Software Token?

[RiversideGuy]

Don't get me wrong, even though I had to endure 2 weeks of being kinda ignored, I finally got through to someone who READ my ticket, and acted for me in getting me back my account. In one of my many writings, I said I'd better secure my account, so I read all the stuff and went with the iOS software token (I've never seen any iOS software being rated 2.2 there, but I managed to catch the one terrible UI thing that got MANY folks to give it a 1 rating). Set it up, everything is cool, if a bit of a pain.

There was one potentially troublesome spot involving using the emergency removal code... the page where you enter it in say you'll get an email to finalize the process. Immediately made me nervous because there is a long standing bug (or just piss poor design) where SOME auto mails simply never get sent to my address. BUT if I change to a gmail address I never use, bingo, it goes through. Definitely something on their end.

So I create a ticket to see if this might be the case for me... oh boy. First, nine of the messages I sent to them were ever actually read. I got a bunch if boilerplate marketing crap. I was getting nowhere. So I asked a few simple questions, arranged so it was a yes or no answer. Based on that, I was going to experiment to see how much it worked in the real world. So what do they do? The removed my protection! Unbelievable.

So, let me try and ask the questions they seemed incapable of answering. If I go for removal and get the conforming email, all is fine, no issue. BUT what if I do NOT get that email?

What does their system do? Does it remove the one-time password so that I can re-apply it at some future point? Or does it simply keep on using the OTPW? Or does it reay muck things up, not allowing me to use the generated token anymore... meaning I am now locked out of both the game AND my account (which also need the OTPW to access)?

No I don't anticipate having issues where I lose access to the token generating app. BUT I want to be prepared for some of these kinds of SE issues (issue is I doubt the game devs work on SE infrastructure or there wouldn't be as bad as they are). Oh, one last thing... 6+ years ago I ran into the same issue... I could NOT register to use these forums because they would not send to my account email (which works just fine in all other aspects).

[EveK]

When you remove a security token from your account, the email it sends is just a notification. You don't need to do anything with the email. If you never receive or read it, the token is still removed.

[RiversideGuy]

Ohhhh, somehow I got the idea it was some kind of confirming thing, like some numbers to splash back at SE. The page says "Send Mail" in a big huge red button... like you can NOT skip this step.

I did find out that to get it rolling again, I HAD to delete the app and all it's data because it provided no way to go back to the initial registration step. Sloppy software design, no wonder it got such crappy rating.

[NelTu]

My only gripe with the token is why can't we either get Push notifications for approval if you use something like MS Authenticator. Also remember my location so I only need to re-authenticate if my public IP changes or every few months. The push notifications would go a long way though.

[RiversideGuy]

Yeah I was not real happy that they do not remember my IP address so I have to find my phone every time I want to access my account in any way. Blizzard does this, they do randomly ask for it, but very rarely. Some might bring up that addresses can be spoofed, well the fact is it is far from easy to actually spoof an address, and way more of a challenge to find out the address that connects me to the SE servers. There is no worthwhile end game to going through this hassle… and I’d bet you the RMT folks make almost nothing from in-game spam with how quickly SE suits them down, they make their coin off external websites where they have no need to log into the game.