Security?

[RiversideGuy]

I see I can either go with a free mobile app or a piece of hardware so I can get my second free destination, I assume this is to enter that "one time passcode" in the launcher. What I want to know is does this get required every single time? "Over there" I have a hardware security token but as they track where my login comes from it rarely asks me to input the number. Having to drag out a mobile devoice to run an app is a serious pain if I HAD to do it every single time.

Also, I have been told these hardware generating code things are pretty universal... might the one I already have work for FFXIV?

Yeah, I CAN get the FFXIV one, but it's 15 bucks... that's a month of game time <lol>!

[EveK]

Yes, every time. Mobile app is free. Yes, the one you already have might work for Final Fantasy XIV. Specifically, the third-party ones that work are Google Authenticator and Microsoft Authenticator.

[DPZ2]

I see I can either go with a free mobile app or a piece of hardware so I can get my second free destination, I assume this is to enter that "one time passcode" in the launcher. What I want to know is does this get required every single time?

Yes, you will have to drag out your passcode device, whether thumb-sized or phone-sized, every time you launch the game. The same goes when you log onto Mogstation. But, it only asks once in a while for the forums.

[RiversideGuy]

Too bad every time (Blizzard wins this one hands down). Also too bad they don't do it like the fruit... I have 2F there, and when it asks for a code, said code automatically appears on the lock screen of my mobile iOS devices.

Wonder of I can register the software version on both a tablet and phone? My guess is not.

[Bearded]

The Blizzard app however is the Blizzard Authenticator - i.e. you can't use your own app
SE allows you to use whatever app you desire be it mobile or even desktop

I myself use the password feature within Safari so it syncs to iCloud and is on my desktop and mobile. It's convenience of choice over convenience of use I guess?

[RiversideGuy]

Well, Square will not accept the serial number from my hardware key generator, shame as I already have it. Curious if I go the software route, will I need to I put both a regular password and the generated code, or will just the generated code suffice? I mean, they call it a one time password….

[DPZ2]

Well, Square will not accept the serial number from my hardware key generator, shame as I already have it. Curious if I go the software route, will I need to I put both a regular password and the generated code, or will just the generated code suffice? I mean, they call it a one time password….

It's multi-factor authentication. Belt AND suspenders. Password AND 'one-time' (because it's continuously generated) code.

[EveK]

Yeah, it's called a "one time password" because you only use that unique password once. It's not good for a second time. The next time, you need to push the button again to generate a new single use password. Being able to use the same password every time would defeat the entire purpose of the function, which is increased security such that if someone gets your password they still can't log in without also having access to whatever device generates your one time passwords.

[RiversideGuy]

I am used to 2 factor where I use my password and get sent a unique code. Here I have to generate that unique by doing a bunch of stuff rather than automatically receiving it. Looking deeper, I wonder how insecure it would be if I ONLY used that one time generated, unique code? I mean I do have to tie my generating app with SE (essentially serializing it so SE recognizes it’s mine along), can a third party replicate that serialized app?

[ICountFrom0]

Curiously the cookie that can be used to identify your machine so that you don't need to sign in with two party authentication on WoW can actually be copied and faked, making it just a show of security, rather then real security.

Remember, two factor login isn't actually two factor if you sometimes don't have to use one of the two, if it can be skipped, ever, it can be faked.