GW2 Account Security Beta

They've turned on the 2 factor auth beta. Go protect your account now! https://forum-en.guildwars2.com/forum/info/news/Beta-Feature-Mobile-Two-Factor-Authentication

Good on them for getting this set up. Wish I could take advantage of it.

I was wondering when this was going to happen - I already use authentication tokens for Battle.net, GMail, and various work functions and it was one thing that I really felt was lacking in ArenaNet's security portfolio. I'll wait until it's out of beta, but am super pleased that it's finally being offered. Hopefully they'll offer physical authenticators at some point so those without smartphones can take advantage of this as well.

» Edited on: 2012-10-11 07:20:22

I use the app on my phone for my gmail, and am a bit confused if it will be the same code for my game. So I am hesitant to set this up until I see a bit more explanation.

The app is tied to the account email used. So each one has there own code on a timer. If your email is the same as for GW2, then the code would be the same. I think... That should not stop you from using it.

They're sing the Google authenticator? Huh. I didn't realize Google was letting anyone besides, well...Google use their authenticator. That's strange; I wonder why they didn't choose to implement a solution from RSA directly instead of opting into Google's service. I also use the GMail authenticator on my phone and while I like it for my Google-related security, I'd rather keep my peanut butter and chocolate separate. It'll be interesting to see how this pans out in the coming weeks.

RSA is fantastically expensive, requires a lot of infrastructure, a lot of management, and, frankly, a lot of risk (getting compromised is not something that just goes away, especially when you're the leader in two-factor authentication). Their smartphone app sucks really super bad, and their physical key fobs cost hundreds of dollars each. Google Authenticator, on the other hand, is much less expensive, and is operated as a cloud service - ArenaNet signs up for it, integrates the capability with the game client and their existing authentication infrastructure, and then it's more or less hands-off. Magic Google handles everything, and it just works. This is a little lazy on ArenaNet's part, but it's understandable, I suppose, given that none of us are paying a monthly fee. I really wish they would offer a physical token, though. Then I, and everyone else who doesn't have a iOS, Android, or WP7 smart phone, could protect our accounts too.

Anet had their own Android/iPhone authenticator in alpha stages from what I understand, but the large number of hacked accounts seems to have convinced them they needed to act faster. Its super simple and works great so far, not really sure why they decided to say it was beta. As far as I know anyone can use the authenticator with just a bit of coding knowledge. It can even be added to any website, if you really wanted. Physical tokens may be in the works still, not really sure on that front.

Winterbeard, that's exactly my concern.

Arowfell, let me preface this by saying that I'm not trying to call you out or devalue your comments, so please don't take this post as a personal affront. I just happen to have differing opinions on this topic than you seem to, and my experience in this arena compels me to point out the flaws in a couple of the things you've said. So, yes. RSA is expensive, but "fantastically expensive" is a bit of hyperbole. I know how much RSA solutions cost, as I've sourced and implemented a number of them for clients; most recently the St. Louis City Circuit Attorney's Office, where security is - as you might imagine - a Very Big Dealâ„¢. Cloud authentication was an option briefly on the table along with Barracuda, but both fell short. I have a very strong suspicion that ArenaNet and their sugardaddy, NCSoft, both have a considerably larger amount of expendable income at their disposal than any of the clients I've worked with, so I wouldn't put too much weight on cost here. As for the benefits of a web-based service over a physical appliance, none of those outweigh the inherent security risks. Given that 2-factor authentication is implemented solely as a security precaution, I'd expect securing the system all the way down the line would be taken into consideration. As you no doubt know, the more avenues of approach you have from the outside world to a system, the more risk is introduced. I'd sooner trust RSA, as a company that hangs its hat solely on security and their continued reputation in that arena, than Google, a company which already has its fingers in far too many pies and has a known history of taking security and privacy a bit too lightly. All of that having been said, please just take this as a contrasting viewpoint for the edification of other people who may be interested in this topic, because at the end of the day that's really all it is. Neither of us has any pull in how ANet chooses to secure its customer accounts. I do agree with you completely that physical token would be best, though, and I still hope it's true that ANet is rolling their own and just using Google's service as a stopgap. I'll just have to wait and see.

» Edited on: 2012-10-14 14:07:26

» Edited on: 2012-10-14 14:08:31