Battle.net Authenticator Changes, Don’t Panic!

So in-case you missed it, there was a recent change to how our accounts are authenticated, here it is again for you again if you didn’t see it.

If you use an authenticator – and we hope you do – you may soon notice that an authenticator prompt may not appear with every login. We’ve recently updated our authentication system to intelligently track your login locations, and if you’re logging in consistently from the same place, you may not be asked for an authenticator code. This change is being made to make the authenticator process less intrusive when we’re sure the person logging in to your account is you.

We hope to continue improving the authenticator system to ensure the same or greater security, while improving and adding features to make having one a more user friendly experience. If you don’t already have a Battle.net Authenticator attached to your account, don’t wait until it’s too late – http://us.battle.net/en/security/checklist

Well, this statement has raised quite a few questions. Many of us in the gaming community work in Information Technology / Information Security, and we are quite honestly interested in having more information on this.

Now before I get started I want to have a note here that the information after this point will represent a more general view of internet protocol. This is not intended to be a tech manual, just the musings of an internet worker who is also a gamer.

There are a couple ways that you might authenticate a computer at a physical location. One is by authenticating the public IP address that is reaching out to the login server. If you see multiple requests from the same IP in a short period of time, you can assume this is the same person to a certain degree. This works in part because IPs are purchased by ISP’s and assigned to a specific region. After that, you as the user rent the IP with a lease sort of like renting an apartment. If you have a static IP, you have a “permanent” lease on that particular IP. If you use a DHCP service, like cable internet, it may change based on what’s available. Every time you get a new IP, it’s from your local region and the local pool. It could also authenticate by not only your public IP address, but also your computers MAC address. A MAC address is a unique identifier that all networking devices have. Think of it like a social security number for your computer. Each one is unique per device. There is however a couple potential problems; IP’s / MAC addresses can be spoofed. Not that it’s something you should be worried about all the time, but it is a fact that it can happen. Also if you have a Dynamic IP and it solely authenticates by the address, every time your IP changes it could cause issues.

Another manner is the creation of software tokens that are placed on client end at the point of logging in. Essentially you log in to your account and a software token, or marker of a successful login, is created on your machine to further authenticate you. By doing this it can validate the token on your machine instead of requiring you to to punch in your authenticator code every time.  The potential problem with software tokens is that if your system is compromised due to trojans or other methods, it could result in a compromising of the security token. Again, while this isn’t something to worry about all the time, but it does happen.

There are several other methods you could use, but those are probably the easiest.

So what method is Blizzard using? Well I decided to perform a little experiment last night to see what I could gleam as far as information goes. Since I work for an ISP in my daily Clark Kent style life I have access to a few things that I can do easily (and legally) to perform a simple test.

Step one was to pick a new IP. I changed my IP to one available from a local pool in the lovely state of Wisconsin. I logged into my Bnet account, it asked for my authenticator normally. I logged out for a period of time, roughly 15 minutes, logged back in and it did not ask me for my Authenticator.

Step two was to change back to a local IP address from back in good old NY state. I logged into my bnet account, and it asks me for my authenticator code. I logged out for another 15 minutes and then logged back in and it did not ask me for my authenticator.

Step three was to repeat step one, but this time after it did not ask me for my authenticator I logged out and completely shut down and restarted the computer. Logging back in required me to use my authenticator. I repeated the steps with a local IP with the same results. Continuing this process multiple times confirmed the same results, each time with different IPs.

From this incredibly simple experiment it would seem that the new authentication process is using a combination of validating your IP either for location, consistency, or potentially both as well as potentially a software token on your machine validating it after a successful login. Every time you cold boot your computer it will remove temporary data, including any software tokens created. Whether or not this is actually how Blizzard is doing it, we won’t know unless they say something.

There are a couple things that confuse me slightly. First is that there was no prior announcement to the change going live rather than it just appearing. I’m wondering if this is a knee-jerk reaction to the recent string of hacker invasions going on across the blog-o-sphere. Second the lack of explanation of the process is concerning, not the exact process per say, but knowledge that this was carefully thought out and not hastily implemented would be comforting, as well as hearing the reasons for the change. Lastly is that there is no option to opt out of it, it just happens. If nothing else I am a creature of habit, and I like typing in my authenticator code every single time. It’s a preference, but it’s something that I would like to have the option to continue doing.

So in the end, while my first reaction to the change was not a positive one, I feel much better about it after my simple experiment. At the very least we know that they are checking for multiple factors before just allowing you to log in. While on a professional level I would love to know more about the process they are using, I don’t think it’s anything we should be too overly worried about. Now if only we could get that pesky opt in/out toggle…

Occuthar Strategy, the new Baradin Hold Boss

This mutt has been available on the PTR for some time. He had way too much health on 10 man during my initial times with him. He’s much more manageable now. You’ll find that this fight is a slight DPS check and skill check.

When you first engage the encounter, the tanks will need to pull him back to a corner and point him away from the raid. The rest of the group will need to stand and spread out around him. Naturally, there is a tank switch involved. When your first tank eats the shadow debuff, your second tank needs to taunt right away until that debuff wears off. The second tank needs to stay off near the side so as to not get hit by Searing Shadows.

Watch out for large, glowing circles around the room. Stay out of those. The DPS check kicks in when he does his Gaze of Occu’thar ability. He launches those little eyeballs of his from the top of his head and sends them towards every player. They’ll hit for around 5000+ damage a second. Have everyone gather up in one central location and light up your AoE. If you don’t kill the eyes quick enough, they’ll explode and dish out 25000 damage to everyone nearby. Spread back out as soon as that’s done!

Enjoy the ridiculous amount of PvP gear that’s bound to drop!

Here’s a kill video from Memento  Mori and Method on 25 man in the PTR

Valor cap the new softlock? Lodur’s opinion

Yesterday we got news that the valor cap is being lowered from1,250 valor points to 980. This may seem like an insignificant change by itself, but it comes among a series of others as well.

  • The maximum number of Valor Points awarded for completing Rise of the Zandalari dungeons remains at 980.
  • The maximum number of Valor Points awarded for completing Heroic dungeons remains at 490.
  • The number of Valor Points awarded for killing a boss in the Firelands is 70 in 10-player mode, and 90 in 25-player mode.
  • The number of Valor Points awarded for killing Occu’thar in Baradin Hold is 35 in 10-player mode, and 45 in 25-player mode.
  • The number of Valor Points awarded for killing a boss on Heroic difficulty in The Bastion of Twilight, Blackwing Descent, and Throne of the Four winds is 35 in 10-player mode, and 45 in 25-player mode.

Raiders completing a full tier 12 raid clear will obtain 630 valor points from raiding 25’s and 490 points for 10’s. If they go back and raid heroic levels in the previous tier, they can gain another 585 (25’s) or 455 (10’s) points. Players running their heroic ZA/ZG will be able to cap out on valor points without having to set foot in a raid. So this raised a few questions, and quite a few opinions. I know I had a good run at it on my twitter account yesterday. So what can we take away from this?

The change really levels the playing field for obtaining raid quality gear and Tier 12 items. Whether you’re in a raid or just able to run heroics, everyone will be doing so at roughly the same pace. This can be good for those players attempting to play catch-up in terms of gear so that they too can raid. I understand that point, but I see a couple potential problems with this.

By lowering the amount of valor points in the previous tier, they are attempting to stem the flow of free valor points. I get that, but it partially removes the incentive for doing the tier after the new one comes out. Now I’m not saying this because I want to farm valor points, but it presents a problem. The raid lockout was recently changed with Cataclysm so that 10 and 25 man raids share the same lockout. As a result, for raiding guilds looking to trial out members it means they either have to take them on content that isn’t progression. This takes away from progression raiding time and can actually hinder a guild’s progression. Previously you could take the person into a 10 man raid and see how they did without disrupting your larger raid group’s progression. I personally was looking forward to having a testing ground in the previous tier of content to run recruits through and see how they do, but with the reduction in points I think it’s going to be quite hard to entice people to go back to the previous content. Also, I don’t know about you, but my guild doesn’t have many plans on keeping the previous content in the rotation when there’s new content to progress through, unless we’re going back for a Sinestra kill.

The idea of not being able to cap out from the current raiding tier bothers me. It means I’ll be forced to do heroics to reach the cap, or try to do so from some other method. I don’t like the idea of being forced to do something else, especially when I spend so much time a week already raiding. Sure it’s great for the non raiders who only run heroic dungeons, but I can’t help but feel it’s a slap in the face for raiders. essentially it’s forcing us to spend more time in game doing content we’ve been running since shortly after the game was released. With only 7 bosses in this tier (+1 for Baradin Hold) we’re falling short of our valor cap by 350 points if we full clear. We can assume we won’t be killing Ragnaros on day one of Firelands, so ultimately it means we’re going to spend even more time grinding in game on top of raiding.

It just smacks of an attempt to keep us in the game longer for the ever elusive gear chase. Right now, the new cap puts you at roughly about three weeks to obtain a piece of tier / vendor gear. That’s if you hit the cap every week. So if you’re raiding 15 hours a week, and you’re still learning the fights and aren’t clearing the whole new tier, you’re still forced to do several hours of either other tier raiding AND heroics, or just heroics. This is a significant time investment, and considering it’s content that a lot of us have already done to death, it has the potential to significantly increase burnout. I know a lot of people personally that have seen this and have already decided to stop raiding as a result. It also comes at a time where summertime burnout is creeping in, and this change doesn’t help matters any. Part of it is the fault of only having 7 new bosses in the game, part of it is just the gear grind in general.

It also, in part, seems like a soft gate. Keeping players under-geared longer means it will take longer to get through the content. With only 7 bosses in the tier, I can understand that to a point, but then it puts us in a position similar to what we were in when ICC was out, stagnant. It’s going to be doubly annoying if you hit a DPS wall that only new gear can fix, but you’re weeks away from that relief coming. How about a boss that is a hard healing check, that healers just simply are behind stat-wise through no fault of their own, to heal through. It will take longer to gather the gear to push through the bosses to down the content. While that is partially true of every tier, the limited number of bosses in this tier combined with the new cap in points makes this take that much longer.

It will be interesting to see how things pan out as this eventually rolls to live, and how players will react to it. Me personally, it just means I’ll be spending more time grinding points on my shaman so I can keep up with the raiding content, and a whole lot less time enjoying myself on my alts, if only because there are only so many hours in a day and I can only spend so much of them at my computer desk.
What do you think about this change? do you love it or hate it? How will it affect your time in game?


Valour Cap Lowered

Just saw this in the latest iteration of patch notes.

The maximum number of Valor Points which can be earned in a week from any and all applicable dungeons and raids is now 980, down from 1250.

  • The maximum number of Valor Points awarded for completing Rise of the Zandalari dungeons remains at 980.
  • The maximum number of Valor Points awarded for completing Heroic dungeons remains at 490.
  • The number of Valor Points awarded for killing a boss in the Firelands is 70 in 10-player mode, and 90 in 25-player mode.
  • The number of Valor Points awarded for killing Occu’thar in Baradin Hold is 35 in 10-player mode, and 45 in 25-player mode.
  • The number of Valor Points awarded for killing a boss on Heroic difficulty in The Bastion of Twilight, Blackwing Descent, and Throne of the Four winds is 35 in 10-player mode, and 45 in 25-player mode.

Looks like Blizzard’s trying to slow down the valor income rate significantly. Instead of getting a chest piece in two weeks, we’ll have to wait three weeks. Not sure if I like this. There’s not much of a point to go back doing Blackwing or Bastion on Heroic with the reduced valor there either. Well, unless you’re going for completions sake.

EDIT: Should be Valor right? Darn this split English language thing!