Blizzard Mobile Authenticator

Were you looking for the Battle.net Authenticator (key fob device)?

Icon for v2.2.2 (Android)/v2.2.4 (iOS) and later

Icon for v2.2.1 (Android)/v2.2.2 (iOS) and earlier

The Blizzard Mobile Authenticator (or just "Authenticator"; previously Battle.net Mobile Authenticator; was also confusingly also called "Battle.net Authenticator" by Blizzard) is a small mobile phone application that functions similarly to the Blizzard Authenticator key fob device. However, it cannot be used in conjunction with the other device, one or the other can be used, but not both.

On March 27, 2017 with the release of v2.2.2 (Android)/v2.2.4 (iOS), the app was renamed to the "Blizzard Mobile Authenticator" or just "Blizzard Authenticator" and the icon was updated.

On January 9, 2012, three new languages were supported (not on BlackBerry): Português (Portuguese), Italiano (Italian), and Polski (Polish).

The application is available for the iPhone, iPod Touch and iPad with iOS 3.x and later. An iPad without 3G support or an iPod Touch needs a wi-fi connection for a setup, re-setup or a re-sync. The iOS application is free of charge.

It's also available for many other mobile smartphones including phones running the Android operating system, Windows Phone 7 OS, and some BlackBerry® smartphones.

Until December 13, 2011 a version of the authenticator was available for some mobile devices like the Motorola RAZR, Nokia's Series 40, and other "non-smartphones."

On June 16, 2016, the "One-Button Authenticator" feature was announced that removes the requirement for copy/paste of the authentication code, but instead gives an Approve/Deny option. This new feature is only available on the Android (release Jun 15, 2016) and iOS (released Jun 13, 2016; v2.2.0) versions, so far. The ability to approve or deny logins via Notifications and approve or deny login requests on your smart watch functionality appeared on iOS v2.2.1 on Jun 27, 2016 and for Android on Nov 8, 2016. An iOS v2.2.2 appeared on Nov 8, 2016, but it isn't clear what the changes are (probably bug fixes).

Supported mobile phone OSes and languages

Mobile phone OS:

• Android™
• iOS (iPhone®, iPod touch®)
• BlackBerry®^‡
• Windows™ Phone 7^‡

^‡ May not support all features.

Language:

• English
• Français (French)
• Deutsch (German)
• Italiano (Italian)
• Polski (Polish)^†
• Português (Portuguese)^†
• Русский (Russian)
• Español (Spanish)^†

^† Not BlackBerry.

Versions

This section concerns content that is out-of-date. Reason: Android versions outdated. iOS version info incomplete.

As of Nov 8, 2016

iOS

• v2.2.4 — March 27, 2017
• v2.2.2 — November 8, 2016
• v2.2.1 — June 27, 2016
• v2.2.0 — June 13, 2016
• v2.0.0 — August 31, 2015
• v1.3.5 — ?
• v1.3.1 — June 8th, 2011
• v1.3.0 — ???
• v1.0.1 — March 11th, 2010
  • A new "Copy" feature lets you copy the currently displayed authentication code into your device's clipboard. You can then paste it into other text entry fields, such as when accessing Battle.net Account Management from your mobile.
  • Miscellaneous UI improvements
• v1.0.0 — March 31st, 2009

Originally released.

Android

• v2.2.2 — March 27, 2017
• v2.2.1 — November 8, 2016
• v2.2.0 — June 15, 2016
• v2.0.4 — October 8, 2015
• v2.0.3 — September 30, 2015
• v2.0.2 — September 10, 2015
• v2.0.1 — September 9, 2015
• v1.1.3 — ?

Approve/deny login features

Starting with v2.2.1.

• You can approve or deny login requests with a single tap.
• You can approve or deny logins via Notifications
• You can approve or deny login requests on your smart watch.

One-Button Authenticator

Note: This is a generic section stub. You can help expand it by clicking  Edit to the right of the section title.

May 6, 2014 update

An update was announced to occur around May 6, 2014 for the following:

• Full iOS 7 compatibility
• iPhone 5/5s resolution update

Discontinued Java-based version

On November 10, 2011, Blizzard announced it would be discontinuing support for the Java-based (J2ME) versions of the Battle.net Mobile Authenticator that were available for download at http://mobile.blizzard.com. Updates will no longer be provided after December 13, 2011.

Unsupported Mobile Devices

It is possible to install and use the mobile authenticator on many mobiles which are not officially listed as supported by Blizzard. Most mobile phones are capable of running the basic java authenticator application, information on installing the authenticator on unsupported devices can be found here.

Specification

This section concerns content that is potentially inaccurate. Reason: Is this still current?

Main article: Battle.net Mobile Authenticator Specification

The initialization of a Mobile Authenticator is done via an RSA encrypted request to Blizzards initialization servers including an one time pad key for encryption of the response. The server generates an 160-bit key which is later used for code generation and a serial number is connected to that key. Both things are stored on the server and are also sent back to the client (encrypted with the one time pad key from the request).

The code generation is done via encrypting the current time (milliseconds since 1970/01/01 0:00 UTC divided by 30,000) with HMAC-SHA1 using the key from the initialization. From the result are some bytes selected and displayed as current authenticator code.

Security Vulnerability

Because of a weak one time pad key generation algorithm on the client side, an attacker who is able to capture the encrypted initialization response between server and client device can fully compromise the security of the Battle.net Mobile Authenticator. The reason is, that the one time pad key used for encryption of the server response only depends deterministic from the current time on the client device. Normally that time shouldn't differ too much from the common time. So an attacker only needs to guess some time values, calculate the corresponding one time pad keys, use them for decryption of the captured server response and check, whether one of the results make sense (because of the known format of the included serial number, it is easy to say, whether a result makes sense or not). If he finds such a result, it is very likely that he guessed the correct one time pad key and now knows the authenticator ID and the secret code calculation key from the decrypted response.

To prevent this attack even if there is no real randomness (e. g. hardware random generator) is available on the client device, there should be used aside from the current time also some kind of user generated randomness (pressing random buttons on the device, ...) for creating the one time pad key used for encryption of the initialization data.

Desktop ports

It is possible to re-implement the specification to run the Battle.net Mobile Authenticator also directly on the PC. It is difficult to say, whether this is less secure or not in comparison to running it on a real mobile device. Of cause an attacker could read out the necessarily stored secret code calculation key from the PC via a trojan and so breaks the security of such a PC authenticator. But with a trojan on the PC of the victim, the attacker could also read the typed authenticator code when the victim is logging into the game, interrupting the connection of the victim and using the current authenticator code by itself for immediate game login (maybe with a bot) while preventing further game logins of the victim via the trojan.

List of desktop ports with public source code availability:

• WinAuth
• Yet another Blizzard Authenticator emulator

It is also possible to run Blizzards implementation within a mobile phone emulator on the desktop.

An online version also exists^* and is publicly available since November 2011. The source code of the PHP implementation are published, but this is not the case for the website. This kind of online application are less secure than a desktop port, but, as an advantage, you can retrieve your code from anywhere.

Media

Images

iOS v2.2.x]]

Notes

• This application was announced on March 31st, 2009 on the US official forums and June 2nd, 2009 on the EU official forums.
• The Mobile Authenticator app was not available in mid to late September 2009 for some reason. Several blue posts stated this fact, but no reason was given.
• All Android based phones can download and use the Mobile Authenticator app listed in the Android Market regardless of whether the phone is listed as being supported here.

See also

• Battle.net Authenticator (physical dongle previously called Blizzard Authenticator)
• Battle.net Dial-in Authenticator - Unsupported after August 15, 2012
• Battle.net SMS Protect
• Blizzard Battle.net mobile app
• BlizzCon Mobile app
• World of Warcraft: Legion Companion App
• WoW Companion App

External links

This section concerns content that is out-of-date. Reason: Some of the support links are probably slightly outdated.

US

Battle.net Support (US) Battle.net Authenticator (Updated: Sep 16, 2015; Article ID: 100588)

         Battle.net Support (US) Download the Battle.net Mobile Authenticator

         iTunes app store Blizzard Authenticator app for iPhone By Blizzard Entertainment, Inc. (US; free)

         Google play Blizzard Authenticator Blizzard Entertainment, Inc. (US; free)

         Battle.net (US) Battle.net Mobile Authenticator Setup

         Battle.net Support (US) Battle.net Mobile Authenticator – Troubleshooting Updated: Jan 13, 2014; Article ID: 100623

EU

Battle.net Support (EU) Battle.net Authenticator (Updated: 31-Aug-2015;Article ID: 100588)

         Battle.net Support (EU) Download the Battle.net Mobile Authenticator

         iTunes app store Blizzard Authenticator app for iPhone By Blizzard Entertainment, Inc. (EU?; free)

         Google play Blizzard Authenticator Blizzard Entertainment, Inc. (EU?; free)

         Battle.net (EU) Battle.net Mobile Authenticator Setup

         Battle.net Support (EU) Battle.net Mobile Authenticator Troubleshooting Updated: 18-Jul-2013; Article ID: 100623

         Battle.net Support (EU) Battle.net Mobile Authenticator Restore Feature updated 14-Dec-2011

Other info

FranksPlace.org Battle.Net Authenticator Information

WoW Insider How to replace a keyfob authenticator with a smartphone Battle.net authenticator by Michael Gray Mar 31st 2012 at 6:00PM

News

  Heroes of the Storm official game site (US) Introducing the One-Button Authenticator Blizzard Entertainment 6/16/2016

  Heroes of the Storm official game site (EU) Introducing the One-Button Authenticator Blizzard Entertainment 16/06/2016

WoW Official Game Site (US) Battle.net Mobile Authenticator Updated Blizzard Entertainment 9/8/2015

Heroes of the Storm official game site (EU) Battle.net Mobile Authenticator Updated Blizzard Entertainment 09/09/2015

Official Support > Customer Support forum (US) [iOS] Authenticator update - Be Prepared! by Vrakthris 5/6/2014 3:37 PM PDT

WoW Insider Mobile authenticator app update for iOS is coming soon by Elizabeth Harper May 7th 2014 7:00PM

IGN.com Blizzard Warns Battle.net Authenticator Users of Possible iOS 7 Reset by Chris Pereira, September 19, 2013

WoW Official Game Site (EU) New Languages for Battle.net Mobile Authenticator by Blizzard Entertainment 09 Jan 2012 12:30 UTC

Battle.net Support (US) Battle.net Authenticator Changes updated Dec 12, 2011

Battle.net Support (EU) Battle.net Authenticator Change updated 13-Dec-2011

Official General Discussion forum (US) #1 - Battle.net Authenticator By-Pass Now Active by Daxxarri, 11/29/11 12:44 PM

WoW Official Game Site (EU) Battle.net Mobile Authenticator – Java Version Support Update by Blizzard Entertainment, Nov 10, 2011 11:06 AM PST

WoW Official Game Site (EU) =Battle.net Mobile Authenticator – Java Version Support Update =by Blizzard Entertainment, 10 Nov 2011 18:52 UTC

WoW Insider Opt-out option incoming for recent authenticator security change by Michael Sacco Jul 26th 2011 at 8:00PM

WoW Insider iPhone authenticator now in app store, for free by Eliah Hecht Mar 27th 2009 at 4:25PM

Old info

Blizzard Entertainment Mobile Ringtone, Wallpapers, and Applications (US)

Blizzard Entertainment Mobile Ringtone, Wallpapers, and Applications (EU)