Please upgrade your browser for the best possible experience.

Chrome Firefox Internet Explorer
×

Major Security Threat - Authenticator useless

STAR WARS: The Old Republic > English > General Discussion
Major Security Threat - Authenticator useless

Templeman's Avatar


Templeman
01.29.2012 , 07:16 AM | #111
Quote: Originally Posted by Pastorfrog View Post
OP makes a really valid point, though. If there's a backdoor around the authenticators, that's a -major- issue.
this+1

Urko's Avatar


Urko
01.29.2012 , 07:19 AM | #112
Apparantly theres players who ive heard of even having WoWs authenticator hacked, if its hackable there will be someone trying to hack it.

Make sure your PC is secure with a GOOD antivirus/firewall/*malware and you should be ok (nothings ever 100% i guess)

* Ive never had faith in free ones or windows own , Kaspersky here for 4 years and it rocks.
Well done Patch 1.2, lots of additions that i was looking for.

HELhikari's Avatar


HELhikari
01.29.2012 , 07:44 AM | #113
That's quite a **** up on someone's part. Although in theory they still shouldn't be able to gain access to SWTOR via your account; you still need the authenticator to get in to the SWTOR site itself and in to the the game.

(Also, rule one of a compromised system is to treat everything as compromised - the only way to fix it is to reformat and reinstall)
[HEL]hikari
Peace is a lie. There is only passion. Through passion, I gain strength.
Through strength, I gain power. Through power, I gain victory.
Through victory, my chains are broken. The Force shall set me free.

corbanite's Avatar


corbanite
01.29.2012 , 07:49 AM | #114
Quote: Originally Posted by Heliotic View Post
Ok, so they use a man in the middle attack and they have login information which is usable for about 20 seconds.

What then?
what they did in wow was to log in and remove the authenticator on there and add there own to lock the owner out of it then they would strip toons for gold and valuables and send to others.

I mean how sweet is that.. sell 20k gold for real money then hack someones account and send them the gold from the hacked account.. Nothing wrong with making a profit eh?

Once account stripped clean make lvl 1 toons and send them to major cities to spam trade until they get banned to generate more sales of gold.

ebenezar's Avatar


ebenezar
01.29.2012 , 07:58 AM | #115
The idea that you can log into your EA/Origin account and somehow affect your SWTOR is a huge security RED FLAG.

What needs to be done is to verify if this really is the case and if so, it needs to be fixed immediately.

For those of you lecturing on Antivirus use and not going to unsafe websites are missing the point; unsecure accounts are a huge liability. This goes way beyond simply having your game account hacked.

If a keylogger can steal your EA/Origin account and bypass your SWTOR security, then it is UNSECURE. No amount of Antivirus or G rated websurfing with fix this.

Bioware, you need to at least look at this to see.

As of right now, I am logged into my EA/Origin account and DID NOT NEED TO USE MY AUTHENTICATOR TO MAKE THIS POST!!! The last time I used my authenticator to log into my SWTOR account online was friday.

What does that tell you?

Heliotic's Avatar


Heliotic
01.29.2012 , 11:00 AM | #116
Quote: Originally Posted by corbanite View Post
what they did in wow was to log in and remove the authenticator on there and add there own to lock the owner out of it then they would strip toons for gold and valuables and send to others.
You can't remove the authenticator without calling on the phone here. And who says Bioware haven't learned anything from Blizzard.

Racquerr's Avatar


Racquerr
01.29.2012 , 11:10 AM | #117
SWTOR logins and EA/Origin logins really really need to be separated.

It's apparently a disaster that's already happened. Mind as well spare anyone else a potential problem...

Ituhata's Avatar


Ituhata
01.29.2012 , 11:16 AM | #118
Ah yes. I too, thought I won a million euros in the Spanish lottery. Of course, when that didn't pan out as expected, I had that prince of Nigeria who needed my help to hide his massive fortune and after I gave him my banking info, I should be seeing a modest increase in my balance.

I'm patient.

Kharzon's Avatar


Kharzon
01.29.2012 , 11:24 AM | #119
Quote: Originally Posted by Runtinator View Post
You realize the auth keys changes every 15s or so?

So EVEN if they got key logged an auth key, It would only be active for a very short period of time.
You missed the point. I have written down the #'s that pop up, after all, it's battery operated. Yes, it's not like Rift's phone auth app where if it's not on the screen (changes every 15s or so) it won't take it. So, again, you can use the numbers that you write down, AT ANY TIME. I will, however, point out, this works for me.

scurrymacleod's Avatar


scurrymacleod
01.29.2012 , 11:58 AM | #120
i just timed it and the iphone gives you 1:20 until it cuts out.