I think every program should have a way in using good-old-passwords because of accessibility (important in a game). I don't think it's worth it what you're asking for. Use a password authentication, then think in other fancy stuff. A secure-authentication-method is another thing that will come on top of this. Other things are as dicey or worse. 

21 hours ago, RnzCpp said:

I think every program should have a way in using good-old-passwords because of accessibility (important in a game). I don't think it's worth it what you're asking for. Use a password authentication, then think in other fancy stuff. A secure-authentication-method is another thing that will come on top of this. Other things are as dicey or worse. 

I'm so personally tired of passwords. Do you know how many sites/apps I have passwords to? It's just stupid. I don't reuse passwords because that's so insecure it's insane. I'm not organized enough to maintain some password app. I don't care about maintaining an account to a site/app. I just want the entertainment or information on the dang thing. All this account crap is a byproduct of security for me to get to the stuff I want and I'm personally so password fatigued  it's insane. The majority of sites I tell to keep me logged in and if for whatever reason it doesn't or invalidates and asks for my pw I have to do the forgot password feature. Basically my email and bank account are the only pw's I know by heart, but I bet I have up to 50 different sites/apps that require passwords. It's all too much. I'm trying to simplify that process in this sense because I feel everyone for sure knows their email pw. For me personally this is why I LOVE getting texted a 6 digit code to my phone to log into something. My phone is always on me and I get unlimited text message (who doesn't in 2018) and it's just easier than remembering all these passwords. So the irony of your statement is that I find it easier to get an access token some how than creating and maintaining an account to yet another thing.

21 hours ago, hplus0603 said:

Honestly, if you install on a PC, you may want to just store a long-lived session token on disk in some settings file, or perhaps better, the keyring of the operating system.

What, exactly, is there to steal in your game, really? The convenience of being able to keep playing is probably far more worth than whatever small protection you'd get by requiring the user to check email each time they want to play.

You could still have some management interface on the web that let the user invalidate any currently issued security token, so if they lose their computer or believe someone stole the key, they can do so using email.

Not that my game will most likely be worth much, but multiplayer desktop games in general require players to log in each time which I think is reasonable and more secure. Games represent time and if someone messes with that it's like they're messing with your time which nobody likes. I feel most PC gamers are rocking 2 monitors at least so it's nothing to have an email up on 1 and the game on another to copy and paste and if a game doesn't allow fullscreen windowed mode then screw that game I say :). Hate when they don't allow that.

It's something to think about though if not just for beta testing. I think ultimately going the Steam route is what I'll do as I'm not opposed to requiring steam. On the client you can request a session token from steam and then pass that to the server to again validate against the steam API to make sure it's a valid Token and then can get a bunch of user info from it. This way they just need to be logged into Steam to play so it's a similar idea of having a central app login used. It's always interesting to get others thoughts though.

Those aren't technically games but maybe it's been a long time since I've played WoW but that used to ask for my pw each time I launched it. Perhaps those tides are changing. I've been playing America's Army and that requests login each time.

2 hours ago, rpiller said:

I'm so personally tired of passwords. Do you know how many sites/apps I have passwords to? It's just stupid. I don't reuse passwords because that's so insecure it's insane. I'm not organized enough to maintain some password app. I don't care about maintaining an account to a site/app. I just want the entertainment or information on the dang thing. All this account crap is a byproduct of security for me to get to the stuff I want and I'm personally so password fatigued  it's insane. The majority of sites I tell to keep me logged in and if for whatever reason it doesn't or invalidates and asks for my pw I have to do the forgot password feature. Basically my email and bank account are the only pw's I know by heart, but I bet I have up to 50 different sites/apps that require passwords. It's all too much. I'm trying to simplify that process in this sense because I feel everyone for sure knows their email pw. For me personally this is why I LOVE getting texted a 6 digit code to my phone to log into something. My phone is always on me and I get unlimited text message (who doesn't in 2018) and it's just easier than remembering all these passwords. So the irony of your statement is that I find it easier to get an access token some how than creating and maintaining an account to yet another thing.

I found a reason to stay inside the matrix. But about tokens... I think it's arguble that time-based-passwords are better than one-time-passwords, yet I haven't seen a "dual time-based password" which would take the some of the annoyance of time-expiration. It's slower to type a token than something that's known.... and you require the smartphone! Tokens require the smartphone, some setting up, plus the app download, though I'm not totally up to date with this.

 

14 hours ago, RnzCpp said:

It's slower to type a token than something that's known

I agree. Assuming you know your pw out of the other 20+ pw's you have. However, this is just another "thing" to remember/maintain.

14 hours ago, RnzCpp said:

and you require the smartphone

My personal feelings is that if this is an obstacle in 2018 then just shut'er down.

14 hours ago, RnzCpp said:

Tokens require the smartphone, some setting up, plus the app download

I know what you're thinking of with having an app and all and setting up but I'm not talking about those kids of tokens that refresh all the time and you have an app for. The tokens I'm referring to are emailed/texted to you and are 6 digits generally in length. You type that into the app you're trying to access and now you're logged in. Generally people still have accounts for this process and it is the 2nd step in a 2 step auth, but I'm questioning why it's not the only step here I guess. Especially when I'm seeing at least 1 bank & Amazon allowing this when you forgot your password instead of having to reset it. That kind of opened my eyes like, yeah why not do this. Getting that access code text'd to my phone and not having to reset my pw because I forgot it was sweet!