Comments on: On Security

By: Jack

Jack — Mon, 04 Aug 2008 17:33:33 +0000

I’ve activated my authenticator now….
As I see….
Authenticator is need for both login to play AND for web account managment…..

To detach the authenticator you have two methods…
If you have the authenticator and no longer want to use it…. just login in account managment and detach it

otherwise, call customer support

By: me

me — Wed, 30 Jul 2008 19:54:44 +0000

so what’s the latest on this? has blizzard ever admitted their responsibility in individual hacking / social engineering hacks?

By: Jack

Jack — Wed, 30 Jul 2008 00:39:59 +0000

Any follow up?
thanks

By: Is the Authenticator Safe? | 8 Bit Culture

Is the Authenticator Safe? | 8 Bit Culture — Sat, 26 Jul 2008 09:37:25 +0000

[...] post hints that a keylogger may be the culprit. Further, the victim’s co-guildie posted more information about the attack. Aside from the attack itself, there is the lasting effect of the authenticator [...]

By: Fiordhraoi

Fiordhraoi — Fri, 25 Jul 2008 18:13:07 +0000

Don’t get me wrong, I think that the authentication system is a great idea in theory. I wouldn’t have bought one otherwise.

But for any security system to work, there has to be training and procedures to make sure that it is not subverted by the people who have control over it.

THAT is why I think this story is important. The most likely scenarios are that one way or another, a Blizzard employee was mislead, tricked, or convinced to remove the authenticator from the account.

Now, if the “theory” some people are pushing (at least on WOWinsider, etc) that someone she knew managed to get into her house and get her CD key, and knew the answer to her secret question, etc, then it is understandable and the blame doesn’t lie at Blizzard’s feet. Unfortunately, being that she lives alone, the possibility of it is rather remote – no convenient “pissed off roomate,” etc.

That is why I think this situation should be investigated as quickly as possible. The odds are that Blizzard’s staff is not doing what they should be, and that needs to be remedied ASAP.

By: Teresa

Teresa — Fri, 25 Jul 2008 16:23:49 +0000

Honestly, the only way I see they could have gotten in was via Social Engineering. I’ve done Customer Service, and a lot of the time, even though its policy for Customers to fully identify themselves, some co-workers will just be lax/lazy and just go through with things without fully identifying the caller, and making sure they’re who they say they are. Part bad training, part bad employee.

As to the authenticators.. The only way a keylogger could have used the authenticator’s password, is if the OP & the keylogger hit enter at the same time. Once you hit enter to log in, the authenticator password used becomes disabled so you CANT use it again. The only way to get around this is if you had 2 computers, typed in passwords, typed in Authenticator passwords, and hit enter on both computers the same second.

By: Pat

Pat — Fri, 25 Jul 2008 15:27:56 +0000

@me
Yeah! Jump on the Blizzard hate train! Did it escape your attention that Blizzard didn’t “sell these when they offer limited protection”? The fault obviously lay outside the authenticator system itself. Grow up.

By: JdJdJd

JdJdJd — Fri, 25 Jul 2008 14:25:38 +0000

There is another possibility that I don’t think I’ve seen mentioned.

Someone at Blizzard (probably low level employee, GM, ect….) who has access to the right information is selling accounts. I’m not saying this is what happened but it’s possible. They don’t make a lot of money.

Fiordhraoi has the other options above. The one I’ve listed and the Blizz employee making a mistake are probably the most likely/easiest to accomplish.

By: Fiordhraoi

Fiordhraoi — Fri, 25 Jul 2008 14:18:16 +0000

@Phoenix

Yes, to log into account management, or even just the official WOW forums, you are asked to provide the token key.

By: Phoenix Lawin

Phoenix Lawin — Thu, 24 Jul 2008 23:36:07 +0000

I dont have an authenticator because I live in a different part of the world, but was just wondering — are you asked for an authenticator ID when logging in to your account online via the website as well? Because if they don’t…. that’s just pretty dumb. Two ways to log into your account and yet leave one of them vulnerable?