RS Authenticator on a PC

[Metaversal]

I know a lot of people are upset about the move from JAG to RS Authenticator and the "requirement" of having a smartphone in order to activate it. However, a smart phone isn't needed to enabled RS Authenticator. Sure, the process isn't nearly as easy, but once it's set up it's pretty straight-forward.

 

My post will probably get removed for this, but I've already written up a tutorial on how to do this on my clan's website. However, since this applies to the community as a whole, I wanted to get the information out there to even bigger communities than our own.

 

The process involves installing a web-based GAuth "application" (it's just a set of web pages) and retrieving the information from the QR code in order to fill out the required fields within the GAuth web application. On the linked page I even made a tool that will automate the process of converting the QR code given on the RS Authenticator page into the information necessary for inputting into the web application. This shouldn't be a risk, because as far as I can tell the QR codes use display names rather than login names, so as long as the two aren't the same there should be no way to match up the secret code to an account.

 

Then, when RuneScape asks you for your code you simply open the web page again and pull the code.

 

Now there's no excuse to not have two-factor authentication on your account =D

[Mercifull]

Blimey a web based generator :S You do realise that whoever is hosting can grab that code as it's generated? You are much safer using something like WinAuth which runs locally if you really MUST use it on desktop.

[Mercifull]

Jagex posted this official wiki article http://services.runescape.com/m=rswiki/en/Authenticator_codes_on_a_desktop_or_laptop

[Metaversal]

I made the tool to do the conversion. It's not required that it be used either, the page explains how to do it all manually. I also give ample warnings about the potential implications of using the tool (though it doesn't save any information). The user submits the information to a page I created. That page relays the image to the QR code processor, the QR code processor replys to the page and the page takes out the relevant information and sends the user back the information. It's as safe as it can be. But, like I said, it's not all that risky unless your display name is the same as your account name. If that's not the case, then there's no way to match up the key with an account name. Not to mention, use of a code implies that the correct password has already been entered, so even if it had the real account name it would still be of limited use to a service processing anonymous requests.

 

I didn't see that Jagex had put up that wiki page. Handy! Looks like I blew several hours figuring out and setting up that relay page. Oh well, at least I learned a thing or two! If nothing else, this is just an alternative solution.

[Metaversal]

Heh, unless you're a compiler wizard it looks like you can't even get WinAuth. For the moment, it appears that wiki article is of limited use to the average Joe. I wanted to test it on Linux to see if it ran in Wine (not all of us run Windows). At least my solution is cross-platform =)

 

Edit: Found a download for it, but, indeed it does not work with Mono -- the open source .NET implementation -- in Linux (the System.Deployment assembly does not exist in Mono). This means that it won't work on anything other than Windows. All other OSes use Mono.

[Metaversal]

Oh, now that I re-read you post I think you mean the fact that the GAuth code generator is web-based. Well, yes and no. Yes in the fact that it runs in a web browser and uses web technology as its interface. But, no in every other regard. It runs from a local file on the local computer, not on a remotely hosted server. Therefore, it's not possible for it to be "grabbed" except for perhaps by a browser add-on. However, on my page I make the recommendation to create a separate profile just for the GAuth code generator which has the bonus of no add-ons being installed by default. The files could be copied to a flash drive as well, just like WinAuth.

[Metaversal]

I updated the article to use a local, cross-platform QR code reader rather than a web service for decoding the QR code used to activate RS Authenticator. This is actually much easier than the previous method. For those that can't use it for whatever reason, I also eliminated the third party query within my form for added security. The image provided to the form is processed only on the site and not transmitted elsewhere.