I’ve just spent like 6 hours doing scans to find nothing on my computer.
Then I just happened to do a google search about the actual authenticator “google authenticator” and not guild wars 2 mobile authenticator. I found this link. – http://productforums.google.com/forum/#!topic/mobile/krLTinE3hXQ
The 2nd post had me check my time on my ipad.
I couldn’t figure out why the password was correct but it kept giving me a wrong password error (I actually reset my password) because of this and it still didn’t work.
Then I checked the clock on my ipad where I have the mobile app installed, the time was off by like 1 minute. That one minute difference caused my authenticator code to fail every time I tried to use it on the website or the game client, however it did not notify me that the authenticator code was wrong, just that the password was wrong, that needs to be fixed so the client and website actually needs to informs you that the authentication code failed, because I’m sure I’m not the only one that just happened to have a slight time difference between their computer and their mobile device. How that even happened is beyond me because I set the computer and ipad to sync the time automatically.
Just thought I’d post this out there for people that are getting password errors with their mobile authenticators and might think they’re hacked. This was a huge relief when I set the clock back on the ipad slightly and then tried the codes again and was able to sign in with nothing missing and my characters sitting where I had them last.
This is also a suggestion to anet that they need to change the client and forum login to reflect an invalid authentication code and not just say that the password is invalid.
Is it better to out-monster the monster or to be quietly devoured?
however it did not notify me that the authenticator code was wrong, just that the password was wrong, that needs to be fixed so the client and website actually needs to informs you that the authentication code failed
Doing this weakens the security. If an attacker knows which part of the login attempt failed, they can concentrate on cracking that until it succeeds. If they don’t know which part failed, they might have gotten one part right but won’t know it. The only way they can successfully crack you account is to simultaneously get the username, password, and authentication code correct. Cracking all three at the same time is much harder than being able to crack one at a time.
The error message needs to be changed to “The username, password, or authentication code you entered was invalid.”
however it did not notify me that the authenticator code was wrong, just that the password was wrong, that needs to be fixed so the client and website actually needs to informs you that the authentication code failed
Doing this weakens the security. If an attacker knows which part of the login attempt failed, they can concentrate on cracking that until it succeeds. If they don’t know which part failed, they might have gotten one part right but won’t know it. The only way they can successfully crack you account is to simultaneously get the username, password, and authentication code correct. Cracking all three at the same time is much harder than being able to crack one at a time.
The error message needs to be changed to “The username, password, or authentication code you entered was invalid.”
Hardly weakens security. Cracking the authenticator program isn’t practical, while possible these types of attempts have no evidence of being made.
At the point of the authenticator coming up, they already have the password and email correct, otherwise the authenticator doesn’t even come up, so again security isn’t weakened because you can’t access the authenticator sign in without the correct credentials in the first place.
So putting a message that the authenticator was entered incorrectly after it fails is not going to weaken their security in any capacity. It will however help those that have had similar issues with their computer times being out of synch with the mobile device they’re using.
Is it better to out-monster the monster or to be quietly devoured?
Even though This topic is 2 years old I still found it extremely helpful! I recently moved from the UK to HongKong, of course I needed my GW2 fix and could not log on as I was on a different network and needed to re-verify. I tried and tried and tried, I have my authentication but to no avail, I have been frantically searching the forums for anything to explain why my correct info was not working and here it was all along, a tiny 1min time discrepancy. THANK YOU! I was starting to rip my hair out.
