Security measure: RSA tokens needed
They have done more then e-mail authentication. They have suggested you don’t use the same PW for the game as your E-mail, and for that matter anywhere else either.
I have it one step further, my E-mail address has nothing to do with my username (Or domain for that matter) for my E-mail making it impossible to trace via my game info where to go to get at my E-mail account.
That said, adding additional protections isn’t a bad thing. Make the tokens optional though.
On a side note, my account was hacked but because they couldn’t get at my E-mail they couldn’t actualy get in thanks to the email authentication. I imediatly changed my account PW.
I would also like to see account options that let us outright ban regions in advance from logging in. I’m not likely to ever visit China and if I do, I doubt I’ll be playing GW2 while I’m there. Same goes for just about anywhere but my home region, even within the US, I’m not likely playing anywhere but the State I live in.
Maybe your nephew should have enabled two factor authentication on his email account (ie like google provides on gmail)
No reason to sell expensive RSA tokens.. there’s cheaper solutions, esp since so many people these days have smartphones.