Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diablo 3 bug report: "Passwords not case-sensitive."

us.battle.net

Post reply on HN
Print view View original

61–70 of 156 posts

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#61

Post by Steko »

rcgs wrote: post #54
Steko wrote: post #46

Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.

Just like how we shouldn't worry about big kids Sony and their 70+ million network being compromised? Telling people not to worry about security works until they, inevitably, have their data compromised. Technically aware consumers have a responsibility to put pressure on companies to be secure with information.

Did Sony offer a free authenticator? At any rate I'm not shedding tears for Sony if that's what you're asking.

"Technically aware consumers have a responsibility to put pressure on companies to be secure with information."

No one's shown that Blizzard has been unsecure with anyone's information. I see a lot of people running around like the sky is falling when it's not.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#62

Post by nsmartt »

Jare wrote: post #47
nsmartt wrote: post #13

Earlier quoted context omitted.

This is not the point. Users are put at risk because Blizzard fails to adequately impose security. Tech savvy users can just use a stronger password, but the others are put at risk by what I can only call negligence.

(based on my anecdotal evidence) Most "normal" people do not use caps letters in their passwords. If you force them to do it, they'll capitalize the first letter and that's it. Compared to this, the lower amount of password-related troubles and customer service probably results in better overall password security. Phishing, keyloggers and various social hacks are the real problem. Blizzard has always been very active…

My fault. I didn't explain properly. I didn't mean it in the normal way- to require strict passwords. I meant in the sense that users who do add a capital in order to up their account security don't get that security added. Only users who know about this bug and go the extra mile then will benefit from the view of "So just make a better password without."

I apologize if this is worded badly. I'm not feeling up to my usual ritual of rewording my post until I'm convinced it makes perfect sense to those who don't have magical insight into my mind.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#63

Post by Zarathust »

Steko wrote: post #46

Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.

So I need to buy a smartphone to enjoy basic security features.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#64

Post by e-dard »

zerovox wrote: post #52
e-dard wrote: post #39

Earlier quoted context omitted.

I don't under stand the confusion in the other replies here. 1) lowercase inputted password. 2) hash password 3) compare hash to db hash (which was from a lowercased initial password).

Because this isn't how they do it. that method is the same as the Blizzard method, and it is a lot less secure than transforming the plain text and trying the three different combinations(normal, uppercase first and capslock password)

Ah, sorry, I missed the top of this reply-thread. I was referring to the story, not Facebook. :-)

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#65

Post by dewiz »

scg wrote: post #29
Twisol wrote: post #22

Earlier quoted context omitted.

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

No, they only need to store a single hashed password. For authentication they can just try out the other 2 transformations above and see if any of them matches what's on file.

thereis no multiple transformations, they just lcase every pwd input before hashing. the stored hash is a the hash of the lcase pwd.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#66

Post by Steko »

Zarathust wrote: post #63
Steko wrote: post #46

Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.

So I need to buy a smartphone to enjoy basic security features.

I wouldn't call the authenticator "basic security"; it's a very high level of additional security. For a video game.

And if you don't have a smartphone (spoilers you probably do) and you wanted an authenticator you could buy the token or emulate it on the OS of your choice...

http://developer.android.com/guide/developing/tools/emulator...

or on any java device apparently:

http://arenabooster.marisil.org/bma.htm

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#67

Post by panic »

Twisol wrote: post #22
nostromo wrote: post #11

Earlier quoted context omitted.

Related, but different in an important way. If your password is aBc, you can log in to Facebook using aBc (original), AbC (windows caps lock), and ABc (first cap) only. For a regular password, this is just slightly less secure. Being case insensitive entirely is quite a bit less secure (abc, abC, aBc, aBC, Abc, AbC, ABc, ABC).

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

They could normalize it in the following way before storing a hash:

1. If the last letter in the string is uppercase, flip the case of the entire string.

2. Make the first character lowercase.

This would allow for abC as well (if you "capitalized" the first letter while holding down capslock).

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#68

Post by gregcmartin »

If there is brute force protection on the login function blocking a username or IP from attempting x times in y hours AND there is a minimum of 8 characters then I can say thats strong protection on the backend. You are much more vulnerable to having your password phished rather than bruteforced.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#69

Post by dewiz »

AgentConundrum wrote: post #33
Twisol wrote: post #22

Earlier quoted context omitted.

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

They would only have to store a single hash - the proper password. When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that. Remember that when you log in, the server is receiving your passwor…

there is no multiple transformations, they just lcase every pwd input before hashing. the stored hash is the hash of the lcase pwd.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#70

Post by Groxx »

rcgs wrote: post #54
Steko wrote: post #46

Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.

Just like how we shouldn't worry about big kids Sony and their 70+ million network being compromised? Telling people not to worry about security works until they, inevitably, have their data compromised. Technically aware consumers have a responsibility to put pressure on companies to be secure with information.

Precisely the same way, yes. Sony's network being compromised had absolutely nothing to do with password case sensitivity, and absolutely everything to do with shoddy practices elsewhere that opened a massive hole into their database, allowing them to download millions of accounts worth of data.

Millions of accounts from a single breach somewhere. Not millions of accounts individually brute forced because their case-insensitive passwords made them trivially guessable.

We should be worried that Blizzard will get hacked like PSN was. That would be potentially catastrophic. But case sensitivity has almost no effect on password security unless your users ALL use random passwords.

Post reply on HN