Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diablo 3 bug report: "Passwords not case-sensitive."

us.battle.net

Post reply on HN
Print view View original

101–110 of 156 posts

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#101

Post by furyofantares »

Steko wrote: post #86
chives wrote: post #83

Earlier quoted context omitted.

>After a small number of failed logins, your IP is temporarily banned. That means that bruteforcing is nearly impossible. If someone in genuinely trying to crack passwords, I'm going to go out on a limb here and say that they know what proxy servers are and how to use them.

After a certain number of attempts even the account is locked out of being logged into for a period. Also after being logged into from multiple IP's in a short period it will be locked. You guys seriously act like Blizzard just fell off the turnip truck here.

Unless the list of accounts you want to crack is tiny, a brute force attack easily gets around per-account rate limiting by simply switching to a different account before tripping it and coming back to the account later.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#102

Post by tszming »

gizzlon wrote: post #91
tszming wrote: post #90

Not sure about Diablo but one of the reasons I can think of why some web site's password is case in-sensitive (it is not uncommon) - they are checking the user password directly with MySQL, e.g. select * from users where user = 'john' and password = 'PASSWORD'; -- the password is actually case in-sensitive if your table collation is ci (which is the default) Of course this also implies the site is storing the passwor…

is that true if "password" is char or varchar as well? Or only for text fields?

For nonbinary strings (CHAR, VARCHAR, TEXT), string searches use the collation of the comparison operands

The default character set and collation are latin1 and latin1_swedish_ci, so nonbinary string comparisons are case insensitive by default.

http://dev.mysql.com/doc/refman/5.1/en/case-sensitivity.html

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#103

Post by furyofantares »

lucian1900 wrote: post #78
al_james wrote: post #56

Earlier quoted context omitted.

Hi, interested in the above comment. Can you explain how a timing attack would work here?

An interesting demo: [1] By not doing all 3 hashes, an attacker might realise that the password they sent passed, say, 2 checks, but not the third. This discloses information about the relationship between the password the attacker just tried and the correct password. [1] http://carlos.bueno.org/2011/10/timing.html

I'm not sure how this is applicable here, if the attacker passes any of the tests then they are able to log in

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#104

Post by TazeTSchnitzel »

nilved wrote: post #75
duaneb wrote: post #18

Earlier quoted context omitted.

They also restrict it to EDIT: That doesn't even make sense, unless they're storing plain-text passwords.

They limit to 16 characters silently. I used a 32-character password for quite some time and wasn't aware that it was silently being truncated to 16.

There was a site I used where one password field was something like 20 chars max, the other was 50. So I could change my password but never log in with it.

That company was namecheap, if I remember rightly.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#105

Post by tptacek »

drivebyacct2 wrote: post #59
desas wrote: post #57

Earlier quoted context omitted.

Quite surprised at the number of people who are worried about this, it's hardly complicated..

It's almost like I acknowledged that there were ways of doing it but expressed concerns for/of doubt that it was being done in the proper fashion due to the misguidedness of it. I'll say for a third time, as you're not the first person to reply in kind, I'm more than well aware of ways this could be done, but none of them meet the typical expectation of how passwords are hashed and I would guess/assume that someone i…

They're using SRP, which dictates that they're storing passwords (relatively) securely on their side. You don't have to guess; this stuff has been reversed.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#106

Post by TazeTSchnitzel »

tszming wrote: post #90

Not sure about Diablo but one of the reasons I can think of why some web site's password is case in-sensitive (it is not uncommon) - they are checking the user password directly with MySQL, e.g. select * from users where user = 'john' and password = 'PASSWORD'; -- the password is actually case in-sensitive if your table collation is ci (which is the default) Of course this also implies the site is storing the passwor…

That or they just do `password.lower()`

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#107

Post by tptacek »

Steko wrote: post #85
bluecalm wrote: post #76

Earlier quoted context omitted.

>Am I missing something silly? Yes. It's not that the bad guys try bruteforce to login multiple times and wait to be banned. They could (will/might) steal db with hashed passwords, do their decrypting at home and then login with what they got. The stronger the password (or better, ie slower to calculate hash used) the more time they need for that thus giving more time for Blizzard to realize passwords were compromise…

This assumes they aren't salting the hashes. But Blizzard apparently[1] uses SRP 6+ which does salt the hashes meaning if you and me have the same password we will still have unique hashes. [1] http://www.reddit.com/r/netsec/comments/u2168/blizzard_inten...

Just so you know, every variant of SRP is randomized, not just SRP6, and every variant of SRP has parameters that can to some extent be tweaked to provide variable work factors.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#108

Post by Shivetya »

What about, battletags do not obey real id preferences in your battlnet account? As in, I was in Diablo 3 beta. I joined numerous public groups.

Apparently anyone who was in those groups can now see if I play World of Warcraft, which server I am on, and even what zone I am in.

and there is nothing I can do about it. Zero, zilch, oh except buy Diablo 3 and change my settings from there because it can access features of my account the standard account management system cannot.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#109

Post by jackalope »

Udo wrote: post #43
elithrar wrote: post #20

Earlier quoted context omitted.

> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…

I agree completely. It is not a bug. From my experience, technically inept users confuse upper and lower case all the time - and the result is they file an incident report because their "password stopped working". The same applies to leading or trailing spaces, they should be stripped.

No. Usually, when I create a password I'm asked to verify it in the next text field. When I visit the login page and enter the exact same characters, I expect it to work. I shouldn't have to guess at my own password because some clever developer's algorithm decides that I made a mistake.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#110

Post by nooooooo »

lucian1900 wrote: post #78
al_james wrote: post #56

Earlier quoted context omitted.

Hi, interested in the above comment. Can you explain how a timing attack would work here?

An interesting demo: [1] By not doing all 3 hashes, an attacker might realise that the password they sent passed, say, 2 checks, but not the third. This discloses information about the relationship between the password the attacker just tried and the correct password. [1] http://carlos.bueno.org/2011/10/timing.html

And that relationship is useful how?
Post reply on HN