EDIT: Looks like it must have been changed, thanks zeogold and adaliabooks:

https://www.gog.com/forum/general/gog_will_enable_twostep_login_on_all_existing_accounts_on_oct_24_2016/post165/?staff=yes



---

So is 2-Step working for anyone right now? I've cleared cache/cookies, etc, and logged in multiple times without GOG asking for a security code even though it has been enabled on my account since it was released.

Either it's broken or they have changed something.

I'm pretty sure it takes a number of bits of information when you login and stores them (city/location, ip address, OS & Browser, etc), much like Steam will do so it can detect (simply) if you're using the same computer. Try logging in on another computer, or a VM or something, then see if the 2-step kicks in.

Well you see... I just reinstalled Windows 10 after a format. Fresh installation. It happen the very first time I logged in, which is why I cleared everything (using Edge) and tried again. No security code was asked of me. So something doesn't seem right.

EDIT: I should say, using CCleaner it would always ask me for a code before, so unless they recently changed something it seemed to only take cookies into account.

I think there was something in HypersomniacLive's thread about it where a blue mentioned that they were using alternate means of tracking rather than cookies. I forget the exact details of it. Something about Google...?

Hmmm... Not sure what to say. I could try logging in, but I doubt that would produce anything useful.

I guess double-check your settings to make sure it's on (although it should be since it's after the 24'th unless you opted out) I'd say what information you/browser provide, easy enough to store that information in a table... OS/Browser, IP/location, language preferences...

See my edit. Something to do with Google that I don't quite understand.

Only way I can see they would know it's me after a full re-installation of Windows 10 is by IP. But I clear everything via CCleaner every week and before it would always ask for a new code. So if they are using IP now it must be new. Hopefully a blue comments otherwise this is cause for concern.

One of the first things I did was check to see if it was still on, it is...

EDIT: Installed Galaxy, again on fresh installation on Windows 10... again no security code was asked.

The IP address and querying with tools can determine which area you are in. CCleaner, doesn't that clean the registries? Unless you're using IE I don't think it would clean temporary files or cookies for say Firefox and Chrome or the like.

You could try using TOR or a proxy server to force a different ip/area, and then try logging in. But it's a lot of work just to test 2-step. Hmmm yeah I figure a blue will be coming to comment if we don't have an answer soon.

Yes I realize this, but that would have to mean that are actually tracking such things now. CCleaner cleans the registry as well as general PC maintenance including cleaning browser cookies/data for all major browsers including FF/Chrome. I could go through a proxy yea... might try that. But even a fresh install of Galaxy isn't asking for a code, and from what I was told during Galaxy testing, Galaxy stores this info and if it's not there it is suppose to ask for a code.

EDIT: That message asking if my email is correct keeps popping up too, even though I have pressed yes about 5 times now. Something seems broken.

No security code , either, but after the re-Captcha , i constantly get a question mark (even at first login attempt) if i want to continue with my current e-mail...........something is wrong.... how many times should i repeat this ? >_<

Sight, GOG can't do something properly when security is at stake....

I was debating on if I should make a thread for this... on one hand I didn't want to alert everyone that a security issue might be happening but on the other if I was to message someone from GOG it would probably be ignored and I'm not 100% sure there is an actual issue. I feel like a thread is the fastest way to get someone's attention though.

er, let's see, if the website was programmed properly : keeping your current e-mail; should be only asked once. I don't really see the point to asking over & over the same thing.

looks like the site doesn't register our answer ... we know they have some troubles when it comes to design properly security features & that's not new.

keep at bay , users using too short passwords , i speak about real issues. i tested quite enough the security measures before the changes, and they were the worst i have ever seen for a website, so any improvement is welcome.

When has anything worked properly in this place?

hmmm interesting - will follow this. For me personally 2 step has worked as intended so far (after deleting cookies - new prompt and such) but reading this this either way means very good news if GOG thinks they kinda found a way to identify us reliably with stuff like hardware id/browser location/resolution so no stored cookie needed or well otherwise it'S bad news and something seems to be kinda broken