Guild Wars 2

While I love the way Anet aims to keep our accounts safe from hacking… with this SMS, I’m not so sure. What do you all think about it?

Cause at the prospect that I’ll get hacked… which is always a threat, but I have a pretty ironclad password… it’s not like ArenaNet gives us their phone number so we can contact them for purposes of important circumstance? I would should I give them my phone number?

If I’m misunderstanding this, someone, please enlighten me.

They probably already have your phone number from when you bought/registered the game unless you entered a fictitious one. You can check by going to My Account > Settings. Anyway I wouldn’t worry about it too much. I doubt they are going to start calling/texting you in the middle of the night to let you know of new and exciting things in the gem store.

Blizzard, google, ea, steam, anet, rockstar, zenimax and many more have my phone number for years. All i get from them is verification codes and warnings about suspicious logins. SMS protection is a thing for many years already.

Yeah, but… are they forcing us to do this… or… making it optional between SMS and Authentication?

do you guys know if we get the mini dragon if we put sms authedication instead of the 2 steps one ?

Ludoflame.1463:

do you guys know if we get the mini dragon if we put sms authedication instead of the 2 steps one ?

SMS authentication IS one of the “2 steps” options. As a matter of fact, it’s even the one they recommend most.

So yes, you will get the mini dragon through enabling that.

lol if you’re worried about them spamming you with ads on your phone number, then no that’s not what this is about. If you sign up for multi-factor authentication, you’ll receive a text message from their authentication servers when you log into Guild Wars. You simply need to reply to that message and their servers will authenticate you. That’s it.

I haven’t signed up for the SMS authentication mechanism yet, but I’ve used other similar services so I’m pretty sure that’s what ANET will be doing as well.

This is a very positive step in the right direction by ANET to bolster security. Things like this should tell you that they take security very seriously.

Just be happy with the Mystical dragon!:) https://www.youtube.com/watch?v=UdaIN1HIg48

I dunno, not being offensive here but… that dragon is:

Creepy
No wings
Length is way longer than it should be
It’s a friggin floating Anaconda with feet

Thank you guys for the mystical dragon, by the way. I have wanted that thing ever since I saw it was a thing.

Paul Ella.2037:

Hi all,

Just to reiterate what was written in Mike’s blog post today -https://www.guildwars2.com/en/news/a-new-way-to-protect-your-account/

We won’t spam you; we’ll use your phone number solely for the purpose of keeping your account secure.

You do have a choice of using SMS or the Authenticator and it is optional, but we encourage you to make your accounts more secure and to say thanks you get a free mini mystical dragon.

Win/win!!

So we can’t use both then?

skullmount.1758:

Paul Ella.2037:

Hi all,

Just to reiterate what was written in Mike’s blog post today -https://www.guildwars2.com/en/news/a-new-way-to-protect-your-account/

We won’t spam you; we’ll use your phone number solely for the purpose of keeping your account secure.

You do have a choice of using SMS or the Authenticator and it is optional, but we encourage you to make your accounts more secure and to say thanks you get a free mini mystical dragon.

Win/win!!

So we can’t use both then?

They’re mutually exclusive… well not really I guess but it would be a rather laborious process.

The one question I have, and hope someone might be around to answer it, can a single landline number be used for multiple accounts? I have two accounts and my partner has one., our mobile phones are used to make emergency phone calls only. I can’t text my eyesight is too bad to read the letters on the keys and even with a smart phone the text is too small for me to read anyway (at least until someone comes up with the 24" smartphone) or could there be an option for a mobile number with a ‘no text’ option so that it would call us the same as a landline.

Oenanthe.6549:

The one question I have, and hope someone might be around to answer it, can a single landline number be used for multiple accounts? I have two accounts and my partner has one., our mobile phones are used to make emergency phone calls only. I can’t text my eyesight is too bad to read the letters on the keys and even with a smart phone the text is too small for me to read anyway (at least until someone comes up with the 24" smartphone) or could there be an option for a mobile number with a ‘no text’ option so that it would call us the same as a landline.

My wife and I have 3 accounts each. She has a mobile phone and the landline is in her name. I have no mobile phone and, obviously, no landline. I’ve never had any kind of phone in my own name ever, nor needed one, and have no plans on changing that.

I have used Google Authenticator in the past for other things but even then I had to use my wife’s mobile phone to set it up. When it becomes mandatory for new accounts to have one or other of these in place, won’t that mean that you can’t play GW2 without a phone number? That seems a bit extreme for a video game to say the least – I can get a bank account and a passport without having to give a phone number.

Can I ask how the form wants you to put in your phone number for the SMS? I’ve tried with and without -, with and without country code and it doesn’t seem to want to recognize my landline as a number.

Edit: Just set up authenticator since I dunno why it wont accept the number. I prefer the SMS calls, been using it on Gmail for a long time.

Tiny Doom.4380:

Oenanthe.6549:

The one question I have, and hope someone might be around to answer it, can a single landline number be used for multiple accounts? I have two accounts and my partner has one., our mobile phones are used to make emergency phone calls only. I can’t text my eyesight is too bad to read the letters on the keys and even with a smart phone the text is too small for me to read anyway (at least until someone comes up with the 24" smartphone) or could there be an option for a mobile number with a ‘no text’ option so that it would call us the same as a landline.

My wife and I have 3 accounts each. She has a mobile phone and the landline is in her name. I have no mobile phone and, obviously, no landline. I’ve never had any kind of phone in my own name ever, nor needed one, and have no plans on changing that.

I have used Google Authenticator in the past for other things but even then I had to use my wife’s mobile phone to set it up. When it becomes mandatory for new accounts to have one or other of these in place, won’t that mean that you can’t play GW2 without a phone number? That seems a bit extreme for a video game to say the least – I can get a bank account and a passport without having to give a phone number.

You don’t need a phone to use 2FA. That’s just the easiest piece of TOTP supporting hardware to use for most people, since they already have one.

You can also use dedicated hardware, such as YubiKey.

Paul Ella.2037:

If you don’t have a phone number you can still use the Google Authenticator option to secure your account with 2 Factor Authentication.

Or the Microsoft authenticator. Or the Ios authenticator (or whoever makes it for apple products :p). There’s even a desktop authenticator (apparently!)

I have had the authenticator back when it was still in beta. I didn’t reinstate it when it went live (I was put back to email authentication), but I still got the dragon :p

(it did push me to reinstate my authenticator again, though…)

I do have a question though… Is it possible to add two authenticators with one account? I don’t always have my phone with me (which is why I don’t care for SMS authentication), but I do always have my tablet with me…

Paul Ella.2037:

You do have a choice of using SMS or the Authenticator and it is optional, but we encourage you to make your accounts more secure and to say thanks you get a free mini mystical dragon.

Win/win!!

I wouldn’t call that a win/win situation. I don’t have a mobile (or for Americans, cell) phone. I also don’t want a phone call to my landline in the event that someone’s trying to access my account, due to personal reasons. All I’m reading here is that there’s another unobtainable item in the game for me. I appreciate what you’re doing to make things more secure for the less savvy members of the playerbase; but tying an item to the system is a bit silly.

Oh well. As much as I love this game, it’s never been very completionist friendly, so I guess one more gap won’t hurt.

Chameleon Dude.1564:

Paul Ella.2037:

You do have a choice of using SMS or the Authenticator and it is optional, but we encourage you to make your accounts more secure and to say thanks you get a free mini mystical dragon.

Win/win!!

I wouldn’t call that a win/win situation. I don’t have a mobile (or for Americans, cell) phone. I also don’t want a phone call to my landline in the event that someone’s trying to access my account, due to personal reasons. All I’m reading here is that there’s another unobtainable item in the game for me. I appreciate what you’re doing to make things more secure for the less savvy members of the playerbase; but tying an item to the system is a bit silly.

Oh well. As much as I love this game, it’s never been very completionist friendly, so I guess one more gap won’t hurt.

You can use the desktop authenticator, which doesnt require a phone of any kind.

So, is the SMS authentication supposed to work yet? I tried adding it, and it accepted my number, but I didn’t get an SMS, even after waiting for two hours and resending it.

Thanks for this. It’s a really good idea, I’ve been meaning to set up the mobile app authentication ever since I got a smart phone 2 months ago and kept forgetting. But offer a mini dragon and I do it right away.

Also it made my ‘Link opens a chest’ text notification sound especially appropriate.

Jaymee.1560:

I dunno, not being offensive here but… that dragon is:

Creepy
No wings
Length is way longer than it should be
It’s a friggin floating Anaconda with feet

It’s a Chinese dragon. It was originally created for the Chinese special edition.

They don’t usually have wings and are much longer (and thinner) than most western dragons (although in fantasy there’s a lot of cross-over and original variants inspired by both, like DnDs gold dragons).

It’s a bit odd in GW2 where all the actual dragons are western style ones (even the Canthan saltspray dragons in GW1 had wings and looked like a cross between the two. But considering the original purpose it seems appropriate.

I’ve had the Authenticator hooked up pretty much since that became an option, but coming into the game and seeing that I had received a dragon mini for “registering with Account Security SMS” when I (1) didn’t do anything with account security recently and (b) didn’t register for anything involving SMS at all… well, it’s a little concerning. I’ve pretty much read between the lines that this is a delivery of something that was promised somehow somewhere, but … If I’m getting this for turning on the Authenticator months ago, I’d rather the email mention the possibility rather than presenting the mini as though I’d just added a thing I didn’t add at a time I didn’t add anything. It made the impression that perhaps SOMEONE ELSE had added SMS notification to my account with a destination I didn’t know about, and that’s usually the first step in an account take-over. That is, the very thing we’re supposed to be alert for and suspicious of.

The big downside is that you’re trusting Anet to keep that data safe. With the number of and severity of data breaches making the news, and the fact they already suffered a pretty nasty breach before, trusting them is more difficult since their already a target.

The constant futility and catch 22 of solving a potential security issue by giving people more personal info to lose is starting to wear down on my brain. Granted its not a single point of failure like hardware RSA token, but with phone numbers leading back to what probably a smart phone, its only a matter of time before someone figures out the back doors on those….. Only this time its at the center of your life, with access to EVERYTHING from email, bank apps, and everything else once toted as being more secure.

(My tin foil hat isn’t big enough to handle all this)

dsslive.8473:

Chameleon Dude.1564:

Paul Ella.2037:

You do have a choice of using SMS or the Authenticator and it is optional, but we encourage you to make your accounts more secure and to say thanks you get a free mini mystical dragon.

Win/win!!

I wouldn’t call that a win/win situation. I don’t have a mobile (or for Americans, cell) phone. I also don’t want a phone call to my landline in the event that someone’s trying to access my account, due to personal reasons. All I’m reading here is that there’s another unobtainable item in the game for me. I appreciate what you’re doing to make things more secure for the less savvy members of the playerbase; but tying an item to the system is a bit silly.

Oh well. As much as I love this game, it’s never been very completionist friendly, so I guess one more gap won’t hurt.

You can use the desktop authenticator, which doesnt require a phone of any kind.

Which doesn’t require any more than what is required to run the game itself. In fact probably quite a bit less.

Love my little dragon. I love the way it spins!

Hey Mr. Ella.
I did the 2 step sms account thingy and put the code in and it stated my account was good to go, and i did not get a mini dragon? i submitted a ticket about a little while ago

So, this has been asked, but not answered, and I’d really like to know…

Can I use one phone number for two accounts? I don’t give out my landline number on principle, so if I opt for the SMS option, can I use it for both accounts, or is that impossible for security reasons (or because it confuses the computer or whatever)?

And can I change the number associated with my account whenever, or is that going to be some complicated process and generally a pain in the rear? In case I lose my phone or ditch the number and get a new one? Because the blog post brags about how “keeping the same phone number for a long time” makes it secure, but what if, for whatever reason, I don’t have access to that number anymore?

(Yes, I’m aware I could use a desktop app, too, but I think I have the secure password thing nailed down, so my bigger worry is malware like keyloggers, which using SMS can prevent, but an app can not.)

€dit: Oh, and one more thing. Those SMS will be regular domestic SMS, right? Yeah, yeah, obvious, silly ‘n stuff, but it doesn’t hurt to ask and make sure^^

Red Queen.7915:

(Yes, I’m aware I could use a desktop app, too, but I think I have the secure password thing nailed down, so my bigger worry is malware like keyloggers, which using SMS can prevent, but an app can not.)

keyloggers shouldnt be a problem. The authentication code keeps changing every few second

Kreejaffa.3682:

Thank you guys for the mystical dragon, by the way. I have wanted that thing ever since I saw it was a thing.

Absolutely – saw one in-game today, and thought “Must have.” That doesn’t happen often with me, either! Am now proud owner of a mini mystical dragon, and enjoyed seeing a small queue of them wriggling about at the Behemoth event earlier. Really great mini and totally worth getting some account security going.

I’ve been using the google authenticator app since the game launched in 2012 and I’ve never had a problem with it. You put your normal password in, then you put the authenticator code in from the app.

This makes your account more secure because a “hacker” would need both your normal password, and your randomly generated code. Or they would need your normal password and the password of the email account.

For example I use 1 email account name as my GW2 account. The password to log in to GW2 is different from the password to access the email itself. So I essentially have 2 different passwords plus a randomly generated code protecting my GW2 account.

What is the minimal amount of information you will need to get back access to your account in case of a lost/changed phone number?

Just use the windows program to setup that weird protection thingy and remove it again once you get your mini, its not like it matters a lot when arena net themselves are messing with your account when releasing broken updates xD

Jaymee.1560:

I have a pretty ironclad password… If I’m misunderstanding this, someone, please enlighten me.

Passwords are pretty much worthless nowdays, and i’m almost willing to bet you have an email with your original serial key somewhere in your email folders which would be all a hacker needs to take over your account.

Multi layer security isn’t hacker proof but it does make you much less of a target to the extent that the time it would take to steal your account wouldn’t be worth the effort.

Lambent.6375:

What is the minimal amount of information you will need to get back access to your account in case of a lost/changed phone number?

With the google authenticator app there is no use of your phone number. You only need to remember your google account and email password.

Paul Ella.2037:

Hi all,

Just to reiterate what was written in Mike’s blog post today -https://www.guildwars2.com/en/news/a-new-way-to-protect-your-account/

We won’t spam you; we’ll use your phone number solely for the purpose of keeping your account secure.

You do have a choice of using SMS or the Authenticator and it is optional, but we encourage you to make your accounts more secure and to say thanks you get a free mini mystical dragon.

Win/win!!

Except I can’t use my Google Voice number so lose.

starlinvf.1358:

The big downside is that you’re trusting Anet to keep that data safe. With the number of and severity of data breaches making the news, and the fact they already suffered a pretty nasty breach before, trusting them is more difficult since their already a target.

The constant futility and catch 22 of solving a potential security issue by giving people more personal info to lose is starting to wear down on my brain. Granted its not a single point of failure like hardware RSA token, but with phone numbers leading back to what probably a smart phone, its only a matter of time before someone figures out the back doors on those….. Only this time its at the center of your life, with access to EVERYTHING from email, bank apps, and everything else once toted as being more secure.

(My tin foil hat isn’t big enough to handle all this)

Really? Do you have links to this ‘pretty nasty breach before’? I’d love to read about it.

I for one am dead against this SMS system ,i know it protects accounts and such. But as i am deaf i do not own a mobile phone nor intend to prove myself to anyone. I have left WoW over their Authenticator and never want to see one again. As my ISP rotates our IP address regularly it haunts me to enter a code every 3-4 days. ANET should have a better system than blame shifting back on too the player. I thought ANET already had a IP Tracker for security.

If ANET force players to use this Authentication i can see many forms of Discrimination taking place against its users. Especially those with deafness and other issues and handicaps affected.

codeman.3425:

I for one am dead against this SMS system ,i know it protects accounts and such. But as i am deaf i do not own a mobile phone nor intend to prove myself to anyone. I have left WoW over their Authenticator and never want to see one again. As my ISP rotates our IP address regularly it haunts me to enter a code every 3-4 days. ANET should have a better system than blame shifting back on too the player. I thought ANET already had a IP Tracker for security.

If ANET force players to use this Authentication i can see many forms of Discrimination taking place against its users. Especially those with deafness and other issues and handicaps affected.

You are not forced to use it. It is optional. You can stick to email authentication if you so choose. That still won’t solve the problem of your IP changing regularly though. That is between you and your provider.

Paul Ella.2037:

Red Queen.7915:

So, this has been asked, but not answered, and I’d really like to know…

Can I use one phone number for two accounts? I don’t give out my landline number on principle, so if I opt for the SMS option, can I use it for both accounts, or is that impossible for security reasons (or because it confuses the computer or whatever)?

Yes

Red Queen.7915:

And can I change the number associated with my account whenever, or is that going to be some complicated process and generally a pain in the rear? In case I lose my phone or ditch the number and get a new one? Because the blog post brags about how “keeping the same phone number for a long time” makes it secure, but what if, for whatever reason, I don’t have access to that number anymore?

Yes, you are able to change the number easily.

So, if it’s easy to change the number associated with the account, and there’s no limit on how many accounts you can use the phone number on, how is this option ‘safer’ than the authenticator? What’s stopping the hacker from simply changing the phone number associated with my account when they steal it? People have spoken on the forums about having double digit numbers of accounts; is there going to be some kind of cut-off or red flag for the number of accounts a phone number is used to authenticate? What about if you have to change the number frequently? I’ve moved pretty much once a year for the last three years. Holding on to a phone number is an alien concept for me.

My issue is simple. I’m charged for every text message I receive. Yes, I do not have a phone plan that has unlimited text because I don’t and neither do any of my friends. It’s a generational thing, I’m in my 50s. I also do not freely distribute my home or mobile phone number in RL and especially online.

Behellagh.1468:

My issue is simple. I’m charged for every text message I receive. Yes, I do not have a phone plan that has unlimited text because I don’t and neither do any of my friends. It’s a generational thing, I’m in my 50s. I also do not freely distribute my home or mobile phone number in RL and especially online.

Then don’t use 2-step/SMS authentication. It isn’t required. All you miss out on is the mini and the added layer of security. As for a generational thing I don’t get what you mean. My parents and many of my friends are in their 60’s. They have phones that have an unlimited text plan. My mom who is 65 uses SMS authenticating for many of her online accounts. I know because I helped her set them up and she likes the extra security. I talk to her almost every day and she has not once mentioned getting unwanted phone calls or texts due this. Trust me she would let me know if she did.

tl;dr You are not forced to use 2-step authentication. If you choose to be behind the times due to your age that is up to you.

Whelp, set up an authenticator on my tablet and home PC. Hope that’s good enough once I set up my folk’s system on my trusted list.

And as for switching to a more “modern” phone plan, they all require you to sign up for a data plan which is sort of pointless with a basic flip phone, and more expensive overall than the plan I’m grandfathered in.

Behellagh.1468:

Whelp, set up an authenticator on my tablet and home PC. Hope that’s good enough once I set up my folk’s system on my trusted list.

And as for switching to a more “modern” phone plan, they all require you to sign up for a data plan which is sort of pointless with a basic flip phone, and more expensive overall than the plan I’m grandfathered in.

I don’t know about other countries but in the UK it’s definitely possible to get phone plans that don’t include data. I can’t see it being that different in other places though.

Until 2 months ago I was on an extremely cheap call and text only rolling plan, which was also sim-card only which meant I could use whatever phone I wanted. Only reason I don’t have it now is because I finally got a smart phone, they still sell the same plan I was on.

But for the authenticator there are other options, including one that’s done through your PC. It’s still extra security because it means a hacker would have to access your PC to get into your account, but it doesn’t require any more gadgets or information than you need to play the game.

let me understand this correctly…
I don’t want use the SMS or the Authenticator, so the only thing i lose is the mini. i don’t be forced to choose one of them, now or in the future. still I can log in the same way as I have done so far and start playing.

correct?

That’s what the blog post seems to imply.

We strongly recommend that you use one of these two systems to protect your account. But for you, our long-term Guild Wars 2 players, we won’t force the issue. You’ve had your account for a while and it hasn’t been stolen. Your existing account security has stood the test of time.

https://www.guildwars2.com/en/news/a-new-way-to-protect-your-account/

The limitation seems to be new accounts without either either SMS or Authenticator can’t trade gold and items to other accounts.

The dragon is encouragement to do so.

I assume this is partially in response to players returning due to HoT finding their accounts compromised, emptied, used as a RMT account and/or banned. If this makes it harder for accounts to be swiped and used for RMT, which reduces the load on 1st line CS they win, we win, RMT loses.