Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard Network Breached; Change Your Battle.Net Passwords

kotaku.com

Post reply on HN
Print view View original

41–50 of 164 posts

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#41

Post by mattdeboard »

RKearney wrote: post #20
swang wrote: post #4

"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we curren…

I believe Blizzard makes you supply a scanned copy of your state issued identification in order to get a password reset.

This is true. Blizzard is unbelievably strict about their account reclamation process. Several years ago I tried to access an account that had been in my ex-wife's name. When I told them that the ex-wife and I weren't in contact, they asked for a copy of the divorce decree, or separation paperwork, or whatever. Seriously.

Of course this was in the 2008 timeframe so maybe things have changed/loosened up since then.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#42

Post by dhimes »

danso wrote: post #25
duaneb wrote: post #17

Earlier quoted context omitted.

They can confirm identity with a one-way hash - the only reason I could think of not supporting this would be fuzzy matching.

Well, that would be thhe reason, I think... Example: For: "Who was your favorite high school teacher." - Mr. Berners-Lee - Mr. Berners Lee - Tim Berners-Lee - Mr. Lee Never mind if you had two different teachers who were great, and you switch them interchangeably depending on whether you're in an English mood or a Music mood

Of course, your answer should NEVER match the question. But that's beside the point.

"Whose was your favorite high school teacher?"

-Pecan pie.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#44

Post by vitalique »

MiguelHudnandez wrote: post #23
dkokelley wrote: post #10

Earlier quoted context omitted.

I agree. As long as the password authentication mechanism is in place, unique, random, and complex passwords are the best way to secure yourself. Unless you can memorize each of these unique passwords yourself, the next best thing is to use a secure password manager program to take care of this for you.

I follow this in practice, but I always have to wonder: what if someone gets my password database and breaks it? It would only take a keylogging trojan to get everything they needed. I would be in for a world of hurt! Way worse than if a few of my accounts were compromised because I had used the same password. But still, the chances of being compromised are probably much smaller.

It depends on which service you actually use, but to my knowledge almost all of the worthy ones provide pre-generation of one-time passwords. Just get a bunch of those passwords on the paper in some proper place to fear the keyloggers no more.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#45

Post by ChuckMcM »

For a long time World of Warcraft accounts sold for more money on the black market than credit card numbers [1]. It was said that this was due to the fact that you could make money using those accounts (primarily through selling 'gold' or in game items) which could not get 'clawed back' by credit card companies.

So having battle.net get hit is a pretty cherry target.

That said, what is the current crack rate for SRP on a GPU for 7, 8 and 10 character passwords?

[1] This was one example but I've also seen other more credible reports on the eset blog. "WoW login I might want to check if they also have Diablo 3 on their account and vice versa. WoW accounts are already more valuable than credit card numbers on the black market, this will only increase their value." -- http://www.gosugamers.net/diablo/news/17557-it-s-the-economy...

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#46

Post by notJim »

csallen wrote: post #31
revx wrote: post #8

Earlier quoted context omitted.

This is why you never use the actual answer to that question, but actually a separate password for those.

That wouldn't help. For example, let's assume your question was, "Who was your favorite teacher growing up?" and your answer was "fish123jellybean456". If that answer is stored in plaintext (no encryption) in a database that's compromised, then it won't matter that it's not the "real" answer. Attackers will see it, and then use it to answer your security questions on other sites. The only way to protect against this…

Presumably you would use a different answer on every site.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#47

Post by StavrosK »

dsl wrote: post #43

From my time reverse engineering the WoW client, I can tell you Blizzard uses SRP6 [1] for authentication. You'd have to really try hard to be storing anything other than a hash on the backend. 1. http://srp.stanford.edu/design.html

Oh wow, I wasn't aware of that. So the password (or a hash of it) never leaves the client, so an eavesdropper can never get any information? That's very interesting.

It looks like both parties end up with a session key, too, which is an added bonus.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#48

Post by StavrosK »

ChuckMcM wrote: post #45

For a long time World of Warcraft accounts sold for more money on the black market than credit card numbers [1]. It was said that this was due to the fact that you could make money using those accounts (primarily through selling 'gold' or in game items) which could not get 'clawed back' by credit card companies. So having battle.net get hit is a pretty cherry target. That said, what is the current crack rate for SRP…

> That said, what is the current crack rate for SRP on a GPU for 7, 8 and 10 character passwords?

If I understand the thing I just first heard about ten seconds ago, SRP is a protocol, not a hash. The passwords are hashed using some hash method, maybe SHA or bcrypt.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#49

Post by lawnchair_larry »

RKearney wrote: post #20
swang wrote: post #4

"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we curren…

I believe Blizzard makes you supply a scanned copy of your state issued identification in order to get a password reset.

No, that is only if you fail the hint question. If you don't know the hint question, they revert to scanned ID. Tried it a few weeks ago.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#50

Post by StavrosK »

DigitalSea wrote: post #19

This is ridiculous. Maybe the world is ending, because it feels like every major website/provider of some popular service is getting hacked these days. A company of Blizzard's stature and wallet size has no excuse for this kind of thing happening, no excuse at all. If you're charging people exorbitant amounts of cash to buy your games and then charging some of your customers a fee for the privilege of using your so-c…

Well, they're using SRP for authentication, which I didn't know about (and I don't consider myself especially illiterate when it comes to security), so it doesn't sound like they don't care about it.
Post reply on HN