The SOE Authenticator - Now Available at SOE.com!

[Amnerys]

<p style="text-align: center;"><img src="http://www.station.sony.com/images/community/commerce/VascoKeyFob.png" width="300" height="306" /></p> <p>Announced at Fan Faire 2011, the <a href="http://www.soe.com/soeauthenticator/">SOE Authenticator</a> offers added account security to SOE Station Accounts.</p> <p>The SOE Authenticator is a supplemental authentication method for your Station Account giving you the security of <a href="http://www.soe.com/soeauthenticator/faq/#Question4">Two-Factor Authentication</a>. This additional layer of security is designed to help thwart and prevent unauthorized access to your account. The SOE Authenticator provides you with a unique, one-time authenticator code (PIN) to use in conjunction with your regular password.</p><p style="text-align: center;"><a href="http://everquest2.com/news/read/current/4023" target="_blank"><img src="http://everquest2.com/images/en/community/buttons/readmore.png" border="0" width="175" height="44" /></a></p>

[Misuko]

<p>The announcement specifically mentions iPhone and Android for the mobile authenticator. Are there any plans/possibilities of getting a BlackBerry app too?</p>

[Xalmat]

<p><cite>Misuko@Antonia Bayle wrote:</cite></p><blockquote><p>The announcement specifically mentions iPhone and Android for the mobile authenticator. Are there any plans/possibilities of getting a BlackBerry app too?</p></blockquote><p>People still use BlackBerries these days?</p><p>Sarcasm aside, that's a good point.</p>

[Maisland]

<p>So... are these only available for players with Station Access accounts?  I tried to buy one of the hardware devises and got an error.</p>

[Cratoh]

<p>You lose everyone's details, shut servers down for weeks, generally really drop the ball. </p><p>Then you come up with a device that helps prevent this, and you want to <em>charge</em> people for it??</p><p>You're having a laugh.</p><p>Edited to add..</p><p>Shame on you.</p>

[Ahlana]

<p><cite>Cratoh wrote:</cite></p><blockquote><p>You lose everyone's details, shut servers down for weeks, generally really drop the ball. </p><p>Then you come up with a device that helps prevent this, and you want to <em>charge</em> people for it??</p><p>You're having a laugh.</p><p>Edited to add..</p><p>Shame on you.</p></blockquote><p>There is (or going to be) a free Android/IPhone version of this. As hardware is not made out of thin air.. I think $10 (which includes shipping in the USA) is not too shabby or shameful at all.</p>

[feldon30]

<p>If they mailed these out for free, people would complain that the design of the EQ2 graphic "sticker" is not to their taste, or it doesn't have a backlight, or it's too heavy/bulky/plasticky, or demand that John Smedley mail everyone $100.</p>

[Cratoh]

<p><cite>feldon30 wrote:</cite></p><blockquote><p>If they mailed these out for free, people would complain that the design of the EQ2 graphic "sticker" is not to their taste, or it doesn't have a backlight, or it's too heavy/bulky/plasticky, or demand that John Smedley mail everyone $100.</p></blockquote><p>I think it would be fine to just pay postage/packing on them. The probably cost a few cents to make, and cost $10 bucks. </p>

[Zehl_Ice-Fire]

<p>Paypal sent me one of those a few years ago... free, and I don't even pay a subscription to Paypal.</p>

[Xalmat]

<p><cite>Zarandar@Oasis wrote:</cite></p><blockquote><p>So... are these only available for players with Station Access accounts?  I tried to buy one of the hardware devises and got an error.</p></blockquote><p>I don't have a Station Access account and I was able to buy one just fine.</p>

[ffd700]

<p>Are these for only logging on to the Soe.com account management site, or also for logging into the actual game?</p><p>Also, how long are the codes good for once you push the button?  I've used SecurID in the past and their codes change every 60 seconds.  Do you have to push the button inbetween each login?</p><p>Will there ever be a USB model that would be required to be plugged in to the actual machine logging on?</p>

[Vashek]

<p>Any chance of this being available for Windows Phone 7 please?</p>

[Rijacki]

<p><cite>Cratoh wrote:</cite></p><blockquote><p><cite>feldon30 wrote:</cite></p><blockquote><p>If they mailed these out for free, people would complain that the design of the EQ2 graphic "sticker" is not to their taste, or it doesn't have a backlight, or it's too heavy/bulky/plasticky, or demand that John Smedley mail everyone $100.</p></blockquote><p>I think it would be fine to just pay postage/packing on them. The probably cost a few cents to make, and cost $10 bucks. </p></blockquote><p>SOE isn't manufacturing them. They have to pay someone else to do the manufacturing. Plus, they have software in the devices and software on a server to provide the sync for the algorithm for the numbers. None of that is free.</p><p>SOE -is- paying the shipping for US. International has a higher shipping cost.</p>

[Cratoh]

<p><cite>Rijacki wrote:</cite></p><blockquote><p><cite>Cratoh wrote:</cite></p><blockquote><p><cite>feldon30 wrote:</cite></p><blockquote><p>If they mailed these out for free, people would complain that the design of the EQ2 graphic "sticker" is not to their taste, or it doesn't have a backlight, or it's too heavy/bulky/plasticky, or demand that John Smedley mail everyone $100.</p></blockquote><p>I think it would be fine to just pay postage/packing on them. The probably cost a few cents to make, and cost $10 bucks. </p></blockquote><p>SOE isn't manufacturing them. They have to pay someone else to do the manufacturing. Plus, they have software in the devices and software on a server to provide the sync for the algorithm for the numbers. None of that is free.</p><p>SOE -is- paying the shipping for US. International has a higher shipping cost.</p></blockquote><p>I realsie soe is not making them themselves. Still they are likely to be a few cents each. </p>

[Trensharo]

<p><cite>Xiara@Antonia Bayle wrote:</cite></p><blockquote><p>Any chance of this being available for Windows Phone 7 please?</p></blockquote><p>+1</p><p>Blizzard got theirs out fast.  I expect RIFT to have one out soon.  Suprised it took this long for them to implement this, TBQH.</p>

[feldon30]

<p><cite>ffd700 wrote:</cite></p><blockquote><p>Are these for logging on to the Soe.com account management site, or also for logging into the actual game?</p></blockquote><p>Both. And the forums too.</p><p><cite>ffd700 wrote:</cite></p><blockquote>Also, how long are the codes good for once you push the button?  I've used SecurID in the past and their codes change every 60 seconds.  Do you have to push the button inbetween each login?</blockquote><p>60 seconds. Why would you need to login multiple times?</p><p><cite>ffd700 wrote:</cite></p><blockquote><p>Will there ever be a USB model that would be required to be plugged in to the actual machine logging on?</p></blockquote><p>I doubt it.</p>

[ffd700]

<p><cite>feldon30 wrote:</cite></p><blockquote><p><cite>ffd700 wrote:</cite></p><blockquote>Also, how long are the codes good for once you push the button?  I've used SecurID in the past and their codes change every 60 seconds.  Do you have to push the button inbetween each login?</blockquote><p>60 seconds. Why would you need to login multiple times?</p></blockquote><p>Well say you get done with your gaming session and you log off and then log back in later, would you be using the same code that was generated from the first time you logged on or would it have automatically generated a new one like a SecurID key fob, or would you have to hit the button on it again to generate a new number?</p>

[Senya]

<p>Each time you login you press the button to generate a code.</p>

[Bremer]

<p><cite>Xalmat wrote:</cite></p><blockquote><p><cite>Misuko@Antonia Bayle wrote:</cite></p><blockquote><p>The announcement specifically mentions iPhone and Android for the mobile authenticator. Are there any plans/possibilities of getting a BlackBerry app too?</p></blockquote><p>People still use BlackBerries these days?</p><p>Sarcasm aside, that's a good point.</p></blockquote><p>Just a few days ago I heard Blackberries are awesome for planning riots and pillaging.</p>

[Xalmat]

<p><cite>Bremer wrote:</cite></p><blockquote><p>Just a few days ago I heard Blackberries are awesome for planning riots and pillaging.</p></blockquote><p><a href="http://www.youtube.com/watch?v=kAG39jKi0lI" target="_blank">Reminds me of a joke...</a></p>

[Amnerys]

<p>Thanks Feldon, Rijacki and Senya for answering those questions quickly!</p><p>The 60-second time-out is for security. You wouldn't want to keep the same number all day or longer, or you'd kinda lose out on the main purpose of the device. <img src="/smilies/3b63d1616c5dfcf29f8a7a031aaa7cad.gif" border="0" alt="SMILEY" /></p><p>And nope, we're not making money on these. Also, they've been in the works for over a year (we talked about them at Fan Faire 2010) and it honestly can take that long for all of the back-end to be set up, along with placing the order, arranging for the art, syncing the technology, and then of course there are those pesky contracts and the red tape to deal with.</p><p>As for Blackberry, I'm not sure, but I can try to find out for you. And if anyone is interested in reading more about the company that makes these and their technology, <a href="http://www.vasco.com/verticals/appsecurity/online_application_security_overview.aspx" target="_blank">here's the link</a>. (Their URL is also on the back of the key fob.)</p>

[ffd700]

<p><cite>Amnerys wrote:</cite></p><blockquote><p>...</p><p>The 60-second time-out is for security. You wouldn't want to keep the same number all day or longer, or you'd kinda lose out on the main purpose of the device. <img src="/eq2/images/smilies/3b63d1616c5dfcf29f8a7a031aaa7cad.gif" border="0" /></p><p>...</p></blockquote><p>That's what I'm curious about though.  Does the display update on it's own every 60 seconds with a new number, like SecurID, or does it require you to push that button on it?</p><p>( I only keep referencing SecurID since that's the only key fob I've had any experience with in the past. )</p>

[Rhyashaa]

<p>The code updates every 60 seconds but you don't see it unless you push the button. Does that make sense?</p>

[ffd700]

<p><cite>Rhyashaa@Kithicor wrote:</cite></p><blockquote><p>The code updates every 60 seconds but you don't see it unless you push the button. Does that make sense?</p></blockquote><p>Ah, ok that makes more sense anyway, thanks.  <img src="/eq2/images/smilies/3b63d1616c5dfcf29f8a7a031aaa7cad.gif" border="0" /></p>

[Lodrelhai]

<p>What happens if you lose it or the battery dies?</p>

[Wingrider01]

<p><cite>Lodrelhai wrote:</cite></p><blockquote><p>What happens if you lose it or the battery dies?</p></blockquote><p>going on the current one I use for the other game you will need to remove it from the account, supposedly the battery is good for at least 5 years</p>

[Lodrelhai]

<p><cite>Wingrider01 wrote:</cite></p><blockquote><p><cite>Lodrelhai wrote:</cite></p><blockquote><p>What happens if you lose it or the battery dies?</p></blockquote><p>going on the current one I use for the other game you will need to remove it from the account, supposedly the battery is good for at least 5 years</p></blockquote><p>But how do you remove it from the account if you need it to log into the account?  Have to go through the same authentication as if you forgot your password?</p><p>5-year guarantee on the authenticator is nice.  Though it occurs to me if SOE had these back when I first signed up, I'd probably be looking for my third now.</p>

[ArivenGemini]

<p><cite>Lodrelhai wrote:</cite></p><blockquote><p><cite>Wingrider01 wrote:</cite></p><blockquote><p><cite>Lodrelhai wrote:</cite></p><blockquote><p>What happens if you lose it or the battery dies?</p></blockquote><p>going on the current one I use for the other game you will need to remove it from the account, supposedly the battery is good for at least 5 years</p></blockquote><p>But how do you remove it from the account if you need it to log into the account?  Have to go through the same authentication as if you forgot your password?</p><p>5-year guarantee on the authenticator is nice.  Though it occurs to me if SOE had these back when I first signed up, I'd probably be looking for my third now.</p></blockquote><p>You would probably have to call in to tech support and prove who you are to their satisfaction to have your account unflagged for it.</p><p>Once every few years isn't that hard a burden, especially when these can prevent your account from walking off without you... having the authenticator is a great boost to security.</p><p>Personally I don't like the "mobile" ones, since so far the implementations I have see on other games tend to have issues if you have to wipe and reload your phone since its a new install.. the authenticator has a different security id, so you have to either be sure its removed from your account before that happens (hard if you lose your phone or something) or call in to tech support.</p><p><img src="/smilies/3b63d1616c5dfcf29f8a7a031aaa7cad.gif" border="0" alt="SMILEY" /></p>

[Rhyashaa]

<p><cite>Lodrelhai wrote:</cite></p><blockquote><p>What happens if you lose it or the battery dies?</p></blockquote><p>You have to call customer service, verify your identity to their satisfaction, and they remove the authenticator from your account. If you find it later you can always re-add it to the account.</p><p>Battery is supposedly good for 5 years. I have yet to hear of anyone's battery dying on them (Blizz's authenticator).</p>

[BulletHole]

<p><cite>Cratoh wrote:</cite></p><blockquote><p>You lose everyone's details, shut servers down for weeks, generally really drop the ball. </p><p>Then you come up with a device that helps prevent this, and you want to <em>charge</em> people for it??</p><p>You're having a laugh.</p><p>Edited to add..</p><p>Shame on you.</p></blockquote><p>This isn't going to protect your credit card info that sony lost. Only your plat. lol</p>

[ArivenGemini]

<p><cite>BulletHole wrote:</cite></p><blockquote><p><cite>Cratoh wrote:</cite></p><blockquote><p>You lose everyone's details, shut servers down for weeks, generally really drop the ball. </p><p>Then you come up with a device that helps prevent this, and you want to <em>charge</em> people for it??</p><p>You're having a laugh.</p><p>Edited to add..</p><p>Shame on you.</p></blockquote><p>This isn't going to protect your credit card info that sony lost. Only your plat. lol</p></blockquote><p>This isn't intended to protect the database from external hacking.</p><p>This is entirely intended to prevent someone from logging into your account without your permission.  It works quite well at that.</p>

[SisterTheresa]

<p>I'm wary of these, and I will state why.</p><p>I don't know where these are manufactured, but the ones for WoW were made in China and were ended up being hacked into.  Sister sepnt enough money on things to keep from getting hacked there and was anyway.</p><p>Anyone use these already?  Do you like them?</p>

[Xalmat]

<p>What's the shipping time on these? I ordered one the first chance I could and I haven't received it yet.</p>

[Dellannah]

<p><cite>Xalmat wrote:</cite></p><blockquote><p>What's the shipping time on these? I ordered one the first chance I could and I haven't received it yet.</p></blockquote><p>Good question - I went searching for shipping info as I haven't received mine yet either, and I can't find an estimate on shipping time. </p>

[Senya]

<p>Amnerys posted <a href="http://forums.station.sony.com/eq2/posts/list.m?start=0&topic_id=504713#5604846" target="_blank">here</a>:</p> <p><cite>Amnerys wrote:</cite></p><blockquote><p>We've got an article going up later today across all sites to make this official announcement. <img src="/eq2/images/smilies/3b63d1616c5dfcf29f8a7a031aaa7cad.gif" border="0" /> The sales site went live on Tuesday (what we call a "soft launch") and we got the word yesterday to shout it from the rooftops, hehe.</p><p>Looks like you guys have most of the questions covered, but do be sure to read the FAQ at the link Zoltaroth provided.</p><p>Also, current processing and shipping time is reported to be about 2-3 weeks, so don't be concerned if you don't see yours in a few days. It's on its way. <img src="/eq2/images/smilies/3b63d1616c5dfcf29f8a7a031aaa7cad.gif" border="0" /></p></blockquote>

[Darkshadow]

<p><cite>Ridolain@Antonia Bayle wrote:</cite></p><blockquote><p>I'm wary of these, and I will state why.</p><p>I don't know where these are manufactured, but the ones for WoW were made in China and were ended up being hacked into.  Sister sepnt enough money on things to keep from getting hacked there and was anyway.</p><p>Anyone use these already?  Do you like them?</p></blockquote><p>I've used one of these in Paypal, Entropia Universe and the one for Rift, I have never had a problem with them, other than attempting to login at the end of a key-cycle and getting an error that I used an invalid key, but that happens few and far between.  I am not going to order the keychain, I am going to wait for the Android version.  The android version of the Rift authenticator works fairly well (even if they do update it like once a week).</p><p>The way they work is by the Keychain's serial number.  When you order the key, that serial number is is logged to your account. On newer types of keys, your security key, and account name are stored on a 3rd party server somewhere. Depending on the time of day, your key and your account will show a particular serial number (I assume it's random by some algorhythm these days). When that time runs out, the serial number changes. Now, I dunno how the keychain stays up to date, but app programs with internet access can be synchronized.</p><p>Older versions of these keyfobs had a finite number of serial numbers. They were fixed and programmed onto the chip. You're account was configured with the serial number for the keychain which told it what numbers to look for. These were inheritantly risky to use. </p><p> The newer keys, if someone were to hack the system they are stored on, would have to figure out a way to not only decrypt the algorhythm, but figure out which key is currently active for the next 30 seconds. Obviously, even though the keys are generated randomly, they are never truely random, given enough time, I am sure someone could predict your key. Gold farmers aren't going to spend that much time looking into a single account. They will move on to the weaker accounts.</p><p>The older keys were a lot easier, if someone hacked the database server, they just needed your algorhythm... since there was a finite number of keys, they didn't need the exact serial number your key is showing, just one of the keys in the chain.</p><p>So in my opinion, while yes there is SOME risk involved when using these authenticators, really I think the reward outweighs the risk.  If there are 2 accounts, one with just a password and one with a password and a random number it could take me hours to crack, I'm going to go with the easier one.</p>

[Dellannah]

<p>My authenticator apparently arrived today (so 2 weeks delivery time was indeed correct - thanks Senya for the link! and of course it was delivered the day after I asked but that's how my timing goes!). </p><p>Just a quick note, it came via the US Postal Service needing Signature Confirmation.  So since nobody was home, I either need to have it redelivered or go pick it up at my local post office.</p><p>A head's up to those that are waiting for it.</p>

[Rhyashaa]

<p><cite>Ridolain@Antonia Bayle wrote:</cite></p><blockquote><p>I don't know where these are manufactured, but the ones for WoW were made in China and were ended up being hacked into.  Sister sepnt enough money on things to keep from getting hacked there and was anyway.</p></blockquote><p>From what I remember the authenticators themselves weren't hacked but rather a few people were victims of man-in-the-middle attacks (go google or wikipedia it if you don't know what it is). This isn't the fault of the authenticator and on top of that, most gold farming corporations won't take the effort to do this. Easier to steal accounts that aren't authenticated than to go through the trouble of a MIM attack.</p><p>Darkshadow may be right about old authenticators but I've only heard of the above ever happening with the WoW authenticators.</p>

[Xalmat]

<p>My authenticator arrived on Thursday via the USPS, but like a previous poster said, a signature was required and I wasn't home to pick it up. So I had to mave a trip to the post office.</p><p>No big deal to be honest. I now have my authenticator.</p><p>The only problem is that if you stick it on your keychain, your keys will likely scratch it up pretty bad.</p>

[feldon30]

<p><cite>Ridolain@Antonia Bayle wrote:</cite></p><blockquote><p>I'm wary of these, and I will state why.</p><p>I don't know where these are manufactured, but the ones for WoW were made in China and were ended up being hacked into.  Sister sepnt enough money on things to keep from getting hacked there and was anyway.</p></blockquote><p>The RSA compromise had nothing to do with the fact that the physical devices are produced in China.</p>

[SisterTheresa]

<p><cite>Rhyashaa@Kithicor wrote:</cite></p><blockquote><p><cite>Ridolain@Antonia Bayle wrote:</cite></p><blockquote><p>I don't know where these are manufactured, but the ones for WoW were made in China and were ended up being hacked into.  Sister sepnt enough money on things to keep from getting hacked there and was anyway.</p></blockquote><p>From what I remember the authenticators themselves weren't hacked but rather a few people were victims of man-in-the-middle attacks (go google or wikipedia it if you don't know what it is). This isn't the fault of the authenticator and on top of that, most gold farming corporations won't take the effort to do this. Easier to steal accounts that aren't authenticated than to go through the trouble of a MIM attack.</p><p>Darkshadow may be right about old authenticators but I've only heard of the above ever happening with the WoW authenticators.</p></blockquote><p>Don't worry I know what MIM attacks are.  Possibly but still makes me wary nontheless.</p><p>Thanks for the info though.</p>

[SisterTheresa]

<p><cite>feldon30 wrote:</cite></p><blockquote><p><cite>Ridolain@Antonia Bayle wrote:</cite></p><blockquote><p>I'm wary of these, and I will state why.</p><p>I don't know where these are manufactured, but the ones for WoW were made in China and were ended up being hacked into.  Sister sepnt enough money on things to keep from getting hacked there and was anyway.</p></blockquote><p>The RSA compromise had nothing to do with the fact that the physical devices are produced in China.</p></blockquote><p>It was what I read at the time of the problems.  Neither here nor there now.  Thanks for the info on the authenticators.</p>

[StAyXreal]

<p>Is the Android one ready to download?</p>

[Starley]

<p><cite>Chieko@Valor wrote:</cite></p><blockquote><p>Is the Android one ready to download?</p></blockquote><p>+1</p><p>I would pay for an android app. I don't need any more gadgets to carry around.</p>

[Whilhelmina]

<p>Arrived in France in around a week after we bought it, very fast delivery. No signature asked here though.</p>

[Raetsel]

<p>My authenticator arrived yesterday. Successfully enabled all my accounts with my single auth token device.</p>

[Whilhelmina]

<p>EDIT</p><p>Forget me, said something stupid</p>

[Labruja]

<p>I'm not sure if Sony is aware of this, but the authenticator is not available for all areas on iTunes.  I live in ZA (South Africa), and it seems that we are not authorized to have this application.  Maybe someone at Sony could make a call...?  Please?</p>

[Xdatinelia]

<p>I ordered mine on 8/12, charge was processed on my card 8/27, it still hasnt arrived here.  I petitioned almost 48 hours ago and havent recieved a response, I am wondering what my next step is.</p>

[TorrynWoodsrunner]

<p>Is there any updated info regarding the Android and iPhone authentication apps? I don't have any need or desire for yet another device for me to keep track of.</p>

[Sheerz]

<p>BUMP</p><p>Still no smartphone app available, we're waiting.</p>

[SpeedyGonzales]

<p><span><strong>Mobile Authenticator Coming Soon!</strong></span></p><div><div>These are the words written on the web page since the Hardware-Authenticator was released. That was about 2 1/2 months ago. I have the Digipass, but i would really like to login from everywhere. And while i have my Mobile Phone always with me, i don't want to carry the Authenticator around and possibly lose it. So is there a release date for the Android-Software?</div></div>

[Yetok]

<p>Bump.</p><p>Four months and no word on the mobile authenticator?</p>

[CountKraven]

<p>Still waiting on mobile Authenticator, any updated info?</p>

[PsiberDaemon]

<p>Did SOE ever come out with an android app, or should I just buy a second authenticator and carry that around in my backpack?</p>

[TorrynWoodsrunner]

<p>No Android App, no iOS app, no word on updates, no apparent progress.</p><p>But hey, we have SOEmote! Isn't THAT cool? So anyone hacking our accounts can make funny faces at everyone as they rob you blind!</p>