A friend of mine plays RuneScape, and mentioned to me that her account was recently compromised. She told me she has two step authentication on her RuneScape account, and on the email address associated with the account.
When she signs into the game client on her computer, she tells me she is asked to provide a code from her authentication app on her phone. However, she has never been asked for a 6 digit code when she signs into the RuneScape website itself.
This struck me as odd, so I created an account to test this, and sure enough, was only asked for an authentication code on the downloadable game client.
Does this count as true two-factor authentication? Are there any standards/guidelines that we can show the game's developers in the hopes of getting them to implement authentication on their website as well as their client?