These forums have been archived and are now read-only.

The new forums are live and can be found at https://forums.eveonline.com/

EVE General Discussion

 
  • Topic is locked indefinitely.
Previous page12
 

Security tokens/virtual security tokens as promised years ago.
Author
Previous Topic Next Topic
DrSmegma
Smegma United
#21 - 2014-05-26 13:49:50 UTC
Tarsas Phage wrote:
DrSmegma wrote:
Tarsas Phage wrote:

CCP would like to do it, and stated that much, however they went as far as saying that implementing 2-fa is not as much of a drop-in or "minimal effort" item as you might think. You might be able to do it on your turbo nerd neckbeardly PHP website in a few minutes, but with CCP's infrastructure it's a bit more involved.

And you actually believe this fact speaks in favour of CCP, don't you? By the way please explain to us why a web designer with knowledge of PHP is a neckbeard. I'm listening.


It's because so often the mega-nerd "this is UNIX I know this!" guys speak up here in acerbic tones and with a wave of their hand postulate something along the lines of "CCP is [ad hominem] because they don't do X when it is SO SIMPLE!" As if a semester of Java programming in university gives them insight into all the things, when they're not taking into consideration a lot more items than just the tech itself. It's annoying and unbecoming.

CCP didn't roll out 2fa before because they weren't satisfied, as a company, with the support requirements and cost behind hardware tokens when they tested this years ago. Now, we have near-ubiquitous smartphones, some with biometrics integrated and third parties providing mature and scalable solutions in this realm, and you're no longer beholden to companies like RSA/EMC as the only go-to for a decent 2fa solution. As they said at Fan Fest (I was there, in the room) it's now something they think they can reasonably pursue again.


I still don't get it. CCP has been unable to do it because it's simple? Google sends me an auth code to my phone. My gmail account is pretty safe, unless someone steals my phone or uses my home computer.

Eve too complicated? Try Astrum Regatta.
Prince Kobol
#22 - 2014-05-26 14:10:33 UTC
DrSmegma wrote:
Tarsas Phage wrote:
DrSmegma wrote:
Tarsas Phage wrote:

CCP would like to do it, and stated that much, however they went as far as saying that implementing 2-fa is not as much of a drop-in or "minimal effort" item as you might think. You might be able to do it on your turbo nerd neckbeardly PHP website in a few minutes, but with CCP's infrastructure it's a bit more involved.

And you actually believe this fact speaks in favour of CCP, don't you? By the way please explain to us why a web designer with knowledge of PHP is a neckbeard. I'm listening.


It's because so often the mega-nerd "this is UNIX I know this!" guys speak up here in acerbic tones and with a wave of their hand postulate something along the lines of "CCP is [ad hominem] because they don't do X when it is SO SIMPLE!" As if a semester of Java programming in university gives them insight into all the things, when they're not taking into consideration a lot more items than just the tech itself. It's annoying and unbecoming.

CCP didn't roll out 2fa before because they weren't satisfied, as a company, with the support requirements and cost behind hardware tokens when they tested this years ago. Now, we have near-ubiquitous smartphones, some with biometrics integrated and third parties providing mature and scalable solutions in this realm, and you're no longer beholden to companies like RSA/EMC as the only go-to for a decent 2fa solution. As they said at Fan Fest (I was there, in the room) it's now something they think they can reasonably pursue again.


I still don't get it. CCP has been unable to do it because it's simple? Google sends me an auth code to my phone. My gmail account is pretty safe, unless someone steals my phone or uses my home computer.



Makes you think that CCP do not want to make too difficult to create untraceable accounts and to account share.
Jaxon Grylls
Institute of Archaeology
#23 - 2014-05-26 17:48:56 UTC
Destoya wrote:

The obvious answer is to just do it like Blizzard with a mobile app that generates keys, physical phobs are a relic of the past.

Some of us don't have or want a smart 'phone. So with your idea how would we manage to log on? If you can't keep your user name and password secure how much more likely is it that you won't lose, forget or have your digital keys stolen?

Oh, and that's fobs not phobs.
Inxentas Ultramar
Ultramar Independent Contracting
#24 - 2014-05-26 18:17:57 UTC
The fact your accounts aren't all hacked to **** seems a reasonable indication on why it's sort of redundant. Is it really that mission-critical from a business standpoint?
Tarsas Phage
Sniggerdly
#25 - 2014-05-26 19:13:17 UTC  |  Edited by: Tarsas Phage
DrSmegma wrote:

I still don't get it. CCP has been unable to do it because it's simple? Google sends me an auth code to my phone. My gmail account is pretty safe, unless someone steals my phone or uses my home computer.


You as a end-user see it as that simple (as it should be - users won't adopt complicated crap), but that doesn't mean it's equally as simple to implement this on CCP's side - the server side, if you will.

I'm in no way speaking for CCP, but from first-hand experience I have when implementing this on a large scale, let me just tick off a few general items that need to be covered:

1) A business relationship with well-defined SLAs would need to be initiated between CCP and its 2fa vendor. After all, if the 2fa provider is down, your account will essentially be unusable.

2) A support system should be drawn up and support people trained on it (GMs, other such people) and used for a while internally for testing, evaluation, and familiarity.

3) If the 2fa solution needs its own dedicated hardware, that hardware must be spec'd and procured, and then integrated into the existing CCP data center(s).

4) Integration of the 2fa system needs to happen with Account Services, the game client+launcher, forums, eve-gate, petition and bug reporting systems. The SSO system will probably simplify this given that's the job of SSO, but given that SSO is new I'm not going to make a sweeping generalization on how easily 3rd party authentication mechanisms can be put in place.

Also, since SSO is eventually going to be able to service external 3rd party websites (or that's the intent, it has been said) then how this is going to work with them will need to be sorted out.

5) Publish documentation on setting it up and using 2fa on whatever devices are supported needs to be made and signaled to us, the end-users.

Finally, a project manager needs to herd all groups inside CCP together where this is relevant and get them to commit to implementing their portion and in the right order.

Simple, right?
Domania
Must Be EOL Cuz Wormholes Dont Jiggle Like This
#26 - 2014-05-26 19:22:12 UTC
IDGAD wrote:
A few fanfests ago we were given security tokens (of which the batteries are probably dead by now lol) with the idea that soon EVE would have optional security token authentication. Sadly this was never implemented even though EACH YEAR there seems to be a panel focused on security. If you don't want to go the costly route of having physical security tokens made, why does CCP not make a secure token app for Android and iCancer? If they even hate that idea, Google has a virtual authentication token software I'm pretty sure you can contract, which may be even cheaper than making your own software. This is minimum effort for the amount of security this would add, so why has it not been done?

TL;DR : That's not that much to read, go back to school.


I still have mine, sitting in the fanfest bag, ready to be used. This was 3 years ago.

P.S The batteries are def not dead, I still have my blizzard one that is 7 years old and still works fine.(They are the same type of keys.)

I'd love security tokens.
Edmond Lewis
Of Tears and ISK
#27 - 2014-05-26 19:47:22 UTC  |  Edited by: Edmond Lewis
Inxentas Ultramar wrote:
The fact your accounts aren't all hacked to **** seems a reasonable indication on why it's sort of redundant. Is it really that mission-critical from a business standpoint?


I have a door and Im sure up till now no one has tried to just open it, guess I don't need locks

Id rather have it, and if something tried they hit a wall and move on, than they try, get my account, and I get to spend weeks seeing if CCP will get my stuff back
Adunh Slavy
#28 - 2014-05-26 19:55:55 UTC
Destoya wrote:

The obvious answer is to just do it like Blizzard with a mobile app that generates keys, physical phobs are a relic of the past.



yeah, could do that. Likely some license involved though

Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.  - William Pitt
IIshira
School of Applied Knowledge
Caldari State
#29 - 2014-05-26 21:31:07 UTC
Jaxon Grylls wrote:
Destoya wrote:

The obvious answer is to just do it like Blizzard with a mobile app that generates keys, physical phobs are a relic of the past.

Some of us don't have or want a smart 'phone. So with your idea how would we manage to log on? If you can't keep your user name and password secure how much more likely is it that you won't lose, forget or have your digital keys stolen?

Oh, and that's fobs not phobs.


I have to agree an app makes more sense than some stupid text. It can't be that complicated to make an authenticator app. WoW is not the only MMO with such an app.

If you're one of the very few that don't use a smartphone then you won't be able to use the extra security feature and you'll have to assume the extra risk to your account. Yes it sucks but technology advances so if you're not going to keep up you'll be left out of some things. Just like if you refuse to upgrade your older PC you may not be able to play Eve.
Tarsas Phage
Sniggerdly
#30 - 2014-05-26 21:55:14 UTC
IIshira wrote:
Jaxon Grylls wrote:
Destoya wrote:

The obvious answer is to just do it like Blizzard with a mobile app that generates keys, physical phobs are a relic of the past.

Some of us don't have or want a smart 'phone. So with your idea how would we manage to log on? If you can't keep your user name and password secure how much more likely is it that you won't lose, forget or have your digital keys stolen?

Oh, and that's fobs not phobs.


I have to agree an app makes more sense than some stupid text. It can't be that complicated to make an authenticator app. WoW is not the only MMO with such an app.

If you're one of the very few that don't use a smartphone then you won't be able to use the extra security feature and you'll have to assume the extra risk to your account.


It's common to also have a soft token for PC/Mac, as well. Owning a smartphone is not a requirement for participating in most established 2fa systems out there - it's just the most convenient way.
Nevyn Auscent
Broke Sauce
#31 - 2014-05-26 21:56:23 UTC
Because smart phones & e-mails can't be hacked also?
Most 'hacks' are key logger type hacks, not honest hacks. From browsing naughty isk selling websites & other things.
A robust password that is more complex than 1234 combined with lock outs if multiple fails happen in a short time is actually pretty secure at a standard user level.
The two stage sign in doesn't actually add that much security to the account. Not if it's purely digital, and requiring a physical item adds a lot of cost to both sides.
IIshira
School of Applied Knowledge
Caldari State
#32 - 2014-05-26 22:52:58 UTC
Nevyn Auscent wrote:
Because smart phones & e-mails can't be hacked also?
Most 'hacks' are key logger type hacks, not honest hacks. From browsing naughty isk selling websites & other things.
A robust password that is more complex than 1234 combined with lock outs if multiple fails happen in a short time is actually pretty secure at a standard user level.
The two stage sign in doesn't actually add that much security to the account. Not if it's purely digital, and requiring a physical item adds a lot of cost to both sides.

Anything can be hacked. You can have the entire NSA protecting your Eve account and it could be hacked. The point is make it more difficult to hack. Any car can be stolen but people still have alarms and other security devices to protect them. I'm not saying make an app mandatory. In fact I prefer it wasn't. You need soft targets to keep hard targets safe.
Previous page12