The vast majority of infections are due to Flash-based ads targeting older Flash installs, which are then targeted to be run on gaming sites. The days of openin

The vast majority of infections are due to Flash-based ads targeting older Flash installs, which are then targeted to be run on gaming sites. The days of opening emails with attached .SCR files are long behind us. Blizzard does require that you provide two consecutive codes when removing an authenticator from an account, so I'm not quite sure how you'd coerce a user into providing two codes back-to-back, unless they just keep spamming tokens into the system. You could get around that by introducing, say, a 15-minute email-based delay that asks for a second auth code: 1) Log into account management (token required), request authenticator be dropped. 2) Request authenticator token. Validate token. 3) Stick request on the queue. 4) In 15 minutes, email the user with a link that includes a URL token validating the request. The link takes them to a page that asks for another token. 5) The authenticator is dropped upon receipt of the second valid token. Most players, no matter how impatient, aren't going to sit at their computers for 15 minutes punching in auth codes. They'll give up after 3 or 4, max. The additional email ownership verification step, with the time delay between code entry should at least buffer you against authenticator-drop attacks.