I run a phone emulator and run the blizzard authenticator app on it.Works great for me and adds some security.
Doesn't that kind of defeat the purpose of two-factor authentication?
Diablo 3 bug report: "Passwords not case-sensitive."
121–130 of 156 posts
Re: Diablo 3 bug report: "Passwords not case-sensitive."
#122This has been the case since as long as I can remember. Not sure why it's an issue all of a sudden.
Re: Diablo 3 bug report: "Passwords not case-sensitive."
#123Also, most banks don't enforce case-sensitivity. I just logged in to my Chase account ignoring the case.
Re: Diablo 3 bug report: "Passwords not case-sensitive."
#124Earlier quoted context omitted.
Unless the list of accounts you want to crack is tiny, a brute force attack easily gets around per-account rate limiting by simply switching to a different account before tripping it and coming back to the account later.
There's only say 12-15 million active accounts. Even if you had all of them you're going to run out of attempts before you reliably brute force anything. Far more likely is Blizzard looks out for large scale distributed brute force attacks and locks users to their last handful of confirmed IPs. That's in the realm of speculation admittedly. Look I'm largely defending Blizzard here but they aren't paragons of security…
Once you limit it to accounts actually worth hacking which don't have an authenticator you're probably looking at more like a million accounts.
Re: Diablo 3 bug report: "Passwords not case-sensitive."
#125 Entropy of [a-z0-9] per character : 5,1 bits
Entropy of [A-Za-z0-9] per character : 5,95 bits
Entropy lost by case insensitivity
(per character): 0,85 bits (15%)
Re: Diablo 3 bug report: "Passwords not case-sensitive."
#126This isn't a bug at all. I would question the assumption that case sensitivity increases the actual search space significantly, theoretically it does but in practise most users will:
- Uppercase first letter only
- All lowercase
It's a usability decision from Blizzard, not a bug.
Re: Diablo 3 bug report: "Passwords not case-sensitive."
#127The following banks and financial institutions also silently discard case-sensitivity:
Citibank
Chase
Wells Fargo
E-Trade
US Bank
Fidelity Investments
SECU
HSBC
TechCU
Re: Diablo 3 bug report: "Passwords not case-sensitive."
#128Entropy of [a-z0-9] per character : 5,1 bits Entropy of [A-Za-z0-9] per character : 5,95 bits Entropy lost by case insensitivity (per character): 0,85 bits (15%) Bottom line: add 2 characters, and your password stays strong. Still, it would cool to warn users, or at least explicitly advise them to use longer passwords.
Or if you care just use an authenticator which adds significant entropy without forcing you to remember anything.
http://us.blizzard.com/store/search.xml?q=authenticator they all have free android / iOS apps.
Re: Diablo 3 bug report: "Passwords not case-sensitive."
#129This isn't a bug at all. I would question the assumption that case sensitivity increases the actual search space significantly, theoretically it does but in practise most users will: - Uppercase first letter only - All lowercase It's a usability decision from Blizzard, not a bug.
Also, to address this comment in the thread:
> This means they probably store passwords in plain text, unsalted, etc. This is unbelievable.
It absolutely does not make that any more likely. All you have to do is normalize it to upper/lower case before hashing and you have case insensitivity.
Re: Diablo 3 bug report: "Passwords not case-sensitive."
#130They don't (or didn't, I haven't checked in the last few months) allow special characters, either. Seriously - what? (Then again, my bank does the same thing.)
Not true at all. My password is long and complex, complete with many different special characters.