League of Legends Dev Tracker

I'm not sure what the long term plan is at the moment when it comes to remembering devices. There will be an official article coming out with more information sometime soon and I'd recommend checking that.

If I got compromised to this in 2016, you are absolutely capable of being pwned by it too.

I use BitWarden in my personal life. It's alright. The autofill is a bit flakey on Android though.

Lots of reasons. Off the top of my head:

• Many (most?) game companies don't have to retrofit their solution to work with hundreds of millions of players across multiple platforms (Web, Desktop, Native Mobile).
• Despite Riots growth, we still have a very limited number of engineers for the weight class we are in. Prioritising projects that span the entire breadth of our product offering is challenging and needs a compelling argument to prioritise it over something else. I'd have to guess that at least 100 people were involved in making this happen, from engineers to QA to player support, comms.. and a lot of those people are working on teams that have other commitments (like the most recent Riot X Arcane event)
• We know that MFA is going to be enabled by a minority of players, and it might not have the security impact we want. However, due to some research we conducted (which I cannot get into), we decided that now was a good time to implement it - It's...

Hi.

I am that security worker, and that is not what I said. :) I do not believe I have ever said or implied that MFA is not necessary or something that Riot should implement, but I am the primary person within our team that has engaged on social media.

What I stressed back then was that MFA would likely not be enabled by players who need it the most, and would only really be enabled by people who would not benefit from it - Since the odds are that if you'll engage with a security measure without an incentive, then you're probably doing pretty good for security already.

That still stands. MFA will prevent a lot of attacks we see, but most of the attacks we see will be on players that are not and will not engage with security measures, and that is always going to be a challenge for us. The problem is that implementing something on this scale requires a large amount of investment that might be better spent elsewhere. If we're going into it knowing that it might...

Ceci n'est pas une pipe.

not if they operate in the EU they don't

It's not that it's hard to fix - it's that it's risky to deploy during a release train that is well underway right before a major holiday (Lunar New Year) on a global game with tens of millions of players.

That being said, we have identified a fix for overspill and aim to have it ready for the event after Lunar Revel 2022.

Yes, last event with Prestige Points.

You will need to go through the prompt every time you log into the Riot Client - If you tick 'stay signed in', then you don't have to worry.

This is usually not a problem, but if you have multiple accounts, this might not be ideal. I would still recommend enabling it.

If you have a verified email address, it is not currently possible to change your email address without demonstrating you have access to the original email address; the account management portal has had two-factor authentication like this for quite some time.

We could add mobile verification to that, but like I said, our current policy (which is in line with most other services out there) is that if you have access to the email address of the account holder, you are the account holder. It also does not sit well with me personally that we would be required to collect your phone number, or that you need a smart phone, in order to benefit from a core security measure.

That said, if you don't have your email verified, yes, this is a big problem. We will revisit the scope of this problem in the future to see if we can't shift more players to have verified emails.

Emotional and time investment aside, as others have covered, accounts that are botted/scripted/sold - you get the idea - are overwhelmingly accounts that are compromised by someone.

Enabling MFA helps make your own account secure, but additionally, every account secured with MFA is one less account that is significantly less likely to get compromised and sold to someone who wants to script, bot, or be super toxic in games.

As things stand, your email account is the keys to the kingdom to your account, and this would not change even if we introduced mobile based authentication, or if you used OAuth. You should use a secure password and two factor authentication on your email.

If you don't wanna juggle multiple passwords like this, I would recommend using a password manager so you only have to remember one good one.

Yes, for the time being this is only email MFA.

It's not something that can be taught, sorry

also who said they were 2fa memes?

yeah well it was like superimposed while i was being possessed so it was kind of hard to make out

At this time, I don't want to make any promises about future features.

👉😎 👉

hey dan i am ready for your memes

hey i made that banner