2011-12-12, 05:39 PM
Stereo Wrote:All the authenticator really does is set up a second password that you never enter directly (thus avoiding keyloggers and such). If they can break into the DB storing your regular PW, they can get the authenticator PW too. It has to be stored on Nexon's end so they can check the authenticator input is right, so if Nexon's the problem...
No. You are thinking of a different kind of device, which I think is generically called a "plug". That device needs to be plugged into your computer, and responds with its (fixed) id when queried, thus giving this "extra password" you mentioned.
The authenticator doesn't work that way. When you ask to log in, a code is generated somewhere and sent to the authenticator, which displays it. You must copy the number and type it into the login screen to prove you're holding the device. The number expires within a few seconds, so even if someone finds it out, it's useless to them.