Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diablo 3 bug report: "Passwords not case-sensitive."

us.battle.net

Post reply on HN
Print view View original

91–100 of 156 posts

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#91

Post by gizzlon »

tszming wrote: post #90

Not sure about Diablo but one of the reasons I can think of why some web site's password is case in-sensitive (it is not uncommon) - they are checking the user password directly with MySQL, e.g. select * from users where user = 'john' and password = 'PASSWORD'; -- the password is actually case in-sensitive if your table collation is ci (which is the default) Of course this also implies the site is storing the passwor…

is that true if "password" is char or varchar as well? Or only for text fields?

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#92

Post by DrJokepu »

Steko wrote: post #46

Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.

edit: I said something stupid here. Nothing to see here, move along.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#93

Post by rmc »

DrJokepu wrote: post #92
Steko wrote: post #46

Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.

edit: I said something stupid here. Nothing to see here, move along.

Passwords being case insensitive implies that they are storing passwords as clear text.

What? No it doesn't. They could just lower case all the password submissions and store the hashed version of that. When someone tries to log in, lower case what they enter, hash it, and compare to hash (or whatever the specifics are)

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#94

Post by rmc »

tszming wrote: post #90

Not sure about Diablo but one of the reasons I can think of why some web site's password is case in-sensitive (it is not uncommon) - they are checking the user password directly with MySQL, e.g. select * from users where user = 'john' and password = 'PASSWORD'; -- the password is actually case in-sensitive if your table collation is ci (which is the default) Of course this also implies the site is storing the passwor…

In that case there is a much much much bigger problem than case sensitivity.

Hint: storing passwords in plain text

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#95

Post by AgentConundrum »

dewiz wrote: post #69
AgentConundrum wrote: post #33

Earlier quoted context omitted.

They would only have to store a single hash - the proper password. When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that. Remember that when you log in, the server is receiving your passwor…

there is no multiple transformations, they just lcase every pwd input before hashing. the stored hash is the hash of the lcase pwd.

I was referring to Facebook with my comment, not Diablo 3.

Facebook massages the data to allow you to login even if you have caps lock on, so "pASSWORD" works when your password is "Password", or if, e.g., your phone capitalizes the first character in your password, so "Password" works when your password is "password".

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#96

Post by rmc »

tonyedgecombe wrote: post #24
Twisol wrote: post #22

Earlier quoted context omitted.

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

Or perhaps they aren't storing it hashed ...

Facebook are not that stupid.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#97

Post by [deleted] »

DrJokepu wrote: post #92
Steko wrote: post #46

Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.

edit: I said something stupid here. Nothing to see here, move along.

[deleted]

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#98

Post by rmc »

duaneb wrote: post #19
tylermenezes wrote: post #7

Earlier quoted context omitted.

Facebook's is a little better - you can't disregard case entirely. Blizzard just cut the search space by a lot. Then again, it would be pretty difficult to brute force a password in Battle.net, to be honest. I'm assuming they'd lock out the account after just a handful of tries.

Yea, until someone steals their hashes.

Which is easier said than done. Honestly if someone can do that, you have bigger problems to worry about.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#99

Post by rmc »

Jare wrote: post #48
kecebongsoft wrote: post #26

I am interested to know how are they storing case insensitive passwords if they were not plain text, they only way I could imagine is by converting them in a full lower/upper case before hashing is performed.

I'm curious, why would you doubt that your "only way" would not be what they do? It works, it's simple, it has no downsides.

Some people think that they must be storing the passwords in plain text ( http://news.ycombinator.com/item?id=4022765)

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#100

Post by tptacek »

carbocation wrote: post #60
JonnieCache wrote: post #58

Earlier quoted context omitted.

Can you do a timing attack against something as fast as a case conversion and a hash function, even if it has a work factor? Normally they're done against database requests aren't they?

"Remote Timing Attacks are Practical" https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf

You can't do a timing attack against a password hashed serverside, since you don't control the string being compared enough to make iterated byte-at-a-time changes.

Even if I'm misunderstanding, though, this particular remote timing attack is probably not practical in most programming environments; (for instance) straight C memcmp is below the measurement floor, even with signal processing.

That is a great paper; also, check out Crosby and Wallach for the modernized, math-ier take; with signal processing, the measurement limits are nanoseconds on a switched LAN (ie, if you could get a box deployed in the same hosting center as Blizzard) and tens of milliseconds over the Internet:

http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.65.9...

... and Nate Lawson's Black Hat talk which actually goes through the practical issues trying to set up and run these attacks against real systems:

http://www.youtube.com/watch?v=A0T8o-Aq3yY

Post reply on HN