Introducing the Square Enix Security Token

[Corrderio]

I'm going to laugh if the in-game item is a keypad that requires you to enter a passcode (for laughs) just to get into your Mog House. XD

And if you enter the wrong combo your MH exploids just like in Maniac Mansion >.>

[Zekyr]

Or a key to a new storage box at a Mog Bank that has 80 new storage slots. Quickest sellout ever.

[Pikarya]

Or a key to a new storage box at a Mog Bank that has 80 new storage slots. Quickest sellout ever.

Probably the best idea of the century for a marketing purpose. Every fucking person in the game would buy it.

[Silenka]

Or a key to a new storage box at a Mog Bank that has 80 new storage slots. Quickest sellout ever.

So I wonder if they'll do it?

[Siegtaru]

Don't know if this was brought up, but I mentioned this to my friend and he said "If someone was keylogging your password anyways it would just read it off the device" and I said "Well then you just reset it by pressing the button again after logging in?" and he replied "If the device is connected to the computer, because it has to have some sort of connection to the server, the keylogger could pick it up from the connection." so I wanted to know, is this thing going to need to be connected to the terminal which you're entering the password on, or is it wireless?

[frodnonnag]

Don't know if this was brought up, but I mentioned this to my friend and he said "If someone was keylogging your password anyways it would just read it off the device" and I said "Well then you just reset it by pressing the button again after logging in?" and he replied "If the device is connected to the computer, because it has to have some sort of connection to the server, the keylogger could pick it up from the connection." so I wanted to know, is this thing going to need to be connected to the terminal which you're entering the password on, or is it wireless?

wireless. press a button, get a code for that specific 30 second time window to log in.

[Spekkio]

Don't know if this was brought up, but I mentioned this to my friend and he said "If someone was keylogging your password anyways it would just read it off the device" and I said "Well then you just reset it by pressing the button again after logging in?" and he replied "If the device is connected to the computer, because it has to have some sort of connection to the server, the keylogger could pick it up from the connection." so I wanted to know, is this thing going to need to be connected to the terminal which you're entering the password on, or is it wireless?

this has already been covered. the token never directly interacts with the computer and the button only serves to activate the screen. to use the device you press the button to get the current code and input that into the computer. the code is only good once and only for a few minutes so a coordinated and speedy attack against it with a keylogger would be entirely possible but would require more technical coordination.

[Frenzy]

So how do these things communicate with the PC which password is the currently correct one?
Someone said wireless, do these bring their own way to wirelessly connect to a PC with them?

[millionsknives]

Just read the first page of the thread and its all explained...

[Gergall]

So how do these things communicate with the PC which password is the currently correct one?
Someone said wireless, do these bring their own way to wirelessly connect to a PC with them?

There is no communication at all. Your password is constantly changing. The device knows the secret recipe to determine your current password, and shows it to you when you push the button.

[shaddix]

The device knows the secret recipe

lol, i like this

[Araelus]

Delicious Cake You Can Eat*
from The Secret of Cooking by Ron Rivest, Adi Shamir, and Len Adleman.

1 (one) Internal Clock
128 bits of seed (factory-encoded random key)
5 oz. plastic
1 (one) LED display panel
1 (one) button

Combine ingredients and press button.
Recipe provides for one password every 30 to 60 seconds.



*delicious cake not included, may be sold separately

[Vuitton]

I use the Blizzard Authenticator. For the confused:

It is basically a keygen. When you tie it to your account it will ask you to enter in one of the number sequences your keygen spits out. This allows your account to orient itself on the algorithm your keygen is using. Once it has oriented itself on your keygen, any number sequence the keygen gives will work as it mathematically matches the algorithm.

Its similar to when you could download a keygen to unlock software you pirated. The software isn't made to accept one specific code, its programmed to accept any code that matches the algorithm.

edit:

Of course, once you enter in a keygen, your account knows not to accept it again in the future after a small period of time. This prevents key loggers from logging your keygen and using it to log in.

[Corrderio]

You know, this thread makes me wonder how long it'll be before MMOs start packaging these with the game.

[Silenka]

More widespread use means more people will be trying to find ways around it, unfortunately. And for every security measure there is an equally good piracy method. =(

[Corrderio]

More widespread use means more people will be trying to find ways around it, unfortunately. And for every security measure there is an equally good piracy method. =(

True, but I do see it being a standard for MMOs in the future.

[Spekkio]

much DRM and other material is circumvented because of a flaw found in the implementation, not in the cryptographic techniques used. since this is virtually a pure crypto function with no surrounding software, this will be extremely secure. hashes like this have been used to secure UNIX passwords (though with a unique, fixed SALT to ensure unique hashes instead of a unique seed and a time offset) for over a decade and yet it remains unbroken. let's move on.

[Izzy]

I use the Blizzard Authenticator. For the confused:

It is basically a keygen. When you tie it to your account it will ask you to enter in one of the number sequences your keygen spits out. This allows your account to orient itself on the algorithm your keygen is using. Once it has oriented itself on your keygen, any number sequence the keygen gives will work as it mathematically matches the algorithm.

Its similar to when you could download a keygen to unlock software you pirated. The software isn't made to accept one specific code, its programmed to accept any code that matches the algorithm.

edit:

Of course, once you enter in a keygen, your account knows not to accept it again in the future after a small period of time. This prevents key loggers from logging your keygen and using it to log in.

I'm pretty sure that's not how it works. In this case, someone could brute force a password quite easily using the same method that....oops, I fear I've said too much.

The key probley works just like every other RSA network logon device.

[Corrderio]

oh my god, I just had the vision of the final screen from that and a Moogle flying out the chimney.. "Kuuuu-pooooooooo~" as he fades to oblivion.

i'm so going to hell

LOL xD

I miss Maniac Mansion. That game was fun as hell.

[Corrderio]

it really needs to be ported. Somewhere. I'd buy it.

did you ever try to get all 34 endings? >.>

I should try that. I know there's a freeware version of it called Maniac Mansion Deluxe, but I kinda liked the NES version just for the music the characters had when you switched to them.

But yeah, they need to port Maniac Mansion and Day of the Tentacle to current-gen systems. They'd be perfect on the DS thanks to the stylus. Maybe someone will figure out how to port them after while when the DSi comes out? Always a hope.

Also, thanks for not making me feel like a total nerd for knowing thos games, elphaba. xD