Security tokren questions:

[SamSmoot]

1. Do you have to use it for every login, or just when the user's IP address changes?

2. Does it also allow you to log in without entering a password?

3. Does the free teleport that comes with it have no cooldown?

[MeowingKittens]

1. Every login. But it will prevent the force password reset from a changed IP entirely.

2. Still need to enter password.

3. No cooldown, simply 0 gil cost.

[SamSmoot]

1. Every login.

Thanks, but that kills it for me. Already takes too long to log into the game without having to take out my phone, unlock it. find the app, generate the number and enter it. Wow's system is much more convenient. Only used if IP has changed, and just tap a button in the app to authenticate (It talks to the server) instead of having to enter the number manually, which still can be done if phone has no connection.

[Brynne]

I use the security token (physical) and wouldn't want to change that, but I'll admit it's a pain sometimes. It applies to EVERY login on every platform that uses my SE account, including the mogstation, lodestone, and the forums. And the companion app, whenever it decides to boot me off for whatever reason. It's really inconvenient. I have considered switching to the phone app just because I have my phone with me everywhere, unlike the physical token, but I've heard people have had problems with it so I'm not sure if I want to risk it.

[DrWho2010]

omg ppls is it that hard to put in an extra entry when you log in. First World Problems.

[Brynne]

First World Problems.

Just about every complaint on this forum qualifies for this lol

[Valkyrie_Lenneth]

It is the most secure way to do it though, even if it is a bit inconvenient.

Compromising security for convenience isn't exactly a good thing.

Mines been I use for 8 years now, since 1.0. Never had an issue, and my account hasn't ever been hacked.

[worldofneil]

Already takes too long to log into the game without having to take out my phone, unlock it. find the app, generate the number and enter it.

Obviously I can only speak for myself, but you get used to it. I've had it on my Square Enix account for nearly 10 years now and I don't think twice about it any more (2009 to 2013 as the physical token and 2013 to now as the app). You said about problems finding the app so I would recommend just put it on the homescreen of your phone if you can. It generates a password immediately on opening without you needing to do anything else.

Wow's system is much more convenient.

Perhaps, but I'd personally take the extra security over a bit of convenience and after all these years I can't really see SE changing their stance on it.

just tap a button in the app to authenticate (It talks to the server) instead of having to enter the number manually, which still can be done if phone has no connection.

Erm... that's actually impossible. If you have no Internet connection, your phone cannot talk to the server. It's probably just using mobile data instead of Wi-Fi.

I have considered switching to the phone app just because I have my phone with me everywhere, unlike the physical token, but I've heard people have had problems with it so I'm not sure if I want to risk it.

They give you an emergency password and as long as you have a copy of this then you can easily sort it out. Although there are apparently some issues for anyone who uses Google Fi, the majority of people with problems are because they didn't make a note of their removal password and had to resort to contacting Square Enix to sort it out (even with the Google Fi issues, if you have the password you can sort it yourself).

Edit: If you do change from a physical token to a software app it will also disable the physical token so you unfortunately can't go back. I have no idea why they don't let you reuse an old token, but that's just how it is. If you wanted to go back to a physical token you'd have to purchase another one.

In all the time I've used the software app I think I've only had to use my emergency code 3 times. Once when a phone died, another time when an operating system upgrade broke the app and the third time was actually the app itself having a problem and resetting for no reason, but 5 minutes later I had removed and readded it and on my way again! Not bad for nearly 6 years of use!

-

At the end of a day it's a personal choice whether anyone wants to use it or not though. If you only ever login from one location then SE's own location check/force password change would probably be sufficient, but if you've put any serious amount of time into your character, is it really worth the hassle of what might happen if someone breaks in to your account?

[LineageRazor]

If you play on PC, definitely get a token. Stolen accounts always have been and always will be a hot item, and unsavory types are always finding new ways to slip through the cracks. As an example, I remember an incident during the days of FFXI where a browser pop-up add introduced a keylogger or something into players' PCs, and a number of FFXI players accounts were stolen as a result. The pop-up was common on sites FFXI players went to for game info - so, basically, players were losing their accounts simply by browsing the same websites they usually do.

While that little trick would likely be difficult to repeat nowadays, the search for security vulnerabilities continues, and no system can be said to be 100% safe. You don't want to be part of the 0.1% of players affected when someone manages to find a way in. Multi-factor authentication is a huge step-up in security.

If you don't play on PC, you're less of a target, but presumably you still have to log into the Mogstation from time to time, for instance to chance credit card info when your card is about to expire.

Having to enter a six-digit code every time you log in might seem like a pain, but it's really not that bad. The extra security is well worth it, and the free teleport is lovely, as well.

[SamSmoot]

[QUOTE=worldofneil;4870916
Erm... that's actually impossible. If you have no Internet connection, your phone cannot talk to the server. It's probably just using mobile data instead of Wi-Fi.[/QUOTE]

If the phone has an internet connection (wifi or mobile), the app checks the server when you start it, and if there's an authentication request pending, it just lets you click a button to verify the login attempt is legitimate. If no connection, then it generates the usual 6-digit time-based code that you then have to transcribe manually into the login page.
The ability to just tap a button would make it a bit easier, but still, the problem of having to physically deal with the phone for every login makes it a major pain for me. (On the other hand, I just realized I don't have to switch between a bunch of alts in this game, so I only need to long in once per session, so I signed up. If it's too inconvenient, I can still disable it. )