Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diablo 3 bug report: "Passwords not case-sensitive."

us.battle.net

Post reply on HN
Print view View original

71–80 of 156 posts

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#71

Post by vibrunazo »

Complete security newbie here. Doesn't it make brute force attacks almost worthless when you just have a minimum time between each login request after too many attempts per IP ? So you can only try to login every 30sec after you've failed 10 times in a row? I thought brute-forcing logins were a thing of the past after people started implementing this min time between requests strategy.

The only weakness I can imagine would be a massive botnet forcing logins, but even then it would be severely limited. Am I missing something silly?

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#72

Post by Steko »

vibrunazo wrote: post #71

Complete security newbie here. Doesn't it make brute force attacks almost worthless when you just have a minimum time between each login request after too many attempts per IP ? So you can only try to login every 30sec after you've failed 10 times in a row? I thought brute-forcing logins were a thing of the past after people started implementing this min time between requests strategy. The only weakness I can imagine…

Correct, the heavy lifting for basic security is not done with a pw that has 50 bits of entropy and drives off your casual playerbase, it's done on blizzard's backend with lockouts after a few failed attempts.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#73

Post by JonnieCache »

carbocation wrote: post #60
JonnieCache wrote: post #58

Earlier quoted context omitted.

Can you do a timing attack against something as fast as a case conversion and a hash function, even if it has a work factor? Normally they're done against database requests aren't they?

"Remote Timing Attacks are Practical" https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf

I know you can do timing attacks through the network, it's not even that hard in the simple case.

That paper, like most papers on timing attacks, was done on the local network, not the internet. They're relying on absurdly precise measurements of absolutely tiny differences in timing, which would be lost in the jitter and latency of the real internet.

As I said, you can certainly do internet timing attacks where you're looking for database access, because this can take many milliseconds, which is a delay which can be detected even on a crappy internet link using a bit of light statistics.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#74

Post by Steko »

drivebyacct2 wrote: post #27
elithrar wrote: post #20

Earlier quoted context omitted.

> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…

I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume some (plausibly safe) ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do .

From reddit:

I've reversed Battle.net protocols in full. Here's some facts:

Your plaintext password is never sent in plaintext. Old Battle.net clients (Diablo 2 and earlier) use what we call the 'old login system' (OLS), which uses Broken-SHA1 (SHA1 implemented with small bugs). Since Warcraft 3, the 'new login system' (NLS) is used, which uses SRPv6 (a standard for password exchange using public keys + RSA).

Under OLS, the Broken-SHA1 of the password is stored. Under NLS, a value called the verifier is stored, which is derived from the (actual) SHA1 of the password.

The protocols (both OLS and NLS) support case sensitivity just fine - the case insensitivity is a client-side issue. If you implement the protocol yourself, you can use a case sensitive password, but the game client won't be able to log in with it. We used to use that as a security feature in bots.

After a small number of failed logins, your IP is temporarily banned. That means that bruteforcing is nearly impossible.

Honestly, I don't understand why they have case insensitive passwords; but, at the same time, it doesn't make that much difference considering only a few password attempts are allowed before you're banned.

http://www.reddit.com/r/netsec/comments/u2168/blizzard_inten...

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#75

Post by nilved »

duaneb wrote: post #18
nodata wrote: post #12

Earlier quoted context omitted.

So use a long password without them: password strength is what counts, not funny rules about special characters and minimum characters.

They also restrict it to EDIT: That doesn't even make sense, unless they're storing plain-text passwords.

They limit to 16 characters silently. I used a 32-character password for quite some time and wasn't aware that it was silently being truncated to 16.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#76

Post by bluecalm »

vibrunazo wrote: post #71

Complete security newbie here. Doesn't it make brute force attacks almost worthless when you just have a minimum time between each login request after too many attempts per IP ? So you can only try to login every 30sec after you've failed 10 times in a row? I thought brute-forcing logins were a thing of the past after people started implementing this min time between requests strategy. The only weakness I can imagine…

>Am I missing something silly?

Yes. It's not that the bad guys try bruteforce to login multiple times and wait to be banned. They could (will/might) steal db with hashed passwords, do their decrypting at home and then login with what they got. The stronger the password (or better, ie slower to calculate hash used) the more time they need for that thus giving more time for Blizzard to realize passwords were compromised and block all accounts/force global password change. Really clever bad guys can do their homework before they have a chance to put their hands on hashed passwords by preparing hashes for say all passwords which are simple combination of words [1]. Now, once password db is compromised they just look for matching hashes and have instant access to some accounts. This is why you are told to use "strong" passwords, if they just try to "bruteforce log-in" that really wouldn't matter much.

[1] http://en.wikipedia.org/wiki/Rainbow_table

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#77

Post by Steko »

icebraining wrote: post #55
Steko wrote: post #42

Earlier quoted context omitted.

If you're at the point of needing a 50 character passcode for your blizzard game maybe you should just download the free authenticator .

OK, where can I download that free authenticator for my Nokia S60?

Run java?

http://arenabooster.marisil.org/bma.htm

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#78

Post by lucian1900 »

al_james wrote: post #56
lucian1900 wrote: post #41

Earlier quoted context omitted.

The only problem with that is that it's ripe for timing attacks. I _hope_ they always check all three passwords anyway.

Hi, interested in the above comment. Can you explain how a timing attack would work here?

An interesting demo: [1] By not doing all 3 hashes, an attacker might realise that the password they sent passed, say, 2 checks, but not the third. This discloses information about the relationship between the password the attacker just tried and the correct password.

[1] http://carlos.bueno.org/2011/10/timing.html

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#79

Post by woadwarrior01 »

karlshea wrote: post #3

Facebook does sort of the same thing: http://www.zdnet.com/blog/facebook/facebook-passwords-are-no... Yes, it's possibly less secure. But for both Facebook and all of the Blizzard games there are other options if you are concerned.

This story was on HN (albeit from a different source) a couple of weeks ago. https://news.ycombinator.com/item?id=3920918

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#80

Post by fuzzix »

zerovox wrote: post #51
fuzzix wrote: post #44

Earlier quoted context omitted.

Why not just lcase everything during initial hashing and later auth? sha1sum(lcase($passwd). $salt);

because as nostromo said then uppercase counts for nothing. Facebook only lets you log in if you accidentally use cap-lock or accidentally capitalize the first letter(quite common on phones). If you lowercased the whole password first, you reduce the benefit of having uppercase characters at all.

Ah, I missed that, sorry.

I think the point stands for the Blizzard case - there seems to be an assumption in some corners that the password is stored plain text, but I would imagine case neutralised (so to speak) passwords are hashed.

Post reply on HN