nailbat.us

If you use an authenticator – and we hope you do – you may soon notice that an authenticator prompt may not appear with every login. We’ve recently updated our authentication system to intelligently track your login locations, and if you’re logging in consistently from the same place, you may not be asked for an authenticator code. This change is being made to make the authenticator process less intrusive when we’re sure the person logging in to your account is you.

We hope to continue improving the authenticator system to ensure the same or greater security, while improving and adding features to make having one a more user friendly experience. If you don’t already have a Battle.net Authenticator attached to your account, don’t wait until it’s too late - http://us.battle.net/en/security/checklist

So basically what they're saying is that if you always log in from the same location, you won't have to type in a code. If you try and log in from another location, you'll have to type in a code. I guess if we trust their security algorithms, it's fine. I guess this isn't much different than it is today. If you get a keylogger on your system, your password is compromised. This doesn't really matter because you have an authenticator. In the new scheme, you'll never be typing authenticator codes, but the instant someone else tries to log on... they're not on your network, so they'll need a code. You're password is still compromised, but you're still "secure".

I personally hope they have a tinfoil hat checkbox that makes you have to type your authenticator code in every time. I don't mind typing it in, so I don't see why I should stop. I'm not sure I'm that paranoid, but maybe I am.

I have seen some of this new security in action. Once a month or so, some of my friends and I gather at my place to play some baby alts on another server. Every time one person or another can't log on without calling Blizzard first. Blizzard detects something hoaky with their account or my network or something and makes them call in to re-authenticate in person.

Yeah, I travel frequently on business, and I have to reset my password each time, and again when I return home. I wish I could proactively tell them I'm travelling.

Adam

I'm not sure I'm that paranoid, but maybe I am.

Its not paranoia if they really are out to get you. And yeah they really are out to get us.

It would appear that this has already happened. It didn't ask me today when I tried to log in from my authenticated account.