Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diablo 3 bug report: "Passwords not case-sensitive."

us.battle.net

Post reply on HN
Print view View original

131–140 of 156 posts

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#131

Post by nsxwolf »

xaro wrote: post #118
jackalope wrote: post #109

Earlier quoted context omitted.

No. Usually, when I create a password I'm asked to verify it in the next text field. When I visit the login page and enter the exact same characters , I expect it to work. I shouldn't have to guess at my own password because some clever developer's algorithm decides that I made a mistake.

You don't need to guess it, if it's implemented the correct way, the signup and the login process will have the same rules and you won't notice.

I'm fairly certain you are both jesting.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#132

Post by blindhippo »

When are we, as a society, going to solve the password problem?

Passwords are a terrible mechanism for solving security - to make them "secure" you have to enforce stringent policies creating passwords that are not memorable to many users, leading to passwords being written down. Add in the fun of needed to know far too many passwords (my daily count is at 17...).

Honestly I don't know enough about cryptography or security in general, but could an application be locked down using a public/private key (ala, SSH)? I'd love the ability to generate my own key (with my own password) and assign it to any application.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#133

Post by gte910h »

TWAndrews wrote: post #35
gte910h wrote: post #2

Use a passphrase then if this bothers you? If you want to be serious about security of your account, use one of the two factor authentication systems available that they offer. The faster passwords stop looking like: C@tV0m!t And start looking like: correct battery horse staple the better for security and actually remembering the phrase rather than writing it down. (XKCD on this: http://xkcd.com/936/ )

One has to imagine that the actual phrase "correct battery horse staple" is a fairly poor choice of password, at this point though...

Yes, I agree with that.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#134

Post by gte910h »

icebraining wrote: post #8
gte910h wrote: post #2

Use a passphrase then if this bothers you? If you want to be serious about security of your account, use one of the two factor authentication systems available that they offer. The faster passwords stop looking like: C@tV0m!t And start looking like: correct battery horse staple the better for security and actually remembering the phrase rather than writing it down. (XKCD on this: http://xkcd.com/936/ )

Well, in the same forum there's also this: http://us.battle.net/d3/en/forum/topic/5149150816 I don't understand why there is a 16 character limit on user passwords.

It's not technically a limit, as much as a truncation.

I still would be happy if they lengthened that.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#135

Post by dclowd9901 »

blindhippo wrote: post #132

When are we, as a society, going to solve the password problem? Passwords are a terrible mechanism for solving security - to make them "secure" you have to enforce stringent policies creating passwords that are not memorable to many users, leading to passwords being written down. Add in the fun of needed to know far too many passwords (my daily count is at 17...). Honestly I don't know enough about cryptography or se…

Probably when bio-based methods of authentication become cheaper and more commonplace. The problem is the passwords themselves: having to remember something arbitrary and outside the normal context of your day.

Hell, their sole purpose is to be cumbersome.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#136

Post by speleding »

loup-vaillant wrote: post #125

Entropy of [a-z0-9] per character : 5,1 bits Entropy of [A-Za-z0-9] per character : 5,95 bits Entropy lost by case insensitivity (per character): 0,85 bits (15%) Bottom line: add 2 characters, and your password stays strong. Still, it would cool to warn users, or at least explicitly advise them to use longer passwords.

Not only is the entropy difference small, there is also an added benefit in less users having to reset their password. Forgetting how their password was capitalized is a big problem for people.

Letting improved user experience trump a tiny bit of extra security is a good tradeoff for Blizzard. They're not a bank.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#137

Post by papsosouid »

Steko wrote: post #46

Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.

Yeah, blizzard are big kids, they would never be so astoundingly incompetent as to do something like say, trust the client to decide whether or not a character is realm. Oh wait, yeah they did that didn't they? But surely they would never be so incompetent as to trust the client to tell the server the clients co-ords right? Oh no, they did they too (and still do!). Seriously, blizzard's demonstrated repeatedly that they either do not understand security, or do not care about security. Either way, "trust them because they have lots of users" is ridiculous.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#138

Post by uxp »

tptacek wrote: post #105
drivebyacct2 wrote: post #59

Earlier quoted context omitted.

It's almost like I acknowledged that there were ways of doing it but expressed concerns for/of doubt that it was being done in the proper fashion due to the misguidedness of it. I'll say for a third time, as you're not the first person to reply in kind, I'm more than well aware of ways this could be done, but none of them meet the typical expectation of how passwords are hashed and I would guess/assume that someone i…

They're using SRP, which dictates that they're storing passwords (relatively) securely on their side. You don't have to guess; this stuff has been reversed.

Storing un-hashed passwords (encrypted or otherwise)?

I'm largely unaware of crypto outside of the general "use bcrypt" webapp cases. SRP is a fairly unknown field to me.

Edit: nevermind, you more or less confirmed this question further down this thread[1], and [2]

[1] http://news.ycombinator.com/item?id=4022996

[2] http://news.ycombinator.com/item?id=4023034

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#139

Post by JackC »

speleding wrote: post #136
loup-vaillant wrote: post #125

Entropy of [a-z0-9] per character : 5,1 bits Entropy of [A-Za-z0-9] per character : 5,95 bits Entropy lost by case insensitivity (per character): 0,85 bits (15%) Bottom line: add 2 characters, and your password stays strong. Still, it would cool to warn users, or at least explicitly advise them to use longer passwords.

Not only is the entropy difference small, there is also an added benefit in less users having to reset their password. Forgetting how their password was capitalized is a big problem for people. Letting improved user experience trump a tiny bit of extra security is a good tradeoff for Blizzard. They're not a bank.

FWIW, I think I read at one point that WoW accounts were worth more on the black market than credit card numbers. So security isn't totally unimportant.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#140

Post by Pechtel »

jackalope wrote: post #109
Udo wrote: post #43

Earlier quoted context omitted.

I agree completely. It is not a bug. From my experience, technically inept users confuse upper and lower case all the time - and the result is they file an incident report because their "password stopped working". The same applies to leading or trailing spaces, they should be stripped.

No. Usually, when I create a password I'm asked to verify it in the next text field. When I visit the login page and enter the exact same characters , I expect it to work. I shouldn't have to guess at my own password because some clever developer's algorithm decides that I made a mistake.

I've implemented this very thing for the same reason--it cuts down on user errors. The real answer to password security is length, not putting odd stuff in the passwords that makes people forget them.

There's nothing you need to guess, the logic is in the password encoder and thus will apply both when you set it and when you use it.

Post reply on HN