business hours only.

Anyone besides me see a problem with this?

I am sure someone else has suggested it but here I go...

I use two-way authentication (One Time Passwords) for everything from Google, Microsoft, Blizzard, Arenanet, etc accounts.
Yes, your issue has come up a couple of times on my end. However...
An easy way to fix this is by emailing yourself or creating a draft under an already protected email account, that you know you can access with ease, despite two-way authentication security, such as Google/Gmail.
Then, you can store your security/password code provided by the service and if something goes wrong, it's just a few clicks away.

I haven't had any problems by doing this.
Sure, it's a little bothersome to us, but it's definitely worth the additional security wall.

[kidvideo]

You can take your username and password

Which these mysterious hackers of yours do not have.

Anyone trying to use my account for illicit purposes would need to make a distinctive change that would generate an email notification. If you understand how SE's account system works it should be obvious. Yet, it's just not going to happen. (insert your own /font /fontcolor /underline for my emphasis if you wish)

[Taylor-MadeAK]

Which these mysterious hackers of yours do not have.

Anyone trying to use my account for illicit purposes would need to make a distinctive change that would generate an email notification. If you understand how SE's account system works it should be obvious. Yet, it's just not going to happen. (insert your own /font /fontcolor /underline for my emphasis if you wish)

Clearly you are an IT Security expert and I bow before your superior intellect.