Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diablo 3 bug report: "Passwords not case-sensitive."

us.battle.net

Post reply on HN
Print view View original

51–60 of 156 posts

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#51

Post by zerovox »

fuzzix wrote: post #44
AgentConundrum wrote: post #33

Earlier quoted context omitted.

They would only have to store a single hash - the proper password. When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that. Remember that when you log in, the server is receiving your passwor…

Why not just lcase everything during initial hashing and later auth? sha1sum(lcase($passwd). $salt);

because as nostromo said then uppercase counts for nothing. Facebook only lets you log in if you accidentally use cap-lock or accidentally capitalize the first letter(quite common on phones). If you lowercased the whole password first, you reduce the benefit of having uppercase characters at all.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#52

Post by zerovox »

e-dard wrote: post #39
Twisol wrote: post #22

Earlier quoted context omitted.

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

I don't under stand the confusion in the other replies here. 1) lowercase inputted password. 2) hash password 3) compare hash to db hash (which was from a lowercased initial password).

Because this isn't how they do it. that method is the same as the Blizzard method, and it is a lot less secure than transforming the plain text and trying the three different combinations(normal, uppercase first and capslock password)

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#53

Post by daeken »

lucian1900 wrote: post #41
AgentConundrum wrote: post #33

Earlier quoted context omitted.

They would only have to store a single hash - the proper password. When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that. Remember that when you log in, the server is receiving your passwor…

The only problem with that is that it's ripe for timing attacks. I _hope_ they always check all three passwords anyway.

Exposing the timing here can only tell you one thing: the password that you're trying works for Facebook, but the capitalization might be wrong if you're using it to get into the user's account on another site. But since there are only three variants on the password, it gives you effectively nothing. This would be insanely difficult to pull off (many, many login samples) for absolutely no payoff; they might as well save the extra hashes if it works the first time.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#54

Post by rcgs »

Steko wrote: post #46

Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.

Just like how we shouldn't worry about big kids Sony and their 70+ million network being compromised?

Telling people not to worry about security works until they, inevitably, have their data compromised. Technically aware consumers have a responsibility to put pressure on companies to be secure with information.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#55

Post by icebraining »

Steko wrote: post #42
duaneb wrote: post #18

Earlier quoted context omitted.

They also restrict it to EDIT: That doesn't even make sense, unless they're storing plain-text passwords.

If you're at the point of needing a 50 character passcode for your blizzard game maybe you should just download the free authenticator .

OK, where can I download that free authenticator for my Nokia S60?

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#56

Post by al_james »

lucian1900 wrote: post #41
AgentConundrum wrote: post #33

Earlier quoted context omitted.

They would only have to store a single hash - the proper password. When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that. Remember that when you log in, the server is receiving your passwor…

The only problem with that is that it's ripe for timing attacks. I _hope_ they always check all three passwords anyway.

Hi, interested in the above comment. Can you explain how a timing attack would work here?

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#57

Post by desas »

drivebyacct2 wrote: post #27
elithrar wrote: post #20

Earlier quoted context omitted.

> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…

I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume some (plausibly safe) ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do .

Quite surprised at the number of people who are worried about this, it's hardly complicated..

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#58

Post by JonnieCache »

lucian1900 wrote: post #41
AgentConundrum wrote: post #33

Earlier quoted context omitted.

They would only have to store a single hash - the proper password. When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that. Remember that when you log in, the server is receiving your passwor…

The only problem with that is that it's ripe for timing attacks. I _hope_ they always check all three passwords anyway.

Can you do a timing attack against something as fast as a case conversion and a hash function, even if it has a work factor? Normally they're done against database requests aren't they?

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#59

Post by drivebyacct2 »

desas wrote: post #57
drivebyacct2 wrote: post #27

Earlier quoted context omitted.

I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume some (plausibly safe) ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do .

Quite surprised at the number of people who are worried about this, it's hardly complicated..

It's almost like I acknowledged that there were ways of doing it but expressed concerns for/of doubt that it was being done in the proper fashion due to the misguidedness of it.

I'll say for a third time, as you're not the first person to reply in kind, I'm more than well aware of ways this could be done, but none of them meet the typical expectation of how passwords are hashed and I would guess/assume that someone is far more likely to be insecurely storing passwords than going out of their way to store a... reduced entropy version of users' passwords in their database.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#60

Post by carbocation »

JonnieCache wrote: post #58
lucian1900 wrote: post #41

Earlier quoted context omitted.

The only problem with that is that it's ripe for timing attacks. I _hope_ they always check all three passwords anyway.

Can you do a timing attack against something as fast as a case conversion and a hash function, even if it has a work factor? Normally they're done against database requests aren't they?

"Remote Timing Attacks are Practical"

https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf

Post reply on HN