Results 1 to 3 of 3
  1. #1
    Player
    TyrFeyrbrand's Avatar
    Join Date
    Jan 2019
    Posts
    2
    Character
    Tyr Feyrbrand
    World
    Valefor
    Main Class
    Samurai Lv 70

    Feature Request: "Trust this device for 30 days" when logging into launcher

    It is what it says; just about every other app out there does a variation of this, so why do I need to keep plugging codes in from my phone just to login, when it's always the same two PC's?

    As far as account security is concerned; it's optional.
    (1)

  2. #2
    Player
    HyoMinPark's Avatar
    Join Date
    Feb 2016
    Location
    Lavender Beds, Ward 13, Plot 41
    Posts
    7,339
    Character
    Hyomin Park
    World
    Cactuar
    Main Class
    Sage Lv 92
    Is this about the One-Time Password? If so, the reason you have to re-enter a one-time password each time you log in is because the password only works one time.
    (0)
    Sage | Astrologian | Dancer

    마지막 날 널 찾아가면
    마지막 밤 기억하길

    Hyomin Park#0055

  3. #3
    Player
    TyrFeyrbrand's Avatar
    Join Date
    Jan 2019
    Posts
    2
    Character
    Tyr Feyrbrand
    World
    Valefor
    Main Class
    Samurai Lv 70
    Quote Originally Posted by HyoMinPark View Post
    Is this about the One-Time Password? If so, the reason you have to re-enter a one-time password each time you log in is because the password only works one time.
    Yes, the "password only works once" - it's a time-based value used to prove that you have a second factor of authentication. By nature it will only be valid once.

    However, "Why won't my one-time password work more than once" this isn't what it's about.

    My identity has already successfully been validated using the full MFA process, so just like Facebook, Google, Ebay, Steam, Epic, Blizzard, Ubisoft, Origin, Cisco, ... (you get the point [I hope]), it should now save an authentication token (based on the machine ID of the computer) that's automatically used and valid for a certain period of time before I need to re-authenticate. When I next launch the game, it should be a simple fair of clicking play.

    Many things can invalidate this token, such as but not limited to;

    * Machine ID of the token not matching the existing machine
    * Certain period of time elapses without refreshing the token
    * Token is used from a different control or IP range than last authenticated

    For those that are on shared machines or don't trust their devices security, there is no need to move away from current practices. For the rest of us, SE could join the rest of the modern web and offer this ability.
    (3)