EVE Information Portal

The most insecure device in this mode, is the Windows PC USB port the YubiKey is being plugged in to.

Given the choice of offering TOTP to customers using an existing toolset, or having to deliver Yubikeys to customers, I would go for the TOTP solution, especially since it is the easier technical implementation. No point investing in a security system the customers (as a group) are not going to actually use. I still have two RSA keyfobs from the last 2FA plans that CCP had. That RSA-based system went nowhere in a hurry!

If I lose my phone, I still have the TOTP seed on my iPad and desktop. This makes disabling the 2FA much easier for me and CCP, since we don't have to engage in telephone calls at odd hours of the day. I just log in, reset the TOTP seed, and continue on my way (along with the usual remote bricking of the phone).

Risk = Probability of event x Damage caused by event

The cost of a "lost my Yubikey" event is significantly higher to all parties than a "lost my TOTP device" event. The probability of TOTP seed being compromised is significantly lower than losing the physical token (both per individual and statistically over the population). Even with the phone being stolen by a malicious third party, they still have to decrypt the storage and then decrypt the key locker.

If I was trying to steal an account from, say, an alliance financial officer or someone else in charge of significant in-game resources, I would hope that they have a Yubikey since it is not protected from my using it in the same way a TOTP key might be. In addition the time it will take the victim to address the loss is significantly higher, meaning I have far more time to plunder the account both ingame and through any stored credit card details.

The only downside to the password locker on my phone is that loss of one token (the phone) means I have to process lost keys for almost a thousand accounts.

Then again, I don't fancy carrying a thousand Yubikeys in my pocket.

Did you log out, then log in with a different account? (it was working for me when I just stayed on one)

i tried both ways logging out and sign in with differnt account, i also tried logging out and logging in with same account.

i think it fixed the website issue but not with the actual game client

nvm i just logged out the website and tried logging back in and it asked me to put in a code again

note these are with the email codes as i do not have a smartphone to use an authenticator

I happily enabled the feature on all accounts like 2 hours ago.
Found out that I need to re-enter the authenticator code when logging different accounts in through the launcher despite the "Remember..." option being selected.

The way I want this to work is:
1. Login through the launcher
2. Enter the code once and "Remember on this computer"
3. Never ever see this prompt for this account on this computer again. Doesn't matter if the IP, CPU, mobo, ram, country, account, weather, whatever changes. Something like the "Authorize this device" in iTunes.

Currently it doesn't work that way. Try again. Let me know when it does. Disabled on all accounts.

i have the issue where its not remembered it on the same computer same everything

Guys, so glad you did this. Just activated for all acounts ... feeling so much safer now. Thanks!!!!!

CCPlease. It's also, instead of it remembering the last account to log in, staying focused on one - not a huge problem, but an annoyance.

Is anyone not having this issue? Is it being worked on?

Just posting to to say I have the same issue also. Things to note is that I have 2 accounts.

Hope this little bug is fix in good time.


As for having 2fA, I am very happy to have it. Thank you for filling my request ;-)

https://forums.eveonline.com/default.aspx?g=posts&t=304921

Reporting that the "remember this computer" does not work either, on two different machines with the client/launcher installed.
It does seem to wok on one machine where I only logs to the web site and not use the client.

It is really painful to have to get the codes every time I log into the game from my own machines. Looking forward to a fix soon, else I am going to be disabling two-step authentification...

While I appreciate the effort. This isn't of much use.

"Yes. This does not prevent people from logging into the game client by circumventing the launcher. That is a legacy issue that we were unable to fix this time around."

So, how about doing what Trion did with RIFT and have a "Coin Lock", but have it extend beyond the currency and go into items. Make it so if the server doesn't recognize the IP it boots you out of the ship and prevents you from getting into a ship or access the Hanger Inventory until you unlock.

The server has already shown that it can boot people out of ships. All of my alts are in Capsules, even the ones that were in Rookie Ships (one of the major expansions did this).

---

Or

Add a third field to the game's login field: One-Time Password -or- One-Time Code

There. Done.

---

OR! Probably the easiest to do of all these...

For a quick fix. If the login server doesn't recognize the IP, have the game fail to login. Just pass it the same response you'd get if you entered the wrong password for a valid Login Name.

And fire off an email to the verified email address for said account.

With a validation link to authorize the new IP

En Masse does this for their accounts, Steam does it, Origin (EA) does this, YOUR WEBSITE does it.