Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Electronic Arts Hates Strong Passwords

kaurkuut.com

Post reply on HN
Print view View original

51–60 of 111 posts

Re: Electronic Arts Hates Strong Passwords

#51

Post by true_religion »

redthrowaway wrote: post #13
benologist wrote: post #2

Does it matter if they're strong if all they're going to do is md5 them?

Long, random strings with weird characters are unlikely to be in any md5 dictionary, so you'd have to bruteforce it. MD5 is a fast algo so that shouldn't take long for short passwords, but it does provide some security. If you've chosen a strong password then bruteforcing isn't a concern, so the fact they hashed instead of encrypting (edit: used a weak hashing algo) won't matter. It's better than nothing, but not muc…

> If you've chosen a strong password then bruteforcing isn't a concern, so the fact they hashed instead of encrypting won't matter.

Why would you encrypt passwords instead of hashing? Encryption by definition is two-way, so you can retrieve the original password.

Re: Electronic Arts Hates Strong Passwords

#52

Post by nettdata »

Having been an Online Architect brought in for a couple of major EA projects (other than this one) I can tell you that they have a very robust and secure centralized user account system available.

The problem comes when you have so many different game teams with varying experience in online security that are allowed to basically implement it as they see fit, and basically "proxy" the account generation/creation process to that centralized user account system. While the underlying system is very capable, the individual game team's end-user offering can be less than optimal, shall we say.

This particular password issue is not an EA-wide thing, to be sure.

Re: Electronic Arts Hates Strong Passwords

#53

Post by LukeShu »

tomp wrote: post #45

OMG, that's all I can say.I'm no expert on security, but the few web sites that I wrote, I intuitively tried to do something as complicated as possible... e.g. md5('something silly' + password + 'qtjwtrb89ujq309') Now, if I were to make an authentication system again, I would use custom salt for every user, something like sha1('random1' + username + 'random2' + password + 'random3') This way, there is no way to use r…

That's better, but still horribly broken. Sha1 and md5 simply aren't adequate for secure passwords, they are still broken too quickly. You should use bcrypt. http://codahale.com/how-to-safely-store-a-password/ explains why, and links to implementations of bcrypt in many environments/languages (in the opening when he says "Use bcrypt" a hundred times).

Re: Electronic Arts Hates Strong Passwords

#54

Post by kogir »

tomp wrote: post #45

OMG, that's all I can say.I'm no expert on security, but the few web sites that I wrote, I intuitively tried to do something as complicated as possible... e.g. md5('something silly' + password + 'qtjwtrb89ujq309') Now, if I were to make an authentication system again, I would use custom salt for every user, something like sha1('random1' + username + 'random2' + password + 'random3') This way, there is no way to use r…

To beat the dead horse one more time, please use per-user salts and bcrypt, scrypt, or PBKDF2 (RFC 2898).

Single time hashes (even per-user salted), are no longer sufficient protection.

Re: Electronic Arts Hates Strong Passwords

#55

Post by redthrowaway »

true_religion wrote: post #51
redthrowaway wrote: post #13

Earlier quoted context omitted.

Long, random strings with weird characters are unlikely to be in any md5 dictionary, so you'd have to bruteforce it. MD5 is a fast algo so that shouldn't take long for short passwords, but it does provide some security. If you've chosen a strong password then bruteforcing isn't a concern, so the fact they hashed instead of encrypting (edit: used a weak hashing algo) won't matter. It's better than nothing, but not muc…

> If you've chosen a strong password then bruteforcing isn't a concern, so the fact they hashed instead of encrypting won't matter. Why would you encrypt passwords instead of hashing? Encryption by definition is two-way, so you can retrieve the original password.

My bad, that was lazy of me. I was using the words sloppily. By "encryption", I was simply trying to say, "hard to break". I know that's not what it means, and apologize for any confusion.

Re: Electronic Arts Hates Strong Passwords

#56

Post by saulrh »

baha_man wrote: post #16
saulrh wrote: post #10

Earlier quoted context omitted.

Even worse, if I remember correctly they silently truncate passwords longer than 16 characters. I wasted nearly an hour trying to log in when they started doing that.

They're not the only site to silently truncate passwords, unfortunately. (I hope you're joking about spending an hour trying to log in, though.)

The only reason I had a Live account was for the xbox, and one day they updated something and I suddenly couldn't log in. It took me ten or fifteen tries to figure out why my newly-reset passwords weren't working, and it took their system two or three minutes to deliver each password-reset email.

Re: Electronic Arts Hates Strong Passwords

#57

Post by city41 »

David wrote: post #20
Derbasti wrote: post #7

Earlier quoted context omitted.

Think about all-numeric PIN style passwords. I have seen banking websites that enforce [0-9]{4,6}

My bank limits you to 20 characters, which I'll grant is decent. But: NO non-alphanumerics, and, get this, is case insensitive . This may just convince me to switch banks...

My bank is about to roll out a new online banking system. They are requiring us to create a new password for the new system. So in order to log into the new system for the first time, they emailed us telling us to email them back a 6 digit pin to identify ourselves for the first login. My response is to start looking for a new bank.

Re: Electronic Arts Hates Strong Passwords

#58

Post by Freaky »

redthrowaway wrote: post #13
benologist wrote: post #2

Does it matter if they're strong if all they're going to do is md5 them?

Long, random strings with weird characters are unlikely to be in any md5 dictionary, so you'd have to bruteforce it. MD5 is a fast algo so that shouldn't take long for short passwords, but it does provide some security. If you've chosen a strong password then bruteforcing isn't a concern, so the fact they hashed instead of encrypting (edit: used a weak hashing algo) won't matter. It's better than nothing, but not muc…

> MD5 is a fast algo so that shouldn't take long for short passwords

Indeed: http://www.golubev.com/hashgpu.htm

On my pair of HD 5870's I get about 6.3 billion hashes/sec - with lowercase alphanumerics, that's up to 8 characters in about 8 minutes, 9 in 5 hours, and 10 inside a week.

Re: Electronic Arts Hates Strong Passwords

#59

Post by techdmn »

arkitaip wrote: post #4

The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.

I have an issue with att where a complex generated password was accepted as a new password, is rejected on the initial log-in page, then accepted on a subsequent "bad username / password" page. Fun and games.

Re: Electronic Arts Hates Strong Passwords

#60

Post by redthrowaway »

Freaky wrote: post #58
redthrowaway wrote: post #13

Earlier quoted context omitted.

Long, random strings with weird characters are unlikely to be in any md5 dictionary, so you'd have to bruteforce it. MD5 is a fast algo so that shouldn't take long for short passwords, but it does provide some security. If you've chosen a strong password then bruteforcing isn't a concern, so the fact they hashed instead of encrypting (edit: used a weak hashing algo) won't matter. It's better than nothing, but not muc…

> MD5 is a fast algo so that shouldn't take long for short passwords Indeed: http://www.golubev.com/hashgpu.htm On my pair of HD 5870's I get about 6.3 billion hashes/sec - with lowercase alphanumerics, that's up to 8 characters in about 8 minutes, 9 in 5 hours, and 10 inside a week.

Pair of HD 5870's... BitCoin mining? I'd heard they were the most cost-effective card for it.
Post reply on HN