I disagree. A few reasons.

1. Only available at online store. (And probly Blizzcon) Means people without credit cards can't get it.

2. Seems like there are too many "problems" that will lock you out of the account until you contact billing and account services. (Don't know if you ever tried to contact blizzard...not easy...lines closed most of the time and slow for emails.)

3. The account verification process is one that takes a long time. (3 weeks when I got hacked)

4. Even if they quicken it, it will be too late to get in that 9 PM raid when you log in at 8:45.

5. Lich is coming out soon...slap them in as a bonus feature to buying.

6. I am a big beleiver that they will have the "shame on you" attitude if you are hacked.

well, i kind of agree, and kind of don't.

forcing key-fob two factor authentication would, in the short term at least, cause way more support problems for blizzard than it would solve, and long term, with keyfobs going out of synch with authentication servers, and batteries dying you get an ongoing support burden. so i'm kind of for an opt-in solution, but i agree that asking the end-user to pay for the opt-in is a bit cheeky, considering how much we're paying already to play this game.

but two factor authentication is definitely needed in some form or another. Currently i think there are two issues that are causing accounts to be hacked.

1) keyloggers - fix this with secondary logon authentication, by asking for a click response. e.g. a random set of pictures, placed in a random order which have to be clicked on via mouse for authentication. or fix this with a phone line that the user has to call, or an sms message that the user has to send in to open up the account for logging in to (apparently in use for taiwan WoW users). do something clever with the authentication process. ask microsoft, or ibm, or google, they all have clever off the shelf solutions already.
2) brute force password hacks - my account was hacked this way, or rather, i'm 100% sure my pc is 100% clean, and there's no other explanation, especially considering that over a space of hours i was forced off line again and again, for no other reason than by hackers tripping some mediocre brute force prevention mechanism at blizzard, that obviously didn't work. They guessed my password because a) it was too simple (fix this by adding a password complexity rules (currently there is none), or password expiry / renewals), and b) the authentication process in place doesn't stop people brute force hacking accounts; there's no lock out, there's no slowing of authentication attempts, there's nothing... and there really really needs to be.

hackers have monetised wow. on a daily basis it's tarnishing the reputation of blizzard ability to provide a secure environment. I got some of my characters back, but i lost a heap load of gold, items, and other characters that blizzard could be bothered, or simply couldn't restore.

for me the price of the authentication fob is small, so i will probably end up buying in to it, simply because i don't want to go through the hassle of spending days getting my toons back.

How you connect to the internet does not affect the security of WoW client's authentication: your password is not sent to the server, so logging your internet communication is not a viable attack vector. The only real factor is the security of your own computer: is it going to send your password to third parties without your knowledge, or are you sure it's secured?

Well, considering many small-frame companies use these security features (my fathers company for example), and they have yet to be hacked by anyone, especially competitors, I doubt that such a quality company like Blizzard would use some "cheap-o" brand of code that can be easy cracked.

Keyloggers won't defeat these little keyfobs. They give a different code every time you press the button, based on an initial "key" known to Blizzard and the breakdown of an isotope. Without knowing the initial key and the time the sequence started, there's currently no way around them.

These dongles are used in high-security applications including secure network access and internet banking, it's quite surprising to see them rolled out for a computer game.

These people are software engineers making their living by stealing accounts. The motivation and skill for cracking these things is something completely different than on small businesses having a look at their competition. The only truly secure login would be a limited amount of codes on a piece of paper that only work once.

Due to the nature of One-Time Pad encryption, even a keylogger would only work if the person running the logger logged in within the couple of minutes before the password expired... and really, if that happened, you'd be able to notice (since you'd get kicked off) and could log in repeatedly until the password changed, thereby preventing the thief from making use of your password.

This type of security device can't exactly be keylogged. Sure your username and password can be, but as long as you have it and activated within your account, it would be extremely hard to break. Basically every 60 seconds the key dongle will generate a random number. The server will generate the same random number at the same time. So say they keylog your security code, in 60 seconds time, it will no longer be valid. Basically, unless they can come up with a way to brute force out all the possibilities of a 6 digit number in 60 seconds, then they are screwed. And even that can be limited by Blizzard. They can put a login attempt limit on the account. So if more then 5 attempts happen within any 60 second period it freezes the account for an hour.

Errr the whole point of these things is they do generate 1 time only keys, that, even with knowing all the previous keys, you cannot find out the next one. Thats the way they work, key gets generated, lasts 1 minute, can only be used once, once 1 min is gone, key is void, never created again. And knowing all the keys that have come before, you can't know what key is coming up next.

Thank you. It's a better system than I thought then. It seems then the only way to break it would be to solve the way the numbers are generated. Will definately be getting me one! :)

i don't know if these will be 100% secure... i've worked with encryption a bit and know that most successful attacks aren't against the encryption.

that said, i'll probably buy one... but trust it without reservation? nope.

Similar devices have been defeated. One of the attacks is called man in the middle - it amounts to getting into the network flow between user and server, and letting you compromise things for yourself. It can be done, such as by a successful hack of the DNS servers.

Likely? I don't know. Possible? Yes, and without compromising your computer itself. Don't ever think there's going to be uncrackable security.

You honestly have no idea what you're talking about Feldur. A man in the middle attack would do about the same as a keylogger: You log in to the fake server, pass them your info, and then they would use this info to log into your account.

The problem with this is that they still can't generate your one-time code, which changes every 60 seconds. Unless they were sitting there, logging in THE MOMENT you gave them the info, they'd be SOL.

Here's the problem, midir. The $6 fee does two things for Blizzard, in my opinion. One plainly visible, one less so.

The first thing is it covers their investment in the hardware. It took them time to research, design, and produce it. Like the article says, this probably covers the bare bones cost of the item. It is not Blizzard's responsibility to make sure that their users are not doing things that get their computers compromised. So to have us cover the physical cost of the device, I think, is a fair trade.

Second, it provides a barrier to entry. If it was free, a larger number of people would go through steps to obtain said device, because it was free and it 'helps security'. You have to understand, if you link this device to your account and you lose it or break it or throw it in the washing machine or whatever it? You have to call Blizzard and it's going to take time out of their payroll to fix the situation. They don't WANT everyone to have one because that brings a wider swathe of people who get it without understanding it and the responsibilities it dictates.

This is also, I daresay, the reason they're not 'including it' with the expansion. Aside from the cost issues that would present.

Just my take on it anyway.