What a fantastic idea. If this works correctly, this will be revolutionary to the MMO gaming industry. Someone should have thought of this years ago.

WTG Blizz!

Hell yea. I am so buying one the day they come out.

This is one of those things that the average user really doesn't worry about. However, Guild Leaders and people who do high-end crafting where they have tons of time and effort invested in materials that are difficult to farm might want this as a way to protect their banks.

I've got one of the RSA SecurID key fobs and they're easy to use. There is a random number generator based on a random seed that is generated when it is made. The corresponding random number decoding seed is inputted into the server. Every 60 seconds the key fob generates a new number and the server will know how to decode it based on its own seed (but doesn't know what the actual number is).

When you go to log in, you just read the current number, input it in and viola. Some systems also have a pin number that you enter at the beginning of the number on the fob. So, for example, if you had a pin number of 1138 and the fob said 001122 you would enter 1138001122 into the blank. If the system you're using doesn't do the pin number thing, then you just enter the number on the fob. There is even a little dot in the corner that flashes once per second and 6 bars on the side that tick off every 10 seconds until the next number change.

The only problem with a system like this occurs on the server end as you have to absolutely make sure that the server is synced with GMT to the second. If the server is a minute off, then the system doesn't work.

It's just you. One Time Password generators are generally pretty pricey. $6.50 is a very small cost for something like this.

I have one of the new ones from my bank and I need to enter a 4-6 digit pin number on a keypad on the token before the authentication code is displayed. That is a more secure way of doing that pin code thing.

/agree

Actually, brute-forcing SecurID is very hard. (I am assuming, for argument's sake, that Blizzard is in fact using RSA SecurID tokens for the system.) Auth codes are only valid for a short duration of time, either 30 or 60 seconds. There is some float designed into the system, to offset the possibility of the token getting out-of-sync with the main authentication server, but even with a brute-force algorithm working the WoW login screen, you can only try so many times in that short window.

The real trick to breaking a SecurID token is to get its seed, usually a 128-bit string. Trouble is, SecurID tokens are tamper-resistant, and will destroy themselves if you try to crack them open.

I'm not saying it's impossible. There are really intelligent and determined folks out there, government, criminal or otherwise, and I'm sure some of them have ways of breaking a SecurID login. But this will put a hurting on the vast majority of keyloggers/trojans/et al.

Considering that the most secure Internet banking solutions use this type of tech ... it will probably be broken there before WoW.

Right, but if you get the seed you still have to get synced with the Ace server so it's not all about the seed. The Token generator would also be deactivated once it's found to be missing, which would render the seed useless anyway.

Each fob has it's own seed. Even if you bought one and were able to extract the key without destroying the device AND somehow sync it up with the server, you've only managed to crack THAT fob. Everybody else's fob has a different seed.

So with this device, it's effectively impossible for somebody to hack your account without physically possessing the password fob. The only potential avenue of attack is for somebody who has your account and PW to claim the fob was lost or broken, and have the security authorization disabled on your account. As long as Bliz has a really secure way to control this, then the whole system is as secure as you can reasonably get.

Heck yeah I'll get one.

When I got hacked, I didn't get any gold back, and definitely some of my bank stuff. You will NOT get full restitution. It sucks. And unless you keep a full inventory of what you have somehow (which I never did, and I had 150 items + in my bank) you won't know what you're missing.

I kind of agree though - I have to pay more for their inability to secure their network? Why am I paying for THEIR problem? Rock and a hard place....

Actually, there is no way an account is being hacked due to Blizzard's fault. Their servers and networks are very secure. In all case that are known, the fault was at the user side - insecure usernames and passwords, viruses and keyloggers, same password used on untrusted sites, not using a secure operating system (Linux plug :)), ...

If your account is haxored, it is not Blizzard's fault, it is your fault. Be grateful if they help you when they can.

"I kind of agree though - I have to pay more for their inability to secure their network? Why am I paying for THEIR problem? Rock and a hard place...."

Actually, you're paying for your inability to secure your computer. I haven't heard of one instance of a successful attack on Blizzard's system. If your account gets hacked, it typically has arisen from a flub on your end (keylogger, trojan, etc.).

So you want Blizz to pay for someone's ignorance on how to properly protect themselves?

If the US Gov wanted to protect everyone, they should mail a free tazer to everyone who pays taxes.