4 ms·

After being a WoW user, I think two factor auth only works if it is forced on all accounts. Here's a scenario that plays out in WoW all the time and it happene

After being a WoW user, I think two factor auth only works if it is forced on all accounts. Here's a scenario that plays out in WoW all the time and it happened to me. Basically, a user quits playing WoW and their account gets hacked at some point after they quit. The hacker then turns on 2 factor auth via the WoW authenticator app. It is now impossible for the original user to log in to the account or reset passwords. To fix this you must argue and explain with customer support that the account was hacked an that the 2 factor auth is preventing you from resetting passwords and such. So, unless you turn on two factor auth up front for all users, it's going to actually make it worse for the end user if their account gets hacked. So, like captchas, it's solving one problem and creating another for the user. I'm not sure that is the best solution.

ceejayoz 14y ago
> The hacker then turns on 2 factor auth via the WoW authenticator app. It is now impossible for the original user to log in to the account or reset passwords. That's deviously simple.
chimeracoder 14y ago
> To fix this you must argue and explain with customer support that the account was hacked an that the 2 factor auth is preventing you from resetting passwords and such. That's not a problem when it comes to Google accounts, though. Maybe Google's lack of customer support is really a "security feature"!
- programminggeek 14y ago
  Maybe you don't understand. It takes 0 customer support to add 2 factor auth and lock out the original user. It takes several emails and support requests back and forth to finally get it sorted out. Also, maybe a few phone calls. If that happened to your google account, it would be INCREDIBLY unpleasant.
  - chimeracoder 14y ago
    I was just making a joke, but I was pointing out that if you have 2FA enabled, I could (theoretically) call up customer support and try and convince them that you're the attacker and I'm the legitimate account holder.
    - programminggeek 14y ago
      Oh sorry, and yes, you are right. It's kind of a screwed up system either way.
r00fus 14y ago
Key distribution is always a problem - perhaps the problem is that it's so easy for "enable" TFA for WoW. Google makes is relatively difficult to setup TFA, and you can (and I have) forced a password/TFA reset - took 30m over a couple of hours to restore.
digitaltoad 14y ago
I'm a WoW user as well. I will say from experience that you do not have to argue with anyone about removing the authenticator. You simply submit a support ticket containing a picture of your drivers license. The authenticator is usually removed in a few hours. I've done this multiple times now due to formatting my phone without grabbing my restore codes for my authenticator.

ceejayoz 14y ago

> The hacker then turns on 2 factor auth via the WoW authenticator app. It is now impossible for the original user to log in to the account or reset passwords. That's deviously simple.

chimeracoder 14y ago

> To fix this you must argue and explain with customer support that the account was hacked an that the 2 factor auth is preventing you from resetting passwords and such. That's not a problem when it comes to Google accounts, though. Maybe Google's lack of customer support is really a "security feature"!

programminggeek 14y ago
Maybe you don't understand. It takes 0 customer support to add 2 factor auth and lock out the original user. It takes several emails and support requests back and forth to finally get it sorted out. Also, maybe a few phone calls. If that happened to your google account, it would be INCREDIBLY unpleasant.
- chimeracoder 14y ago
  I was just making a joke, but I was pointing out that if you have 2FA enabled, I could (theoretically) call up customer support and try and convince them that you're the attacker and I'm the legitimate account holder.
  - programminggeek 14y ago
    Oh sorry, and yes, you are right. It's kind of a screwed up system either way.

r00fus 14y ago

Key distribution is always a problem - perhaps the problem is that it's so easy for "enable" TFA for WoW. Google makes is relatively difficult to setup TFA, and you can (and I have) forced a password/TFA reset - took 30m over a couple of hours to restore.

digitaltoad 14y ago

I'm a WoW user as well. I will say from experience that you do not have to argue with anyone about removing the authenticator. You simply submit a support ticket containing a picture of your drivers license. The authenticator is usually removed in a few hours. I've done this multiple times now due to formatting my phone without grabbing my restore codes for my authenticator.