Also, Blizzard has a 16-character password limit... seriously disappointing.
Blizzard has numerous server side protections that prevent your lower case 16 character p/w from ever being brute forced. It's not that big of a deal.
Blizzard Network Breached; Change Your Battle.Net Passwords
21–30 of 164 posts
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#22This is ridiculous. Maybe the world is ending, because it feels like every major website/provider of some popular service is getting hacked these days. A company of Blizzard's stature and wallet size has no excuse for this kind of thing happening, no excuse at all. If you're charging people exorbitant amounts of cash to buy your games and then charging some of your customers a fee for the privilege of using your so-c…
Blizzard operates in a free market. Average consumers don't care that much about security until something happens, then they forget. Therefore, security isn't a priority to Blizzard. It is really as simple as that.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#23Earlier quoted context omitted.
One of the many reasons using a password manager and having different, random passwords for each site is a good idea.
I agree. As long as the password authentication mechanism is in place, unique, random, and complex passwords are the best way to secure yourself. Unless you can memorize each of these unique passwords yourself, the next best thing is to use a secure password manager program to take care of this for you.
I follow this in practice, but I always have to wonder: what if someone gets my password database and breaks it? It would only take a keylogging trojan to get everything they needed.
I would be in for a world of hurt! Way worse than if a few of my accounts were compromised because I had used the same password. But still, the chances of being compromised are probably much smaller.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#24[deleted]
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#25Earlier quoted context omitted.
> Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext? I would hazard a guess that most sites store "Secret Questions/Answers" in plain text, or a two-way hash (that their support app reverses), as they are used to confirm identity along with the basics (DOB, address, email, etc).
They can confirm identity with a one-way hash - the only reason I could think of not supporting this would be fuzzy matching.
Well, that would be thhe reason, I think...
Example:
For: "Who was your favorite high school teacher."
- Mr. Berners-Lee - Mr. Berners Lee - Tim Berners-Lee - Mr. Lee
Never mind if you had two different teachers who were great, and you switch them interchangeably depending on whether you're in an English mood or a Music mood
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#26I'm concerned that this is happening so often that it is no longer raising eyebrows. It's becoming one of those "just how things work on the Internet, get used to it".
Either that or 2-factor authentication will catch on and stealing passwords won't be worth anything.
Blizzard has 2 factor; the secrets for the mobile authenticator seem to have been compromised as well as the hashed passwords.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#27This is ridiculous. Maybe the world is ending, because it feels like every major website/provider of some popular service is getting hacked these days. A company of Blizzard's stature and wallet size has no excuse for this kind of thing happening, no excuse at all. If you're charging people exorbitant amounts of cash to buy your games and then charging some of your customers a fee for the privilege of using your so-c…
Blizzard operates in a free market. Average consumers don't care that much about security until something happens, then they forget. Therefore, security isn't a priority to Blizzard. It is really as simple as that.
Security seems like a priority at Blizzard based on everything I know.
Priority =/= invulnerability.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#28Also, Blizzard has a 16-character password limit... seriously disappointing.
Blizzard has numerous server side protections that prevent your lower case 16 character p/w from ever being brute forced. It's not that big of a deal.
Any password length limitation (within reason, not allowing a 1MB password is reasonable) says to me "we are not using hashes". That may or may not be the actual case, but it's the only reason I can think of for limiting password length. Hashes used for passwords have fixed lengths regardless of input, so any length password will "fit" in a database column.
If you're using hashes, limiting the lengths of passwords is extra work.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#29Earlier quoted context omitted.
Blizzard has numerous server side protections that prevent your lower case 16 character p/w from ever being brute forced. It's not that big of a deal.
Any password length limitation (within reason, not allowing a 1MB password is reasonable) says to me "we are not using hashes". That may or may not be the actual case, but it's the only reason I can think of for limiting password length. Hashes used for passwords have fixed lengths regardless of input, so any length password will "fit" in a database column. If you're using hashes, limiting the lengths of passwords is…
"That may or may not be the actual case"
It is not the actual case so I guess your blanket assumption was completely wrong.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#30They're after my 150K DPS Demon Hunter.