Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diablo 3 bug report: "Passwords not case-sensitive."

us.battle.net

Post reply on HN
Print view View original

81–90 of 156 posts

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#81

Post by chc »

nsmartt wrote: post #62
Jare wrote: post #47

Earlier quoted context omitted.

(based on my anecdotal evidence) Most "normal" people do not use caps letters in their passwords. If you force them to do it, they'll capitalize the first letter and that's it. Compared to this, the lower amount of password-related troubles and customer service probably results in better overall password security. Phishing, keyloggers and various social hacks are the real problem. Blizzard has always been very active…

My fault. I didn't explain properly. I didn't mean it in the normal way- to require strict passwords. I meant in the sense that users who do add a capital in order to up their account security don't get that security added. Only users who know about this bug and go the extra mile then will benefit from the view of "So just make a better password without." I apologize if this is worded badly. I'm not feeling up to my…

I think the point here is that if goofy capitalization is the only thing that kept your password from being trivially guessable, your password was only a little bit harder to guess. If your password isn't guessable, then it doesn't really matter if you have additional entropy, because the server smacks down brute-force attempts before they even get off the ground. In other words, it doesn't seem like capital letters make your password appreciably more secure in this context.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#82

Post by carbocation »

JonnieCache wrote: post #73
carbocation wrote: post #60

Earlier quoted context omitted.

"Remote Timing Attacks are Practical" https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf

I know you can do timing attacks through the network, it's not even that hard in the simple case. That paper, like most papers on timing attacks, was done on the local network, not the internet. They're relying on absurdly precise measurements of absolutely tiny differences in timing, which would be lost in the jitter and latency of the real internet. As I said, you can certainly do internet timing attacks where you'…

Right; I guess my thought is that since a hash with a modest work function can also take many milliseconds, this would be meaningful. Not sure in practice, however.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#83

Post by chives »

Steko wrote: post #74
drivebyacct2 wrote: post #27

Earlier quoted context omitted.

I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume some (plausibly safe) ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do .

From reddit: I've reversed Battle.net protocols in full. Here's some facts: Your plaintext password is never sent in plaintext. Old Battle.net clients (Diablo 2 and earlier) use what we call the 'old login system' (OLS), which uses Broken-SHA1 (SHA1 implemented with small bugs). Since Warcraft 3, the 'new login system' (NLS) is used, which uses SRPv6 (a standard for password exchange using public keys + RSA). Under O…

>After a small number of failed logins, your IP is temporarily banned. That means that bruteforcing is nearly impossible.

If someone in genuinely trying to crack passwords, I'm going to go out on a limb here and say that they know what proxy servers are and how to use them.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#84

Post by StavrosK »

chives wrote: post #83
Steko wrote: post #74

Earlier quoted context omitted.

From reddit: I've reversed Battle.net protocols in full. Here's some facts: Your plaintext password is never sent in plaintext. Old Battle.net clients (Diablo 2 and earlier) use what we call the 'old login system' (OLS), which uses Broken-SHA1 (SHA1 implemented with small bugs). Since Warcraft 3, the 'new login system' (NLS) is used, which uses SRPv6 (a standard for password exchange using public keys + RSA). Under O…

>After a small number of failed logins, your IP is temporarily banned. That means that bruteforcing is nearly impossible. If someone in genuinely trying to crack passwords, I'm going to go out on a limb here and say that they know what proxy servers are and how to use them.

Are you saying they have a number of proxy servers comparable to the keyspace? Because I'm pretty sure there aren't that many IPs.

EDIT: I just did a few calculations, there are 40 times as many elements in a 8-character password with only lowercase letters than there are IPv4 addresses.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#85

Post by Steko »

bluecalm wrote: post #76
vibrunazo wrote: post #71

Complete security newbie here. Doesn't it make brute force attacks almost worthless when you just have a minimum time between each login request after too many attempts per IP ? So you can only try to login every 30sec after you've failed 10 times in a row? I thought brute-forcing logins were a thing of the past after people started implementing this min time between requests strategy. The only weakness I can imagine…

>Am I missing something silly? Yes. It's not that the bad guys try bruteforce to login multiple times and wait to be banned. They could (will/might) steal db with hashed passwords, do their decrypting at home and then login with what they got. The stronger the password (or better, ie slower to calculate hash used) the more time they need for that thus giving more time for Blizzard to realize passwords were compromise…

This assumes they aren't salting the hashes. But Blizzard apparently[1] uses SRP 6+ which does salt the hashes meaning if you and me have the same password we will still have unique hashes.

[1] http://www.reddit.com/r/netsec/comments/u2168/blizzard_inten...

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#86

Post by Steko »

chives wrote: post #83
Steko wrote: post #74

Earlier quoted context omitted.

From reddit: I've reversed Battle.net protocols in full. Here's some facts: Your plaintext password is never sent in plaintext. Old Battle.net clients (Diablo 2 and earlier) use what we call the 'old login system' (OLS), which uses Broken-SHA1 (SHA1 implemented with small bugs). Since Warcraft 3, the 'new login system' (NLS) is used, which uses SRPv6 (a standard for password exchange using public keys + RSA). Under O…

>After a small number of failed logins, your IP is temporarily banned. That means that bruteforcing is nearly impossible. If someone in genuinely trying to crack passwords, I'm going to go out on a limb here and say that they know what proxy servers are and how to use them.

After a certain number of attempts even the account is locked out of being logged into for a period.

Also after being logged into from multiple IP's in a short period it will be locked.

You guys seriously act like Blizzard just fell off the turnip truck here.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#87

Post by sixcorners »

Udo wrote: post #43
elithrar wrote: post #20

Earlier quoted context omitted.

> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…

I agree completely. It is not a bug. From my experience, technically inept users confuse upper and lower case all the time - and the result is they file an incident report because their "password stopped working". The same applies to leading or trailing spaces, they should be stripped.

We should also automatically correct the spelling of the word used as the password. /s

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#88

Post by estel »

Steko wrote: post #66
Zarathust wrote: post #63

Earlier quoted context omitted.

So I need to buy a smartphone to enjoy basic security features.

I wouldn't call the authenticator "basic security"; it's a very high level of additional security. For a video game. And if you don't have a smartphone (spoilers you probably do) and you wanted an authenticator you could buy the token or emulate it on the OS of your choice... http://developer.android.com/guide/developing/tools/emulator... or on any java device apparently: http://arenabooster.marisil.org/bma.htm

I believe that they also now allow authentication over SMS.

Edit: it's not quite an authenticator: http://us.battle.net/support/en/article/battlenet-sms-protec...

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#89

Post by estel »

icebraining wrote: post #55
Steko wrote: post #42

Earlier quoted context omitted.

If you're at the point of needing a 50 character passcode for your blizzard game maybe you should just download the free authenticator .

OK, where can I download that free authenticator for my Nokia S60?

Well, they do offer http://us.battle.net/support/en/article/battlenet-sms-protec... which provides an extra (but different) layer of security.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#90

Post by tszming »

Not sure about Diablo but one of the reasons I can think of why some web site's password is case in-sensitive (it is not uncommon) - they are checking the user password directly with MySQL, e.g.

select * from users where user = 'john' and password = 'PASSWORD'; -- the password is actually case in-sensitive if your table collation is ci (which is the default)

Of course this also implies the site is storing the password as plain text..

Post reply on HN