World of Warcraft®

02/17/2011 8:23 AMPosted by Dartaneon

i was under the impression that the phone in authenticator works by recognizing what IP address you normally use, then requires authentication when using a different one. So, wouldn't that be pretty darn secure short of someone logging onto my account from my computer?

It should be quite secure. I believe it's very difficult at best to spoof an IP address to Blizzard's servers.

If you're on a local network, though--especially a wireless network--there is the possibility a roommate, neighbor, or a stranger that comes near your residence could easily spoof your IP address.

Also, your ISP (Internet Server Provider) may change your IP address from time to time.

Lastly, if you ever travel and your phone's battery is low for whatever reason, or you haven't updated your phone number on record after changing it, you will not have legitimate access to your account until you've gone through whatever reset procedure Blizzard uses.

ahh, very good points, i'll have to go home and make sure my wireless lan is secure.

I imagine the changing IP address is precisely the issue -- there must be some leeway built into the system to allow for some changes. The question is then regarding the looseness of their system.

The more traditional authenticators, on the other hand, require some rather nasty malware installed on your computer capable of spoofing log-in screens, and would require some quick action on the part of the malicious party -- they can't wait until later to use your login information, they must use it immediately, and as far as I know they can only cause disturbances until their login is interrupted.

The more traditional authenticators, on the other hand, require some rather nasty malware installed on your computer capable of spoofing log-in screens, and would require some quick action on the part of the malicious party -- they can't wait until later to use your login information, they must use it immediately, and as far as I know they can only cause disturbances until their login is interrupted.

A simple key logger could give someone a tiny window to log in. However, the small length of time available to log in and the tremendous amount of time required to perform cryptanalysis to determine what key will be valid at any other given time deters practically all account hackers and scammers from putting any effort towards it.