authentication
Latest
Login issues plague all Battle.net games
It's Tuesday, which means maintenance -- or in this case, post-maintenance -- server problems. At present, @BlizzardCS says login issues for North American realms are under investigation -- though they may already be starting to clear up. If you manage to get into the Battle.net launcher, it will helpfully inform you: "Login to the Battle.net desktop app is currently unavailable. However, you can continue to use Battle.net in offline mode to launch and play games that are available offline." I guess that means tonight's Diablo 3 rift runs are going to be replaced by Diablo 2 leveling.
Two years later, DirecTV customers can finally use Roku players to watch HBO Go
Even as HBO Go has launched on new platforms over the years, people who pay for TV service and HBO have occasionally found that their provider won't play along. That's been the case for DirecTV subscribers with a Roku ever since the app rolled out in 2011, but now things have changed. Customers started seeing the change Thursday and now the DirecTV Twitter account confirms subscribers can use their account logins on Roku. The Syfy Now app on iOS also has a fresh update that says it supports DirecTV accounts, while some users say they've been able to login to apps for History, A&E, and Lifetime, although that doesn't appear to be officially available yet. Comcast Xfinity customers are the most notable remaining group still denied activations on Roku and Samsung Smart TVs, although the service does support Apple TV and Xbox 360. Will that ever change? After this move and the recent arrival of YouTube on the platform, here's hoping Comcast, Roku and Time Warner can get together to keep the streak going.
Microsoft joins the FIDO Alliance to put an end to passwords
The FIDO Alliance is on a roll: It already has support from heavyweights like Google and Lenovo in its quest to eliminate password-based sign-ins, and it's now bringing Microsoft into the fold. The software pioneer is taking a seat at the Alliance's board of directors, where it will help shape open authentication standards. Microsoft isn't revealing what it would like to do with FIDO at this early stage, but it's easy to see the company improving both its verification methods and Windows' support for biometric readers. There are still gaps in the Alliance's membership -- Apple and Samsung aren't involved, for instance. Still, Redmond's involvement makes it clearer than ever that the group will have a lot of say over our future digital security.
Synaptics' new acquisition could bring fingerprint readers to most laptops
If you hadn't heard, fingerprint readers are in vogue these days. Synaptics clearly knows it: the company just acquired Validity, a firm that specializes in finger-based authentication. The $92.5 million deal gives Synaptics both access to the biometric market as well as a complement to its existing touch input devices. While the company isn't detailing its plans, it's easy to see the potential impact. When Synaptics makes the majority of laptop trackpads, there's a real chance that fingerprint sign-ins on PCs could become commonplace.
Android phones with FIDO-based fingerprint readers to arrive in early 2014
The FIDO Alliance hinted that mobile fingerprint readers would play a part in its passcode-free strategy, and it turns out that we'll see those readers quite soon. Group president Michael Barrett tells USA Today that Android smartphones with FIDO-based fingerprint readers should be available in about six months, or early 2014. While the Alliance isn't saying which companies are launching those devices, we'd expect FIDO members like Lenovo and LG to embrace the technology first. As for other platforms? Barrett believes that Apple's Touch ID could work with FIDO, but we wouldn't count on it when Apple is still hesitant to embrace third-party developers.
CCP adds email verification to EVE Online accounts
Immigrants to EVE Online's New Eden will have an extra layer of security as of today, with CCP rolling out mandatory email verification to all new accounts. Email verification is the first of several upcoming security improvements for EVE, one that brings the 10-year-old game closer in step with more recent releases. The process will be familiar to MMO veterans: When creating an EVE account, all new players must validate the registered email address by following instructions provided in an email from CCP. Existing EVE players have the option of verifying their email addresses as well; a new "Verify Email Address" option has been added to the game's account management page. CCP encourages all users to log into EVE's account management system to ensure their information is correct and to take advantage of the new verification system.
Google's updated security roadmap details increased friction, reliance on hardware
A lot has changed in the security realm since 2008 -- remember Alicia Keys' recent attempt to convince us her Twitter account was hacked, when we all know she still uses an iPhone even as BlackBerry's Creative Director? Pranks aside, the consumer world alone has been overrun with mass data hackings -- everyone from Evernote to Microsoft to Sony to RSA has felt the wrath. To combat all of this, Google is revamping its five-year security plan, which calls for a complex authentication code replacing the conventional password in due time; in other words, Google is going to make it harder to access your accounts when initially setting up a device, but hopes you'll deal. Eric Sachs, group product manager for identity at Google, put it as such: "We will change sign-in to a once-per-device action and make it higher friction, not lower friction, for all users. We don't mind making it painful for users to sign into their device if they only have to do it once." The documents also suggest that two-step verification may soon become less of an option, and more of a mandate. Sachs straight-up confesses that Google didn't predict the current level of smartphone adoption back in 2008, but now realizes that utilizing mobile hardware and apps as friction points for logging in makes a lot more sense. A huge swath of Google users are already carrying around a product that could be used as a verification token, so the obvious solution is to make use of that. We're also told that learnings from Android will be carried over to Chrome, and further into the world of web apps. No specific ETAs are given, but trust us -- half a decade goes by quickly when you're having fun.
Google joins the FIDO Alliance, supports its two-factor authentication standard
Google's already investing in two-factor authentication, but it's making a bigger commitment to the security method by joining the FIDO (Fast IDentity Online) Alliance's board of directors. Founded in-part by heavyweights Lenovo and PayPal, the group envisions a future where an open standard developed by it will lead to interoperable two-step security that can log users into sites and cloud apps across the web -- not to mention replace passwords as we know them. While support for USB keys is certainly in the works, the group expects to throw its weight behind the likes of NFC, voice and facial recognition, fingerprint scanners and more. There's no telling how soon FIDO's efforts will bear fruit, but the search titan's support ought to help move things along. [Image credit: Marc Falardeau, Flickr]
Trustonic: a way for mobile apps to benefit from ARM's hardware-level security
This here narrative begins back in April, when ARM, Giesecke & Devrient and Gemalto teamed up and gave themselves precisely nine months in which to find the perfect brand name for their newly merged mobile security platform. Today, we're looking at the fruits of their efforts: Trustonic; a word which snappily captures the essence of what's at stake (trust-onic) and which you may soon encounter in connection with your next-gen smartphone, Mastercard payment app or 20th Century Fox DRM'd media. What does Trustonic do, exactly? Pretty much what Mobicore already does in the Galaxy S III, or what Trusted Foundation does inside a Tegra-powered tablet: it allows certain pieces of software to tap into hardware-level encryption and authentication, courtesy of the TrustZone silicon that many ARM chips already contain, thereby removing many of the risks associated with malware and other intrusions within the mobile OS. As far as we understand it, the key difference with Trustonic is that it won't require direct input from OEMs like Samsung and NVIDIA, but will instead be more readily accessible to any banking, payment or DRM service that is willing to pay for a key. In return, the service would get enhanced security and faster logins for its users, who'd only need to enter a short, locally-verified PIN rather than wading through cloud-based steps to prove their identity. Indeed, perhaps that's where the tonic comes into it.
Guild Wars 2: Now with two-factor authentication
Security has kind of been a hot topic in Guild Wars 2. ArenaNet announced a couple weeks ago that they were working on bringing two-factor authentication into play, and that joyous day has arrived! A new post on the official forums introduces players to mobile two-factor security. ArenaNet is using Google's authenticator, which is available on iOS, Android, and Windows Phone, and players will use this authenticator to verify devices rather than the previous email authentication system. The team is advising people that this is currently a beta feature, and already has two changes planned for the near future. Soon, unlinking the mobile authentication system will require additional codes, and users will have an option to remember current networks rather than having to authenticate every login. Visit the official post for complete details for setting up the authentication system.
Microsoft buys PhoneFactor, adds smartphone authentication to its cloud services
With a hand-in-glove relationship with the world of business, it's key that Microsoft ensures it can keep companies data safe. That's what prompted Steve Ballmer to whip out his checkbook to snap up PhoneFactor, a multi-factor authentication company that uses smartphones instead of code-generating security tokens. With its new toy, Redmond plans to integrate the feature into its services like SharePoint, Azure and Office 365, letting users sign on with their own device as a key element of the signing in process.
Apple Lightning cable inspection finds an extra-smart connector, won't make for cheap substitutes
Apple made much ado of the Lightning connector it launched side-by-side with the iPhone 5, but what we've known about it has been limited outside of the presence of an authentication chip. Double Helix Cables' Peter Bradstock has delved deeper and tells AppleInsider that there's some clever wiring that clinches the reversible design. While Lightning's power supply is truly symmetrical among the contact pins, the data isn't -- which suggests a chip inside is redirecting data to keep the plug working as intended. The technique helps explain why Apple would need any elaborate circuitry in the first place. No matter the wizardry inside, Bradstock doesn't see any cut-rate Lightning alternatives being useful in the near future: as it's unlikely that anyone outside of Cupertino knows how the authentication works at this stage, clone cables may amount to little more than heaps of metal and plastic.
ArenaNet talks security in Guild Wars 2
Account security has been a hot topic in the world of Guild Wars 2 between the hubbub about the email verification system and the woes of hacked accounts. It's been such a hot topic that ArenaNet President Mike O'Brien wrote up a big ol' post about it. O'Brien began by reiterating one of the golden rules of account security: Use a strong and unique password for any account that you don't wish to have compromised. He pointed out that simply having a strong password does you almost no good if you've got the same password with the same email used for an account elsewhere -- if one such account is compromised, they all are. The same rule of having a unique password applies to the email account you use for authenticating your GW2 login attempts: the email authentication system can only protect you if your email is secure. Fans of two-factor authentication will be pleased to hear that Guild Wars 2 will have a two-step authentication system soon. "We had our own homegrown implementation of smartphone two-factor authenticator in testing, but we're going to pull it back and instead integrate Guild Wars 2 with Google Authenticator, which already has robust authenticator implementations on most major smartphone platforms. We expect to roll this out in the next two weeks." But that's not all! ArenaNet is also building a password blacklist (which is 20 million passwords long and growing) that blocks all passwords for which hackers are already scanning. According to O'Brien, "the rate of account hacking was about 1.5% for accounts created before this blacklist was in place, and is about 0.1% for accounts created after." This announcement comes with the request that existing customers change their password so that the blacklist protects them as well. Read O'Brien's full post on the GW2 news page.
NBC rebrands Olympics app as NBC Sports Live Extra, promises streams for a wider athletic universe
NBC's Olympics Live Extra may have lost its original raison d'être after the flame was extinguished in London, but that doesn't mean it's time to purge the app from your phone's home screen. An update for Android and iOS users alike is giving the title new life as NBC Sports Live Extra, and the name makes it quite obvious that you'll have a lot more to watch than just biathlons and fencing. NBC expects to offer live streaming for the European PGA, LPGA, MLS, NHL, Notre Dame, PGA, Ryder Cup and other events or leagues culled from the channel formerly known as Versus. Highlights, social sharing and other side features will carry over as well. You don't have to do a thing beyond check for a new version to make the switch to the already updated apps, but you will have to subscribe to conventional TV to use them properly: NBC is requiring TV Everywhere authentication for access to most of what's on offer from NBC Sports Network and the Golf Channel.
Pac-12 Conference streams come to iPad, fuel that Big Game rivalry on the road
Cal and Stanford fans away from home no longer have to huddle around their laptops if they want to learn who's one-upping who. The Pac-12 Conference has just launched an iPad app for its authenticated Pac-12 Now service: as long as you're with a TV provider that carries the college sports division's games (sorry for now, DirecTV customers), you can tune into 850 live matches spread across a myriad of sports. As you'd hope, going the digital route allows for some on-demand viewing, a dedicated program guide and the social sharing you'll want to rope friends into watching. Only Bright House, Cox and Time Warner Cable subscribers can use the iPad viewer at first, although support should come to BendBroadband, Comcast, Frontier and Suddenlink this fall, right alongside Android- and iPhone-sized apps. Hopefully, they arrive in time for a little ego padding around the Big Game in October.
Dropbox two-step login verification available in experimental build, coming to all accounts soon
Following up on its promise to tighten account security following a recent breach, Dropbox is now offering two-step login authentication to users who install the service's latest experimental desktop build. The team says the functionality will roll out to all users in the coming days, but listed full instructions to forum users who just can't wait. Those who op-in only need to download a new version of the Dropbox desktop software and activate the feature in their account settings. Once set up, Dropbox will require all unrecognized machines to provide a code, culled from an authenticator app or received via text message. The firm also provides an emergency back-up code that'll disable the feature should you lose your phone. Feeling insecure? Check out the source link below to get started. Update: Dropbox just made it official, detailing set up instructions once more on the Dropbox blog.
Twitter's API plans cause trouble for iOS devs, but they're sticking with it
Twitter has announced a series of upcoming changes to its API that could cause problems for developers who use it their apps. There are a number of technical and aesthetic updates, but the biggest change is that certain calls to the API will be rate-limited and governed by authentication tokens, which means that any developers signing in to the Twitter service will need to monitor when they're logging in and how. Also, Twitter is going to be enforcing certain "display requirements" in order to get developers to conform to the service's look and feel. In Twitter apps, these things aren't a big problem. They ask that the "@" symbol is always used with usernames, and that retweet, reply, and favorite buttons are always clear and in the same place. But for apps that use Twitter's API in other ways, that might not be so easy. The good news is that the developers of two big third-party Twitter apps for iOS have already confirmed that they're ready to work with the changes. Tapbots has put up a blog post saying that it shouldn't have a problem complying with either the authentication regulations or the display requirements, and that it will work with Twitter to make sure things go all right on both iOS and Mac. Ged Maheux of Iconfactory has also confirmed that Twitterific should fall within the guidelines. It's completely reasonable that Twitter would want to make sure its service is used responsibly and represented well, but a big part of the service's success is its third-party accessibility and interfaces. It sounds like developers were angry about these changes when they first appeared, but Twitter seems as if it's responding to these changes in a reasonable way.
DARPA-backed Power Pwn is power strip by day, superhero hack machine by night
Call the Power Pwn the champion of white hat hacking. Underneath that Clark Kent power strip exterior, there's a Superman of full-scale breach testing that can push the limits of just about any company network, whether it takes 3G, Ethernet or WiFi to get there. Pwnie Express' stealthy sequel to the Pwn Plug ships with a Debian 6 instance of Linux whose handy hacking tools are as easy to launch as they are tough to detect. There's just one step needed to create a snoop-friendly Evil AP WiFi hotspot, and the box dodges around low-level NAC/802.1x/RADIUS network authentication without any help; in the same breath, it can easily leap into stealth mode and keeps an ongoing encrypted link to give do-gooders a real challenge. The hacker doesn't even need to be in the same ZIP code to crack a firewall or VPN -- the 3G link lets the Power Pwn take bash command-line instructions through SMS messages and doles out some of its feedback the same way. While the $1,295 device can theoretically be used for nefarious purposes, DARPA's blessing (and funding) should help keep the Power Pwn safely in the hands of security pros and thwart more than a few dastardly villains looking for weak networks.
Sony suspends PlayStation Store for PS3 in Korea, blames new law about selling to minors
Sony has been caught unawares by a legal change in South Korea, which prevents under-18s from being asked for their names or ages for the purpose of account authentication. No sooner had the company announced a half-price sale at its PS Store and then it was forced to pull the whole thing down in order re-work the interface and make it compliant. It's expecting to reopen it sometime "this year," but in the meantime the Store is strangely still accessible to PSP and Vita users of any age, while multiplayer and other PSN functions will continue to run on PS3. There must be a lawyer somewhere for whom this all makes complete sense, and hopefully they work for Facebook.
WatchESPN finally streams to Comcast customers, but not on Android
The short list of TV and internet providers that support ESPN's TV Everywhere play, WatchESPN, just grew by one with the addition of Comcast to a list that already included Time Warner, Bright House and Verizon. Part of a deal reached back in January, ESPN has managed to tie its live streaming service in with Comcast's Xfinity TV protocols, similar to the adjustments made by HBO to open up HBO Go streaming on the Xbox 360. One downside however is that for the moment Comcast customer access is restricted to the website (XfinityTV.com access is coming soon) and iPad / iPhone apps (an update is required first). The Android app that launched a year ago is, for the moment, not supported, although access there is promised "in the coming months." As we heard in January this just the beginning, as similar Watch services will be rolling out for Disney Channel, DisneyXD and Disney Junior as part of the mouse company's TV+ program. For now those live feeds of ESPN, ESPN2, ESPNU and ESPN3.com (Buzzer Beater and Goal Line are available in their respective seasons) will have to do however, as the channels and cable services try to add more features and access to keep subscribers happy, or at least still paying, whether they're at home or away.