DISCLAIMER: I know this post has a TL;DR issue - you really need to care about this subject to get through it
It’s not just a Blizzard issue. For years now, industry leaders and cybersecurity experts across many industries have been calling on people everywhere to take steps to improve their online security. So everything is evolving and even the most mundane online account can now be secured with account verification techniques, such as phone verification and two-factor authentication (2FA), and keyfob physical authenticators.
For work I have a Yubico Security Key C NFC USB device to provide authentication security that protects access to any of our enterprise user accounts for websites, software, systems, and networks. And even then when I first log on I get pinged on my company phone. So I don’t even know what that would be called - four (or is it five or six) factor authentication?
All these security features enable the entities we interact with to verify the unique identity of each legitimate end-user through their valid phone number - at the very least.
Through this phone number, provided by the end-user, businesses can prevent fraud and protect account access through 2FA - where the device tied to that number serves as the second factor.
Phone numbers are now often considered the standard minimum trust anchor for end-user accounts. In some cases, a user’s valid phone number is their user name.
But what happens when the very phone numbers that are used to verify and keep end-users secure are given up, recycled and assigned to a new person?
Phone number deactivation is an industry term that refers to the event when a user disconnects their phone number completely. This could be because they moved to a new city, want to prevent specific people from reaching them, or just feel like changing things up. Whatever the reason may be, they are no longer reachable at this phone number.
Phone number recycling is the industry term that refers to the event when that deactivated/disconnected number gets reassigned to someone else. Typically, it takes at least 90 days for this reassignment to take place but it can be faster in high-demand area codes (212, 310, etc.).
So why is number recycling a problem?
According to the FCC, approximately 35 million phone numbers are recycled every year, or about 100k every single day. Benchmarked against the 361 million U.S. phone numbers, approximately 10% – or 1 out of ten – phone numbers change hands every year.
To understand the security risks of phone number recycling, researchers from the Department of Computer Science and Center for Information Policy at Princeton University analyzed a sample of 259 reassigned phone numbers. The researchers discovered that two-thirds – or 66% – maintained active connections to accounts owned by the previous owners.
So bottom line is recycled phone numbers create significant security and privacy risks - which is why Blizz red flags them.
In the most basic scenario, the new owner of a phone number is now tied to the account that the former owner linked to that same number - providing access to someone else’s account. Alternatively, this can also lead to:
- The true user being locked out
- Account notification failure
- Security code failure
- Password resets and other messages and alerts not reaching the end-user
Statistically, number recycling churn rates are much higher with pre-paid phones and VoIP numbers than they are with long-term contract phones.
So it’s not too surprising that a security expert would discourage allowing the use of numbers registered with the FCC as VoIP or pay-as-you-go numbers.
Again, in the case of my employer, they covered all their bases - they supplied me a router and hardware firewall device, a laptop that IT has control over, they also supply me a phone (that IT has control over) and they supply me a USB token that has to be inserted in the laptop - after which I get a ping on the phone with a security code I have to enter before I can even enter my password (which is force changed with a randomly generated string every quarter) - all this to log into my IPsec VPN every day.
Something else employers will do that Blizz hesitates to do is delete accounts for inactivity. Any IT department will tell you that orphaned accounts are problematic because they are old user accounts that contain data encompassing usernames, passwords, emails, and more. The older they are the weaker their passwords (generally). Imagine an orphaned (former) department head account that a bad actor gets ahold of - you can see why companies cull orphaned accounts quickly. The parallel in WoW might be the account belonging to a (former) Guild leader with full bank control. Everyone had heard stories of a hacked officers account social engineering their way to GL then kicking everyone before looting the bank. Employers are quick to lock out orphans - but Blizz wants those customers back so hesitates (creating security vulnerabilities).
The whole gaming company dynamic when it comes to security is problematic.
So for me jumping through the hoop of changing my cheapo “burner” phone number a few times till I randomly came up with one that was never registered with the FCC as ‘pre-paid’ wasn’t so bad. Sure I wish Blizz had another security scheme.
I liked the physical authenticator - if you have a modern version there are far fewer ways to get screwed over with them. But I would guess Blizz did away with them because the expense versus a phone-based software token was limiting the kind of widespread adoption they wanted to see.
Software token only has two advantages going for it which are cost and a potential ease of use in that most people always carry their phone around with them making it easier to log on from other computers than the physical token.
But that said, I’ve heard of software authenticators being unreliable and bugging out/detaching themselves from accounts. And of course, the issue with these numbers is the system red flags because they were at one point registered with the FCC as ‘pre-paid’.
Furthermore, there’s always the risk of your device getting a virus (not going to happen with a physical authenticator).
Over the years I had a hardware authenticator for Blizz games and work and my only issue lay with accidentally throwing it away. Other than that I love having this security.
Also, there’s a code on the back of it you can use to detach the authenticator from the account with in case you lose it/it breaks or the battery dies. I don’t know what the process is if my phone gets lost or wiped but I should probably look into that.
Ah, the joys of modern technological complexity.
But, hey - at least I still have my Core Hound pet.
At least they got that right in the transition