Account security improvements

[Shred]

This FAQ probably should have been included on this thread:

https://forum.warmane.com/showthread.php?t=325532

But can anybody confirm whether the Google authenticator app can be used for multiple accounts? I multibox and I'd prefer the app over email, but I don't know if it can work for 5-10 accounts.

You can also set up a filter in gmail to forward all your authentication emails to a single email address.

[Mitzen]

Most people have a dynamic IP which changes every 24h, so that means every single day they have to redo it..... this is extremely inconvenient, people should have the option to opt out, and in the end of the day its at their own will, please rethink this move.

1 minute a day when you login for the first time for improved account security doesn't really sound that inconvenient, been doing that for years btw.

[Obnoxious]

Do you have the option to not use a password in any service you use out there?
No? How come you still use them? The principle is the same and even if you don't care about security and have your password saved it takes more than 0.000000000000001 second to login.

Plenty of services other players already mentioned, such as Discord, Steam, and many social platforms, use the exact same type of "are you really you?" confirmation sent as a code to an email or phone number. This isn't an exception, but what's becoming the norm.

If someone would seriously stop playing because of this, I suppose so be it. This sort of change isn't done on a whim or because someone didn't have anything else to do. Individual users might "not care," but we host a service used by hundreds of thousands of accounts and we have to use solutions with the global in mind.

[HyperX777]

I just love the fact how all of you clowns that are trash talking the industry standard, when it comes to security measures, are the first one to start ****ing on Warmane when you get your account compromised or complain on any minor inconvenience such as maintenance downtime, or server reset. But will also complain about any attempt by Warmane to improve their standards and bring the servers and YOUR security to a new level and make this not be a thrird world country high school project.

Before you let your lazy *** type bibles here on forum (which btw, took you more time than logging into the game in the next year would) without thinking about it first. Reconsider everyting involved and not just you being too lazy to log into the game. There isnt a single multiplayer platform out there which doesnt use e-mail address as its main security point. Username + PW for full account accesses is a horrible practice none of you clowns should be supporting.

Finally, you cant really influence Warmane's decision about improving their security for players that have more than 2 braincells. All in all this is a positive change you should be supporting and not just ****ing on any change you get your hands on. I know it's warmane playerbase mentality to **** on any out of the box idea or change anyone proposes but next time before you take a gulp of laxatives before going ham on a forum post, turn your brain on first and spend 2 minutes thinking about it.

Big W warmane.

[Arbiterone]

Well, can you break down the math on the justifications for security?

No, we can't. Why should we need to justify this with numbers?

is the real concern that there are scammers that are basically making money off of wealth that is supposed to stay within the warmane coin system? (by the way, most of us would support decisions you have to make for money, as long as its not obviously greedy)

Are you saying that staff members decided to sit down, have a discussion on "how can we make more money" and the end conclusion was that we have to add 2 factor authentication for player accounts?
Do you think we have some sort of 'greed' department that makes these decisions on the basis of 'making more money'?

[Mitzen]

Does this mean that we now log in with our emails to play the game instead of our username?

Login method stays the same. You'll use username to login.

We are also traveling in the dark here, they did not provide further information or instructions for avoiding your account loss, so I must presume that a contingency plan is needed I case things go South. I urge the warmane team to clarify this questions.

Like before this announcement, or after?

Account Integrity Policies, Guidelines and Information [Updated: March 09, 2017]

[Deadrock]

I always use 2FA to secure my account where this feature is provided. I feel calmer this way.
I am glad about this new solution for account security because it will lead to the collapse (or at least cause great damage) to the industry of bots, gold sellers and stolen accounts, for some reason none of those who complained about this innovation on the previous pages of this topic , didn’t even think about what/whom Warmane made such a tough decision against. Guys, sometimes it seems to me that some people were born with jelly instead of a brain when I look at these negative comments in this thread.
I saw only one guy in this thread who really understands the meaning of this security decision (@LezChap1) and not a single soul except him wrote something like that, and an interesting note after he wrote that these measures will shock goldsellers and bots, the moderator answered him with the text “Curious, isn’t it?” , as if indirectly confirming my words written above, and I unrealistically support the administration in this decision on account security. People don’t even understand that they should have taken their accounts seriously from the very beginning instead of registering a random Google account through an account generator and forgetting about it for the rest of their lives. Damn it, at least write down the data from the email that you created ONLY FOR your Warmane account on a piece of paper/notepad in your phone. Since WoW is a game where you spend HUNDREDS of hours developing your character, has it ever occurred to you how frustrating it would be to lose those characters? Have you ever thought that you might somehow lose access to your account and have to restore access? And now you yourself see the result of your careless attitude towards the data of your accounts, you will be extremely upset to lose all those hundreds of hours of play on your characters, but at the same time you absolutely did not give a damn about organizing security for these very characters on which you spent hundreds hours, you guys look like laughingstock from the outside, blaming the administration for their decision to clear the server (or at least cause huge damage to them) from bots/gold-coin-sellers and from stolen accounts.
I also saw a message from the moderator that one guy in this thread wrote from different accounts to justify himself (lol), I wouldn’t be surprised if a large number of those who speak very negatively about this security solution are those who work in the goldselling industry / botting and uses stolen accounts for this, which obviously they will not be able to log into after this update. (These are just my thoughts. I'm not pointing fingers at anyone.)
In general, I will summarize:
I’m very happy with the new solution and just wanted to leave my feedback on this from people like Me, @Seshollowaterboy and @LezChap1 (I don’t know these people, I just can’t believe that there are SO few people who understand why this is being done and that’s why I decided to note them )

[Obnoxious]

There's nothing wrong with being a multiboxer though, we're not breaking any rules as long as we're not PvPing or using third party apps.
It's not the end of the world, but it's going to make login in a bit more cumberstone. I really hope they'll give us the opportunity to turn it off.

It's true that multiboxing, within the limitation of five simultaneous characters, is in accord with the rules, but being allowed is where the support for that ends, it doesn't extend to any differentiated treatment. While I'm sure multiboxers are brought up in certain decisions, I'd be very worried if they were remotely considered any sort of deciding factor for changes that will affected Warmane as a whole.

This update in account security isn't optional, be it for regular players or multiboxers. An option to turn it off would render the effort moot.

[Repost]

question for all moderators, I currently have enabled on my main account 2FA only, but not ingame, my question is:
1.) Will there be any changes to my account that currently has 2FA enabled? - for example, do I need to input some additional code even if I have 2FA enabled already? or 2FA enabled accounts are not affected by this change? I am asking because my sister's email is on 2nd account.
2.) Since ingame is not enabled, will this automatically request code for ingame?

Thanks

It's the same 2fa system that we already have but being enforced for all accounts and email will be the default for accounts that had it previously disabled.

[Mitzen]

You should scroll through the thread and read it, the numerous concerns many have.

Google is literally banned in some countries

Gmail is required(?), or at least heavily recommended to make an account here.
VPN should help you with that.

they discourage multiple accounts

I have multiple gmail addresses, don't have a single issue.
Making those accounts wasn't hard, didn't require any extra steps, unless I wanted to link/use backup gmail which isn't required.

They are doing a large purge of inactive accounts at the end of the year

You will be warned about it for months in advance. Plenty of time to be active and send an email to keep your gmail account safe from termination.
Do you know who else does inactivity cleanups? Warmane. How can you avoid character from being deleted? Login once an year before it happens.

many have an alternate gaming email or ones they created just to make an account here.

As do I, and instead of tossing the info out of the window, I've kept hold of it because it's important.
I need to keep that gmail account secure (and info at hand), so that my Warmane account is secure too, and so that I can continue playing here too.

Again stop talking about hypothetical garbage and how easy it was/is for YOU, think of others or the whole community.

It is easy, people just made it harder for themselves with their actions, or lack thereof.

[Mitzen]

I didnt recieve code like 15 mins...

There might be some delays.

Authentication emails may be slightly delayed during peak times.

If after a minute you haven't received the code, double check your emails Spam or Junk folders as it may have been filtered there.

If still no authentication email has been received, we recommend double checking you're logged into the same email as the one displayed within the My Account section of the website. You could also update your accounts email to a new one as your email service provider may have incorrectly labelled the email as spam.

[Edifice]

The system has been re-enabled, the sending of codes should now be instant, regardless of volume.

We may enable the use of non-gmail emails over the coming days.
We will also introduce a username changing system, for those that receive a lot of suspicious TFA requests.

As someone mentioned, this is indeed a forced-2fa change, as with most modern platforms, security is paramount.
This is a step to bring us in line with other services, reduce our overheads for account compromise support and overall increase account security which is our #1 priority right now with recent compromising waves.

Regardless of players dislike for the system, It is a step in the right direction. The alternative is 'Bot Network' bans continue due to large target on our back, slower support due to amount of attention given to compromised accounts and restoring as much as possible for the player, following the hot-potato like movement of stolen items, gold, coins, characters between hundreds of accounts and so on.

[Edifice]

Update to the security improvements.

Update #1:
https://forum.warmane.com/showthread...83#post3196783

Update #2 to security improvements:

Restrictions on what emails can be used have been lifted, this allows using your desired email provider.
Restrictions on usage of "." and "+" have also been lifted, allowing the use of the same email through gmail for multiple accounts for example.

[Edifice]

Accounts which were using google authenticator for website only are too bugged atm. Google authenticator code works for website bot not ingame. You need to go in website and switch back to email authentication than back again to google authenticator + to remove in authenticator and scan once again to work. Jesus christ really dont know why ingame protection is that necessary when anyways you couldnt change email pass or smth since u cant log in website...

Thank you for clarifying, this has now been resolved.

It affected those that previously had the setting "Ingame protection" set to off.

[Sixtyninee]

A simple solution for this whole mess is to have this 2FA thing as a MUST when logging on website = no acc steals or for whatever reason this is made up, while when logging in game having it as either optional or turned off. 95% people from this topic are against the rule to have this forced logging in game as you can see and I am one of those as well, people want to log in game and play, not additional hassle every time when logging in game.

SOLUTION = having it as a MUST logging on WEBSITE = no way to steal accounts etc = perfect security measure, while when logging IN-GAME = optional, no hassle/stress for all the people.

Most likely GM's/moderators are not going to listen, as it has been always like that, but that will just result in the whole lot drop of a playerbase, especially on the long run, cause no one wants to enter on mail every time logging in game with different IP/location.

Promise? I'm really hoping this filters out some die hard cookie cutter thinkers.