Diablo 3 Account Theft

[Cpt._Keyes]

no smart phone, outside US or dont want to pay 7 for the authenticator, they have a dial in authenticator, where you set up a phone number you call from to authenticate account access

How do I get spam on an email address that I have never posted anywhere on the internet and simply exists? Answering a question with a question is bad, but I think it makes the point pretty adequately.

also i dont know what you have done with your email, but for all 3 of my discrete addresses and work I get no spam, not even any hit by the filters. If thats honestly a concern of yours...I would check where or on what you have used the address on

Also, I'm not excusing blizzard, but the majority of the time, it boils down to the same cause as 99% of the other computer problems that exist in the world...user did something to cause it

[frostdillicus]

And I'm not claiming that there isn't user error involved a lot of the time. The fact still remains that Blizzard's security practices suck. There are many rookie mistakes in their system that should not be there. If they can't even design a login system properly, how can we be sure they can do anything related to security correctly?

I'm sick of seeing people flat out blaming the users when Blizzard is as much to blame as any user. If their solution to security is the authenticator system, then they need to eat the cost and start including one in every game they ship if it is that necessary for your account to remain secure.

Edit: Also, the Dial in Authenticator does not work for Diablo 3. http://us.battle.net/d3/en/forum/topic/5270830422

[Cpt._Keyes]

Edit: Also, the Dial in Authenticator does not work for Diablo 3. http://us.battle.net/d3/en/forum/topic/5270830422

that's silly...i cant come up with a good argument there

[E.T. EddieTorrez]

Wow good thing I signed up for that...

[Bronze Fox]

Not sure if it still matters or not but:

We've investigated several reports of "session spoofing," as reported both in these forums and elsewhere on the internet. We treat these kinds of reports very seriously; however, to date, we have yet to identify a single case of compromise which was the result of a player joining or participating in a public game.

Additionally (highlighted the important part):

"Regarding this specific example, we've looked into the issue and found no evidence to indicate compromises are occurring in this fashion, and we've determined the methods being suggested to do so are technically impossible."


Even so, we're continuing to investigate related reports. If you have evidence which supports your claim that such reports are "100% true," then please relay that information to our support representatives. If you're just spreading hearsay, however...well, that's just not cool. Spinning the rumor mill isn't helping the community, it's only making it dizzy.

[Masakari]

http://arstechnica.com/security/2012/05 ... ng-victim/

[bullet4o1]

http://arstechnica.com/security/2012/05 ... ng-victim/

Authentication downloaded and installed.

[MrBlah]

Authentication is nice and all, but he did point out one VERY IMPORTANT DETAIL!

The password I've been using for my Battle.net account was the same one I used to use on services such as Twitter and PSN before they were potentially compromised through well-publicized hacking scandals.

This is the key bit here. If you use the same username/password combination on multiple services/sites, that is, same password on Battle.net or on Steam or any other online service, if any single one of these was ever compromised, then there is a chance that every other service in which you have an identical username/password combination can be accessed.

[Buzzy Beetle]

For the Villuns without authenticators! I found this on the battle.net forums and helps well for those who don't have smartphones or physical authenticators.

There are other ways of getting a mobile authenticator if you do not have a mobile phone.

Virtual systems with an Android OS - Google it, it's not hard to set up and since you have a powerful enough computer to play D3, you can easily set up a virtual box with a free operating system and then download the mobile authenticator (which works on an android OS) which is a mobile OS.

1. Download Virtual Box from Oracle's Virtual box website
2. Download a 3.x or 4.x version of android and save it to the computer.
3. Launch Virtual box, go through the setup, choose Android as the operating system.
4. When inside of the OS, go to the android market and search for blizzard authenticator.
5. Set it up on your account.

There you go, no need for a smart phone.

And now nobody has a reason to not have an authenticator. Not even me.

[frostdillicus]

Just be warned, emulated android SUCKS. So damned slow. Developing apps on the emulator is the worst programming experience I have ever had in my life. lol