Guild Wars 2

HI,

After realising that my game client wasn’t asking for my 6 digit authenticator code I got a little worried. At first I thought perhaps GW2 used a method to track members so that only one authentication was required per IP and since my IP had not changed in the last few days I waited, I am fairly confident about my password/security choices even if authenticator was broken so I wasn’t too stressed.
Today I tried unlinking my Authenticator after my IP changed and I still wasn’t asked for any authentication.

Upon removal I re-linked a new authenticator and noticed that the QR Code Scans are still invalid! (Thats been a while now that they have been broken/overlooked). So I manually typed the code instead into my authenticator and proceeded to get a successfull message from the website.

I then re-tested the login for both the game client and this website and both still did not ask me to provide any authentication codes.

In my opinion something is broken and it would be nice if this could be remedied as soon as possible as this is a potential security problem since email verification is automaticall disabled upon linking of the authenticator which is currently not working. This effectively Lowers account security rather than increase it.

thanks for you support.

Nitro

Does your IP change very so often ? How often does it change ? What did you do to check that your IP changed ?

I would totally remove the IP info in your picture. The reason I said it’s IP based is because I don’t get the code request at home. I have yet to authorize IP from work and it does ask me every time when I log in from work to post in forum.

Although it is strange in your case unless they allow a range of IPs instead of particular IP.

In any case, if you are worried, send in a ticket and see what support can tell you.

Re-posted as per moderators advice. Please note the IP was outdated, and even if it was not I personally would not consider it sensitive information (its called a Public IP for a reason).

“Hi Zaken,
Thanks for your response. My IP is dynamically assigned by my Internet Provider, it only changes once my hardware either loses connection, disconnects or is powered off and on again.
My Router runs the open source Tomato project firmware and it tells me within the status page what my current IP details are, this generally includes the private ip segment in use and the current external public IP assigned to the WAN interface (see attached image for confirmation).
The status page also keeps track of the connection details, My IP was the same for 6 days and 20 hours. I restarted my router, it gained a new public IP address and authentication still was not present on the website or the client.
Due to this I don’t believe that the authentication is based on IP address and therefor leads me to believe there may be a bug involved.”