Slashdot Log In
Blizzard Introduces One-Time Password Devices For WoW
Posted by
timothy
on Sun Jun 29, 2008 05:57 AM
from the status-symbols dept.
from the status-symbols dept.
An anonymous reader writes "Two days ago Blizzard announced that they will be selling keychain tokens to add one-time password support (FAQ) to World of Warcraft. Have compromised World of Warcraft accounts become such a serious problem, that OTPs are already neccesary for games?"
Related Stories
Firehose:World of Warcraft introduces One Time Passwords by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Not a problem... an opportunity (Score:5, Insightful)
Probably more like Blizzard has decided that people paranoid about having their accounts compromised have become such a serious market segment that it can eke out a few more pennies selling these dongles for 6 euros a pop.
If it was a huge problem, Blizzard would begin requiring them. The fact that they're optional means they're probably just a new way to sap a few more bucks from players who have invested so much of their time and being into this game that six euros seems a very reasonable security blanket.
It's both (Score:5, Informative)
It's both. Password stealing via phishing and other means has hit quite a few MMO's. It boils down to dumb users mainly, and Blizzard surely sees a profit opportunity in their stupidity.
Parent
Re:Not a problem... an opportunity (Score:5, Informative)
Thank you Mr. Conspiracy theory. But the truth is that:
- There is a serious problem in WoW
- It is extremely common for accounts to get compromised
- Sometimes people quit the game after a breakin (-$13/month)
- A 30 second google search found similar devices for between $17 and $23 a go
If I had to guess I would imagine Blizzard breaks even roughly on these devices. I can't imagine there being a huge profit margin on $6 and that they justify it by keeping people playing.
Parent
Re:Not a problem... an opportunity (Score:5, Insightful)
A cancelled account of mine got hacked somehow, and I only discovered it months later when I went to reactivate it. Blizzard basically said "sucks to be you, we won't do anything". My first level 60 character is gone forever, which makes me kind of sad.
Blizzard will, apparently, not fix all problems.
Parent
Re:Not a problem... an opportunity (Score:5, Informative)
My account got compromised a year after I quit, and I only discovered it because I got an IM from someone who saw my character log in and wanted to know if I was playing again. My password was good enough that no one was going to randomly guess it, and I certainly never gave it out.
My best theory on how it happened is that I used the same account and password on lots of web forums, many of which have terrible security. Someone probably hacked into one of them and tried all the user/pass combos to see if they were also WoW accounts. I took a look at my old characters on armory and noticed that my lowbie alts had been stripped and my main moved to another server. I figure whoever got access probably sold the account to a clueless buyer because I can't imagine someone paying for a character transfer otherwise. I also wouldn't be surprised if people made a lot of money doing this. Lesson learned: use unique passwords (or usernames) on any accounts you actually care about.
Blizzard reset my password, but refused to transfer my character back to his original server because I "willingly gave out my password." I didn't intend to ever play again anyway, but service like that certainly sealed it. They didn't care one bit about catching the person who did it either, despite having IP addresses and even credit card numbers.
Parent
Re:Not a problem... an opportunity (Score:5, Insightful)
My best theory on how it happened is that I used the same account and password on lots of web forums, many of which have terrible security.
There is your problem.
I know we are all lazy when it comes to passwords, but you really need to keep different passwords for different things. It doesn't mean you have to keep completely different passwords for everyone forums so my personal rule is to have levels on how much I care about it being breached.
Level 1: Random forums I don't trust or places I don't care if hacked.
Level 2: Places I frequent that I trust and have a reputation, but its not going to kill me if my account is breached.
Level 3: Stuff I pay money for. Like Online Games, Steam, utility bills, and cell phone plans.
Level 4: Money. Banks. Credit cards. And/or anything that is serious business. This also includes email accounts attached to them which I keep completely separate passwords between accounts since it would be dumb to have the same password for your bank as your email. Also I tend to keep different passwords between financial institutions because I don't trust competency of employees and their laptops.
The goal is to never use the same password between the levels so if one is breached the others are not.
So if it is that important to you, then don't use the same passwords on untrusted sites or forums that use unpatched vBulletin or PHPbb. I mean... I don't even trust Slashdot.
And it never hurts to paranoid and change your passwords every 6 months or if you just suspect something. Its not going to cost you anything other than mental exercise if your wrong, but it saves you a whole lot of grief if you are right.
Parent
Re:Not a problem... an opportunity (Score:5, Funny)
Hey were you the subject of a Dilbert comic a while back?
Parent
Re:Not a problem... an opportunity (Score:5, Funny)
These things cost way more than $6 to make
Yes, maybe if you handcraft them in Norway from reindeer horns and freshly clubbed seal, but in the rest of the world you can buy a USB memory for less than this.
Parent
Re:Not a problem... an opportunity (Score:5, Informative)
Depends on who is making them.
http://www.entrust.com/strong-authentication/identityguard/calculator.cfm [entrust.com]
Entrust here likes to advertise they're 1/7th as expensive as the ones RSA sells, and those are still $4/year.
So at $6 until the token dies, Blizzard isn't exactly making a mint on these things. The profit for them comes in reduced account restorations.
Unless you'd care to source me someone who sells them so cheap that Blizzard is making a fortune at these prices, since there's probably also costs for the server end of the setup?
Parent
can't beat stupidity (Score:5, Insightful)
Its not the system that has a flaw, its the stupidity of people for giving away their usernames/passwords for powerlvling etc.
Re:can't beat stupidity (Score:5, Insightful)
Parent
There are those who could learn from this... (Score:5, Funny)
Wowzers, now I can have more security for my account on some computer game than my online banking (I'm looking at you, Citibank).
Re:There are those who could learn from this... (Score:5, Funny)
Hmm... let's see... The average WoW addict is playing 30 hours a day, has most likely no job...
What do you think is worth more, the account of such a person or his bank account?
Parent
Re:There are those who could learn from this... (Score:5, Funny)
They both probably are about equally low in worth.
Parent
The first thing that comes to my mind is... (Score:5, Insightful)
Why can I get this feature for a MMORPG account, but not from my bank, or any other banks I know of?
I value my real money far more than imaginary swords, shields and armor that exist as bits in an entertainment company's database.
Maybe some people's priorities are different...
Re:The first thing that comes to my mind is... (Score:5, Informative)
Parent
Re:The first thing that comes to my mind is... (Score:5, Informative)
Barclays have been providing a device they call PIN Sentry since early 2007:
http://www.barclays.co.uk/pinsentry/ [barclays.co.uk]
NatWest introduced their offering summer 2007:
http://www.natwest.com/microsites/general/card-reader-user-guide/index.asp?cmp=reader [natwest.com]
I believe you're right about Lloyds not having followed suit just yet.
Parent
Cheap (Score:4, Insightful)
6 euro protecting 1000s of hours of time spent, it's a no brainer.
Other Authentication (Score:4, Interesting)
I was listening to The Instance, which is a WoW podcast and one of their topics concerned Taiwanese WoW players. They had the option to sign up for a different type of secondary authentication which required them to register 3 different phone numbers. You couldn't completely log in unless Blizzard received a call from one of said phone numbers.
Considering the amount of time people have devoted into these accounts, I don't see this being that big of a deal. As a player, I'm not too sure I'd get one, as I try to avoid random websites, certain browsers and suspiscious addons. The current belief now, however, is that people cracking into wow accounts are using more brute force methods instead of trojan/spyware etc etc (but it's not like those have completely disappeared.)
There's nothing wrong with a little extra security, especially when you've played for 3 years.
Also (Score:5, Interesting)
I can imagine that the problem of hacked accounts is *huge* and primarily a problem on the user's end. I'd wager a guess that Blizzard's largest demographic sometimes also engages in P2P/Warez in conjunction with poor security habits. Trojan-laden warez, account sharing, piss-poor passwords and wide-open PC's; users leave themselves wide open to getting their virtual goodies ransacked and run off with.
I played WoW for 4 months a few years ago and was surprised at the number of trojans packed in the executable installers of some popular UI mods.It wasn't a very clever(but it was effective)way of farming usernames and passwords. Considering the global reach and sheer numbers of people playing WoW, and the virtual goods for real life cash trade, I wouldn't be surprised to learn about WoW-specific trojans running around in the wild. Some people make it easy for the bad guys; using the same login details on WoW related forums as their actual wow account, to purchasing gold and other items from shady websites (good way of farming cc numbers, shady websites also use cc info to pay for their own account time, leading to charge backs and other hassles)to just flat out sharing their details willy-nilly with anyone half trusting.
And there's no evil in Blizzard charging two cups of coffee for an extra layer of protection. I'm sure they've spent oodles and oodles of cash in the past dealing with these issues, so there's nothing wrong with recouping past costs and helping to avoid a portion of future expenditures.
I would appreciate separate user names and passwords for account management and character login, too.
Re:Also (Score:5, Insightful)
I don't even think they are trying to recoup costs, it's just a token amount so that every single user doesn't click the 'give me a free token' button. People love getting free stuff, even if they don't need it (or is it just my wife that does that? Hi wife, if you are reading this
Parent
Long Term evolution... (Score:5, Insightful)
Phase 1 : OTP is a plus that you may buy
Phase 2 : A free OTPtoken with each WoLK extension sold
Phase 3 : A collector edition with WoW+BC+WoLK+token
Phase 4 : Mandatory token for all accounts
That way, they cut the grass under the feet of the chinese farmers who sell ready to play accounts and to the reselling of accounts on E-Bay and such...
Re:Bilzzard? (Score:5, Funny)
I believe they wanted to spell it "Bill-zard"
base client: 25 bucks
bc client: 25 bucks
name changes: 10 bucks
realm chances: 25 bucks (per character, that's 250 bucks if you are transferring off a realm on which you were established)
wrath of the lich king: (unknown, but be prepared to chop up your first born son)
Parent
Re:Bilzzard? (Score:5, Funny)
wrath of the lich king: (unknown, but be prepared to chop up your first born son)
I'm sure there are a few WoW addicts who wouldn't consider that an unfair deal to be in the WotLK beta...
Parent
Re:Security Theatre (Score:4, Insightful)
I'm not security unconscious either [...] no control over what other uses the computer you play on is put
One might argue that a security-conscious person would not let any random people share his computer, unless it had a very safe multi-user system.
Parent