Password Reset Security Flaw

[Canadane]

The token is far from a hassle.

[Aerowaffle]

OP, I would like to add that this would probably be better to post in either Technical Support (http://forum.square-enix.com/ffxiv/f...hnical-Support), or Website Bugs (http://forum.square-enix.com/ffxiv/f...4-Website-Bugs).

As general discussion is mostly composed of the community and not people who can actually do something about a problem like this.

[Theref]

Well if you think token is a hassle, Your choice

[Chihaya]

The fact that they got your SE Account password and you don't use a token = you're most likely screwed even if they send you an e-mail.

[Nicobo]

And a lot of people won't use a token since it's a hassle...

Do you know there is in-game bonus for one-time password users?
IMO using a token absolutely is an advantage for long term players. ^^;

[Kosmos992k]

Two factor authentication, what's hard to understand. Out of all the compromised accounts hijacked by RMT, I'd bet none used the security token. Personally, I think it's time to make two factor authentication mandatory.

Technically, PS3/PS4 playerswith a security token have 3 factor security since PSN authenticates you and your license, then SE takes your password and one time security code.

[Lexia]

Not everyone has a security token or a device able to use one. And a lot of people won't use a token since it's a hassle. And anyone would expect to be notified when ANY change to my account is made.

So getting a $10 token that will secure you account is a hassle? That like having a safe but leaving it open all the time cause it too much of a hassle to enter the combination every time.

[mbncd]

So getting a $10 token that will secure you account is a hassle? That like having a safe but leaving it open all the time cause it too much of a hassle to enter the combination every time.

The phone software token is free.

[Lexia]

The phone software token is free.

They said they didn't have a device that could run the software token so they would need the physical one.

[mbncd]

They said they didn't have a device that could run the software token so they would need the physical one.

They said a lot of people don't have one, but they also said a lot of people won't use any kind of OTP because it's a hassle. It's unclear exactly what they have or what they're willing to do.

I would not however recommend buying a dongle token over getting any smart phone or iphone released in the last 10 years, for the simple fact that they can easily get one of the latter from a friend or family member for free when they upgrade to a more recent phone, and a phone is more universally useful and harder to lose. (I can't count the number of times I've spent an hour looking for something that fell behind a cupboard or something and wishing I could simply call it to find it...)