Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diablo 3 bug report: "Passwords not case-sensitive."

us.battle.net

Post reply on HN
Print view View original

41–50 of 156 posts

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#41

Post by lucian1900 »

AgentConundrum wrote: post #33
Twisol wrote: post #22

Earlier quoted context omitted.

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

They would only have to store a single hash - the proper password. When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that. Remember that when you log in, the server is receiving your passwor…

The only problem with that is that it's ripe for timing attacks. I _hope_ they always check all three passwords anyway.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#42

Post by Steko »

duaneb wrote: post #18
nodata wrote: post #12

Earlier quoted context omitted.

So use a long password without them: password strength is what counts, not funny rules about special characters and minimum characters.

They also restrict it to EDIT: That doesn't even make sense, unless they're storing plain-text passwords.

If you're at the point of needing a 50 character passcode for your blizzard game maybe you should just download the free authenticator.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#43

Post by Udo »

elithrar wrote: post #20
Bud wrote: post #9

Although this is a really silly bug, I did already know about it (it's the same in WoW), so frankly at the moment, I'm more concerned about the Diablo 3 bug which is causing a lot of us to not be able to successfully login and play, at all. Really not good.

> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…

I agree completely. It is not a bug. From my experience, technically inept users confuse upper and lower case all the time - and the result is they file an incident report because their "password stopped working". The same applies to leading or trailing spaces, they should be stripped.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#44

Post by fuzzix »

AgentConundrum wrote: post #33
Twisol wrote: post #22

Earlier quoted context omitted.

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

They would only have to store a single hash - the proper password. When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that. Remember that when you log in, the server is receiving your passwor…

Why not just lcase everything during initial hashing and later auth?

sha1sum(lcase($passwd). $salt);

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#45

Post by [deleted] »

fuzzix wrote: post #44
AgentConundrum wrote: post #33

Earlier quoted context omitted.

They would only have to store a single hash - the proper password. When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that. Remember that when you log in, the server is receiving your passwor…

Why not just lcase everything during initial hashing and later auth? sha1sum(lcase($passwd). $salt);

[deleted]

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#47

Post by Jare »

nsmartt wrote: post #13
nodata wrote: post #12

Earlier quoted context omitted.

So use a long password without them: password strength is what counts, not funny rules about special characters and minimum characters.

This is not the point. Users are put at risk because Blizzard fails to adequately impose security. Tech savvy users can just use a stronger password, but the others are put at risk by what I can only call negligence.

(based on my anecdotal evidence) Most "normal" people do not use caps letters in their passwords. If you force them to do it, they'll capitalize the first letter and that's it. Compared to this, the lower amount of password-related troubles and customer service probably results in better overall password security.

Phishing, keyloggers and various social hacks are the real problem. Blizzard has always been very active in this regard with their constant and visible reminders that "Blizzard will NEVER ask for your password", but most users disregard even that.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#48

Post by Jare »

kecebongsoft wrote: post #26

I am interested to know how are they storing case insensitive passwords if they were not plain text, they only way I could imagine is by converting them in a full lower/upper case before hashing is performed.

I'm curious, why would you doubt that your "only way" would not be what they do? It works, it's simple, it has no downsides.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#49

Post by zobzu »

TWAndrews wrote: post #35
gte910h wrote: post #2

Use a passphrase then if this bothers you? If you want to be serious about security of your account, use one of the two factor authentication systems available that they offer. The faster passwords stop looking like: C@tV0m!t And start looking like: correct battery horse staple the better for security and actually remembering the phrase rather than writing it down. (XKCD on this: http://xkcd.com/936/ )

One has to imagine that the actual phrase "correct battery horse staple" is a fairly poor choice of password, at this point though...

I'm using "archaic hello dog waterpool" so i'm safe.
Post reply on HN