Electronic Arts Hates Strong Passwords

Post by decadentcactus » Mon, Jun 27, 2011, 9:52 AM UTC

nettdata wrote: post #52

Having been an Online Architect brought in for a couple of major EA projects (other than this one) I can tell you that they have a very robust and secure centralized user account system available. The problem comes when you have so many different game teams with varying experience in online security that are allowed to basically implement it as they see fit, and basically "proxy" the account generation/creation proce…

Post by tomjen3 » Mon, Jun 27, 2011, 10:11 AM UTC

marshray wrote: post #23

benologist wrote: post #2

Does it matter if they're strong if all they're going to do is md5 them?

Yes, absolutely. Although MD5 is a little on the short side and collisions can be generated for it easily, it would still be a noteworthy breakthrough for someone to produce a primary preimage for MD5. That's what it would take for someone to find a working password for your account given your salt and MD5 hash. In other words, there are still no known cracking tools that can do much better than dictionary or brute f…

Post by plamenv » Mon, Jun 27, 2011, 11:41 AM UTC

Revisor wrote: post #74

plamenv wrote: post #31

Can anyone explain why would you want a password longer than 16 characters? Even if it's unsalted, all lowercase letters and md5 hashed, it's impossible to bruteforce crack it. And people who use 16 character passwords are unlikely to have them all-lowercase-lettered so it's even worse for the crackers. Sure, the 16 char limit may be arbitrary but even if you make it 50, tomorrow some outraged blogger will be complai…

A better question is> Why WOULDN'T I want a password longer than 16 chars? The longer the password, the more secure I feel, even if it's one day leaked as an unsalted MD5. And I don't care whether I can remember it because my password manager has effectively superseded my memory. There is no reason to put an upper limit to the password length.

Post by drdaeman » Mon, Jun 27, 2011, 1:56 PM UTC

jackvalentine wrote: post #98

windsurfer wrote: post #76

Earlier quoted context omitted.

The rules for my university are: * 7 to 8 characters long * Must contain at least one of each: non-capitalized letter, capitalized letter, and a number * No special characters allowed

Mine are: "The new password is to be chosen as a combination of alphabetics, digits and special characters. It must be eight characters long and contain one of the special printable characters (eg $ - ! : / = _). Normal alphabetic characters are case sensitive ie "a" is not the same as "A". Special characters may not appear at the beginning or end."

    $ openssl rand -base64 9
    TjB3tbYOo1wz

Post by muppetman » Mon, Jun 27, 2011, 9:53 PM UTC

jlangenauer wrote: post #102

muppetman wrote: post #82

ASB Bank in New Zealand allows a maximum of 8 characters for your passwords. Numbers and letters only. That's right, all that stands between you and your account details is 8 characters. If someone tries to transfer out over ~$200 then you get a text message on your phone - IF you've enabled that service. So it's not the end of the world, but it's still pretty terrible.

Yes, but (like most banks) I dare say they'd lock your account after 3 incorrect attempts, and you'd have to unlock it out-of-band (e.g. calling their call centre).