Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard Network Breached; Change Your Battle.Net Passwords

kotaku.com

Post reply on HN
Print view View original

51–60 of 164 posts

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#51

Post by Steko »

duaneb wrote: post #33
Steko wrote: post #21

Earlier quoted context omitted.

Blizzard has numerous server side protections that prevent your lower case 16 character p/w from ever being brute forced. It's not that big of a deal.

They're needlessly limiting it. There's nothing wrong with making the limit, say, 256 characters. It's just bad security.

"It's just bad security."

In general maybe but if you have safeguards in place such that 16 character passwords can't be bruteforced than you don't gain much by going to 256. Every hack/stolen account I've ever heard about was spoof login/keylogger/MITM, social or same p/w from another service that kept it in plaintext. I'd guess some people just got hacked because they use the most common p/w's ("12345678", etc.). 256 characters wouldn't help any of those people

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#52

Post by BadassFractal »

DanBC wrote: post #40
MiguelHudnandez wrote: post #23

Earlier quoted context omitted.

I follow this in practice, but I always have to wonder: what if someone gets my password database and breaks it? It would only take a keylogging trojan to get everything they needed. I would be in for a world of hurt! Way worse than if a few of my accounts were compromised because I had used the same password. But still, the chances of being compromised are probably much smaller.

As mentioned by other people in other recent threads some good quality password safe programs work with Yubikey, so an attacker needs something you know (your password) and something you have (your Yubikey). I'd be interested in seeing some robust analysis of password safe software. But "Password safe" and "keepass" appear to be reputable. I'd also like a native, and trustworthy, password safe for OS X that can work…

Is Yubikey superior to something like Keepass/Lastpass/1password?

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#54

Post by natesm »

Steko wrote: post #29
natesm wrote: post #28

Earlier quoted context omitted.

Any password length limitation (within reason, not allowing a 1MB password is reasonable) says to me "we are not using hashes". That may or may not be the actual case, but it's the only reason I can think of for limiting password length. Hashes used for passwords have fixed lengths regardless of input, so any length password will "fit" in a database column. If you're using hashes, limiting the lengths of passwords is…

"That may or may not be the actual case" It is not the actual case so I guess your blanket assumption was completely wrong.

I'm not talking about Battle.net specifically. I'm talking about in general. That's merely the impression that a password length limit gives to me, on any site. Can you think of any another "rational" reason for limiting password length? I see two possibilities:

1. They're not using hashes.

2. They are using hashes, but they don't understand what that actually does, and that there's no reason to have a limit on input length. The passwords might be more secure, but it calls into question the general competency of their security (do they salt? per user?).

This also applies to character restrictions (no ____ characters). I can understand requiring at least N instances of a class of characters, but the entire UTF-8 character set should be valid input. If I want an emoji password, there's no reason to disallow it. bcrypt will be happy to take those bytes.

So, here's a comparison of site purposes and security practices. This is largely unrelated, but it gives better insight as to what I was talking about, not just making a random assumption about Battle.net (which I theoretically have an account at, but I don't really care about it anymore, I don't play video games anymore).

Chase is a bank. They handle money. They allow up to 32 character passwords, with no "special" (whatever that means) characters whatsoever.

Twitter is a social networking site. I have a 50 character password of various character types, because that's how far 1Password will go.

Bank of America is also a bank. Twenty characters. Twenty. Characters. And none of those are allowed to be "special".

Facebook is user for the same purpose Twitter. I have a 50 character password there as well.

Why do I trust social sites more than my banks? Security is so messed up.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#55

Post by suresk »

> and information relating to Mobile and Dial-In Authenticators were also accessed.

I don't know a ton about 2 factor auth implementation details, but I'm assuming that if you were able to access the serial # or whatever is used to uniquely identify an authenticator, you could generate valid tokens, essentially rendering the 2 factor auth useless?

If so, and if they were also able to access information about the key fob authenticators, that could be messy. Hopefully that isn't the case.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#56

Post by drucken »

csallen wrote: post #31
revx wrote: post #8

Earlier quoted context omitted.

This is why you never use the actual answer to that question, but actually a separate password for those.

That wouldn't help. For example, let's assume your question was, "Who was your favorite teacher growing up?" and your answer was "fish123jellybean456". If that answer is stored in plaintext (no encryption) in a database that's compromised, then it won't matter that it's not the "real" answer. Attackers will see it, and then use it to answer your security questions on other sites. The only way to protect against this…

For most people savy enough to use an arbitrary answer, it is because you can use a different one each time (with the very few exceptions where you may not be able, e.g. banks).

Offline portable password managers like Keepass/Password Safe/etc. are immense help for these non-bank services.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#57

Post by david_shaw »

barik wrote: post #34
duaneb wrote: post #18

Also, Blizzard has a 16-character password limit... seriously disappointing.

The 16-character limit is not as bothersome to me as the fact that they go out of their way to set onpaste="false" in their HTML, making even 16-character passwords annoying because the average user has to type it all in by hand. I will never understand the rationale for preventing me from pasting a strong password versus picking a weaker password that I have to type by hand. Currently, my workaround is to use "Inspe…

Rather than doing this by hand via Firebug/Chrome Inspect Element, it might be worth looking into creating a quick Chrome Extension or Firefox Add-On (or even a userscript) to do this for you.

I understand the initial rationale behind not allowing you to paste a password:

(1) Pasting a password can allow a malicious user to find your password somewhere and paste it in (as it would take much more time to type by hand).

This doesn't make any sense - as you pointed out, there are programmatic ways to avoid actually being unable to paste. Furthermore, a malicious user going through a password list would likely be using a command line interface or script, and not bothering with a GUI anyway. I'd call this issue completely moot.

(2) You could accidentally paste it somewhere else.

This has a little more value, but it doesn't come anywhere close to being a valid reason to disallow pasting. The security benefits of using a secure password manager (like KeePass or a TrueCrypt volume with a password list) are so much greater than Blizzard (or anyone) worrying about what you're going to do with your paste buffer.

The problem with putting any limitations on passwords that a user can use is that they almost always backfire. Sure, it might have made more sense when hashing algorithms crapped out after several characters, but in today's world those hashing algorithms shouldn't be used anyway.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#58

Post by untog »

dhimes wrote: post #42
danso wrote: post #25

Earlier quoted context omitted.

Well, that would be thhe reason, I think... Example: For: "Who was your favorite high school teacher." - Mr. Berners-Lee - Mr. Berners Lee - Tim Berners-Lee - Mr. Lee Never mind if you had two different teachers who were great, and you switch them interchangeably depending on whether you're in an English mood or a Music mood

Of course, your answer should NEVER match the question. But that's beside the point. "Whose was your favorite high school teacher?" -Pecan pie.

The point still stands, though. There is way, way too much potential variation to hash that stuff.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#59

Post by MiguelHudnandez »

BadassFractal wrote: post #52
DanBC wrote: post #40

Earlier quoted context omitted.

As mentioned by other people in other recent threads some good quality password safe programs work with Yubikey, so an attacker needs something you know (your password) and something you have (your Yubikey). I'd be interested in seeing some robust analysis of password safe software. But "Password safe" and "keepass" appear to be reputable. I'd also like a native, and trustworthy, password safe for OS X that can work…

Is Yubikey superior to something like Keepass/Lastpass/1password?

Yubikey works just like Google Authenticator, except it is a little more convenient to type in the code. (you touch a physical button on the dongle, and it types the code for you)

It does not actually save any passwords. It would replace Google Authenticator or an RSA SecurID FOB.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#60

Post by Steko »

natesm wrote: post #54
Steko wrote: post #29

Earlier quoted context omitted.

"That may or may not be the actual case" It is not the actual case so I guess your blanket assumption was completely wrong.

I'm not talking about Battle.net specifically. I'm talking about in general . That's merely the impression that a password length limit gives to me, on any site. Can you think of any another "rational" reason for limiting password length? I see two possibilities: 1. They're not using hashes. 2. They are using hashes, but they don't understand what that actually does, and that there's no reason to have a limit on inpu…

http://security.stackexchange.com/questions/17949/why-are-pa...

If you are to abide by CWE-521: Weak Password Requirements. Then all passwords must have a min and max password length.

There are two reasons for this. For one, hashing a large amount of data can cause significant resource consumption on behalf of the server and would be an easy target for Denial of Service. Especially if the server is using key stretching such as PBKDF2.

The other concerns is hash length-extension attacks or the prefixing attack against MD5. However If you are using a hash function that isn't broken, such as bcrypt or sha-256 and you aren't using an HMAC, then this shouldn't be a concern.

Post reply on HN