Blizzard, the authenticator migration (aka SMS is now REQUIRED) is an awful idea

Not my problem, and you can get a refurbished post paid phone unlocked a cheap one from around 50 bucks…and at the right time can get them around for 30 dollars

TCL A30 Unlocked Smartphone with 5.5" HD+ Display, 8MP Rear Camera, 32GB+3GB RAM, 3000mAh Battery, Android 11, Prime Black (Renewed) https://a.co/d/2NXFYH9

You keep clinging to this “unlocked phone” nonsense. An unlocked phone makes 0 difference when you can’t even afford it or a postpaid plan to go with it.

Drop this “everyone can be like me” mentality and understand that different people live under different circumstances.

3 Likes

Then maybe people shouldn’t be playing subscription games that require money until their finances approved.

The whole department. It normalizes installing Blizzard apps on your phone with greater required permissions and Blizzrd’s Eula. Getting your phone number makes the data more valuable / easier to use with data brokers because it can serve as a unique ID to correlate data with other sources.

1 Like

Glad i never put one of those authenticators on any of my accounts.

1 Like

Ah yes, the tired bad-faith argument that people shouldn’t be able to play a game unless they can afford more expensive phones and plans that no other gaming company tries to push onto their customers.

Let’s not forget that people who are broke are probably the ones already playing the game for free by farming gold and buying tokens off the AH.

Next.

1 Like

My phone before I got an obamaphone was exactly this. Still no dice :stuck_out_tongue:

Any other suggestions? I promise whatever you suggest I have not only tried it but I have both tried it and asked a blizzard customer service rep about it.

Then your Sol, other than getting a post paid phone with a post paid plan…

I dont mind it…but i would like a physical authenticator not google or anything like that.

1 Like

Okay so we’re in agreement then. Glad I could help at least one person see that.

2 Likes

It took them a while to finally admit it lol.

I have one and have never had any indication yet it is failing. Nice to know it gives warning though because when it does that I will just have to remove it before it fails completely.

People have been using wow gold to pay for this game since WoD. A mobile phone would cost me $40 or more per month. Huge difference. Plus I would only be using said mobile phone one or two times a month so that is a huge waste of money.

2 Likes

Ok?

10char

Yes, indeed. When the button is pressed it will alternate between the auth code and “low batt”. Soon after I saw that I removed it and tried to swap to a physical auth that still had a good battery but that’s disallowed now. I’ve since transitioned to the phone app. At first had some struggles because the “pay as you go” phone with AT&T I bought just to secure my account uses a VoIP number - but after briefly using a rented number - I found a workaround that allowed me to use the VoIP number with AT&T for a while. My employer supplies us with a phone but historically has not allowed gaming or gambling apps. IT received a petition from around 100 employees asking them to make an exception so they reviewed the battlenet app and determined it was not a threat to IT security at our research institute. So many of us who had to get a second phone just to secure our Warcraft accounts no longer have that expense (yay!).

BTW see below because it is NOT just VOIP phones (pay as you go) that are the only ones causing issues…

1 Like

By the way, I’ve since learned that a lot of the confusion about what works and doesn’t has to do with issues beyond the control of the player.

A little history… the Mobile Auth and SMS protect used to be totally separate. So it was true that you did not need a phone number to use the Mobile Auth, just a device that could run it. Recently that changed and you need an eligible phone number even for the Auth. This of course creates issues because pre-paid numbers, or VOIP numbers are not eligible.

Worse, some numbers are flagged as pre-paid when they no longer are. Cricket and TracPhone seem to fall into that bucket a lot (but not always).

It’s not really the provider or the type, per se. It’s how the specific number is classified with the FCC.

While originally most pre-paid numbers weren’t working, some would. Most regular subscription phones worked fine, but then a handful didn’t, because, at one point or another, the number itself was registered through the FCC as a pre-paid number.

There wasn’t really any hard and fast thing that was evident. As I said before, people liked to point at Cricket Wireless, but some still worked fine despite being Cricket. For example, people who had been a subscriber through Verizon as long as they had the phone but at some point in its lifetime, that number was registered through the FCC as a pre-paid number. I had the same issue with AT&T.

So it’s not really on the provider in question, it’s all based on the number’s registration through the FCC. So I’m assuming that what happens when Blizz receives an app-based authenticator request the system cross-references the number with a database of FCC registration data and is red flagging anything that hints at being (or having been) a “burner” phone.

Unfortunately, even when presented with documentation that this is not a phone you bought as a “burner” - but is a phone you’ve had for ages and use for everything - Blizz can’t change the flagging and the phone provider usually can’t either. Neither can the player.

So it’s a roll of the dice whether or not your phone will work - prepaid or not.

When my new prepaid phone number didn’t work my workaround was to call AT&T and get them to change my number three times till - by chance - I got one that had never been registered with the FCC as prepaid.

Note that some “long-term contract” (NOT pay as you go) numbers are actually recycled from prior prepaid plans also, and may not work.

So (as I understand it - I’m not an expert) the only real workaround if you get stuck with one of these is to keep asking your carrier for a change in number till you get one that works.

3 Likes

This is not a real workaround and it is absolutely senseless that you would need to recycle your phone number just to secure your account on a FREAKING VIDEO GAME. Blizzard really needs to rethink this.

This sort of thing, of course, quite possibly has absolutely no meaning if you are a player who does not reside in the US but plays World of Warcraft, such as Oceanic players, or quite possibly Canadia. You might just be SOL.

As a NZ player, phone numbers literally don’t work with the same restrictions and rules that I’ve seen from US providers, and who knows what “data” Blizzard is hooking into for overseas information (if any at all)

DISCLAIMER: I know this post has a TL;DR issue - you really need to care about this subject to get through it :wink:

It’s not just a Blizzard issue. For years now, industry leaders and cybersecurity experts across many industries have been calling on people everywhere to take steps to improve their online security. So everything is evolving and even the most mundane online account can now be secured with account verification techniques, such as phone verification and two-factor authentication (2FA), and keyfob physical authenticators.

For work I have a Yubico Security Key C NFC USB device to provide authentication security that protects access to any of our enterprise user accounts for websites, software, systems, and networks. And even then when I first log on I get pinged on my company phone. So I don’t even know what that would be called - four (or is it five or six) factor authentication?

All these security features enable the entities we interact with to verify the unique identity of each legitimate end-user through their valid phone number - at the very least.

Through this phone number, provided by the end-user, businesses can prevent fraud and protect account access through 2FA - where the device tied to that number serves as the second factor.

Phone numbers are now often considered the standard minimum trust anchor for end-user accounts. In some cases, a user’s valid phone number is their user name.

But what happens when the very phone numbers that are used to verify and keep end-users secure are given up, recycled and assigned to a new person?

Phone number deactivation is an industry term that refers to the event when a user disconnects their phone number completely. This could be because they moved to a new city, want to prevent specific people from reaching them, or just feel like changing things up. Whatever the reason may be, they are no longer reachable at this phone number.

Phone number recycling is the industry term that refers to the event when that deactivated/disconnected number gets reassigned to someone else. Typically, it takes at least 90 days for this reassignment to take place but it can be faster in high-demand area codes (212, 310, etc.).

So why is number recycling a problem?

According to the FCC, approximately 35 million phone numbers are recycled every year, or about 100k every single day. Benchmarked against the 361 million U.S. phone numbers, approximately 10% – or 1 out of ten – phone numbers change hands every year.

To understand the security risks of phone number recycling, researchers from the Department of Computer Science and Center for Information Policy at Princeton University analyzed a sample of 259 reassigned phone numbers. The researchers discovered that two-thirds – or 66% – maintained active connections to accounts owned by the previous owners.

So bottom line is recycled phone numbers create significant security and privacy risks - which is why Blizz red flags them.

In the most basic scenario, the new owner of a phone number is now tied to the account that the former owner linked to that same number - providing access to someone else’s account. Alternatively, this can also lead to:

  • The true user being locked out
  • Account notification failure
  • Security code failure
  • Password resets and other messages and alerts not reaching the end-user

Statistically, number recycling churn rates are much higher with pre-paid phones and VoIP numbers than they are with long-term contract phones.

So it’s not too surprising that a security expert would discourage allowing the use of numbers registered with the FCC as VoIP or pay-as-you-go numbers.

Again, in the case of my employer, they covered all their bases - they supplied me a router and hardware firewall device, a laptop that IT has control over, they also supply me a phone (that IT has control over) and they supply me a USB token that has to be inserted in the laptop - after which I get a ping on the phone with a security code I have to enter before I can even enter my password (which is force changed with a randomly generated string every quarter) - all this to log into my IPsec VPN every day.

Something else employers will do that Blizz hesitates to do is delete accounts for inactivity. Any IT department will tell you that orphaned accounts are problematic because they are old user accounts that contain data encompassing usernames, passwords, emails, and more. The older they are the weaker their passwords (generally). Imagine an orphaned (former) department head account that a bad actor gets ahold of - you can see why companies cull orphaned accounts quickly. The parallel in WoW might be the account belonging to a (former) Guild leader with full bank control. Everyone had heard stories of a hacked officers account social engineering their way to GL then kicking everyone before looting the bank. Employers are quick to lock out orphans - but Blizz wants those customers back so hesitates (creating security vulnerabilities).

The whole gaming company dynamic when it comes to security is problematic.

So for me jumping through the hoop of changing my cheapo “burner” phone number a few times till I randomly came up with one that was never registered with the FCC as ‘pre-paid’ wasn’t so bad. Sure I wish Blizz had another security scheme.

I liked the physical authenticator - if you have a modern version there are far fewer ways to get screwed over with them. But I would guess Blizz did away with them because the expense versus a phone-based software token was limiting the kind of widespread adoption they wanted to see.

Software token only has two advantages going for it which are cost and a potential ease of use in that most people always carry their phone around with them making it easier to log on from other computers than the physical token.

But that said, I’ve heard of software authenticators being unreliable and bugging out/detaching themselves from accounts. And of course, the issue with these numbers is the system red flags because they were at one point registered with the FCC as ‘pre-paid’.

Furthermore, there’s always the risk of your device getting a virus (not going to happen with a physical authenticator).

Over the years I had a hardware authenticator for Blizz games and work and my only issue lay with accidentally throwing it away. Other than that I love having this security.

Also, there’s a code on the back of it you can use to detach the authenticator from the account with in case you lose it/it breaks or the battery dies. I don’t know what the process is if my phone gets lost or wiped but I should probably look into that.

Ah, the joys of modern technological complexity.

But, hey - at least I still have my Core Hound pet.

At least they got that right in the transition :wink:

1 Like

I used to raid with an Oceanic guild on a US server and even though it finally transitioned to an Oceanic server for recruitment purposes, I still stay in touch with some friends there.

What they are doing to secure their accounts is renting SIM-card based (not VoIP or pre-paid flagged) US numbers from onlinesim.io or mobilesms.io – this allows them to not only authorize the Blizz security feature but also receive multiple SMS verification codes for any service that asks for a US-based number. Note they also offer numbers based in other countries. I used one to play with friends in Korea for a while (but that also requires a valid Korean social security number equivalent so theres a bunch of hoops to jump in that case)