16 character max password with no special characters allowed.
.. Are you people high or something? This is 2012, when every major provider has been owned at least once. Not AOL circa 1995. Get with the program, Blizzard!
Blizzard Network Breached; Change Your Battle.Net Passwords
81–90 of 164 posts
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#82For a long time World of Warcraft accounts sold for more money on the black market than credit card numbers [1]. It was said that this was due to the fact that you could make money using those accounts (primarily through selling 'gold' or in game items) which could not get 'clawed back' by credit card companies. So having battle.net get hit is a pretty cherry target. That said, what is the current crack rate for SRP…
> That said, what is the current crack rate for SRP on a GPU for 7, 8 and 10 character passwords?
That is a really good question, SRP is actually pretty serious. Based on the small amount I know about SRP, a simple rainbow table brute force attack would take a VERY VERY long time per hash; even on an extremely fast multiple gpu rig. Somebody with more specific knowledge about SRP could probably calculate an exact number.
However, since they have stolen other information (perhaps even some, like the modifier, salt or modulo data, that they have not disclosed) they could possibly create a more advanced and targeted rainbow table attack which would greatly reduce the time it would take per account.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#83How is a breach like this detected and how would they determine what data was accessed? How likely is is that that other sites on the internet are breached but don't detect it? If the answer is too long and you could recommend a book or website I could read up on this topic, that would be awesome.
Breach is generally detected in one of two ways - information is sold and that leads to scrutiny when users write in, and/or you have auditing mechanisms (ip geolocation, for example) which points out behavior that does not seem to be correct.
Once you see this, you run through a full audit of all of your accesses, searching for things that don't fit a pattern. Logins of your admins — did they login at some time that they don't usually? Was there a login from a Russian/Chinese/Unusual IP? Did someone go into something they usually shouldn't? It's not an exact science, which is why it's really hard to do — you may never be sure what exactly was compromised.
Finally, how likely it is that other sites are breached: highly likely. The problem is that when you have leaked email/passwords, there's a large number of people that reuse passwords, and those people can be working at Blizzard, banks, or other companies. Unless they have proactive intrusion detection scanning in place, you don't know until after they've come in, looked at what they wanted to, and left.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#84This is ridiculous. Maybe the world is ending, because it feels like every major website/provider of some popular service is getting hacked these days. A company of Blizzard's stature and wallet size has no excuse for this kind of thing happening, no excuse at all. If you're charging people exorbitant amounts of cash to buy your games and then charging some of your customers a fee for the privilege of using your so-c…
Blizzard is _literally_ under _constant_ attack and has an incredible security team in place. Obviously the only acceptable result is 100% attack deflection, but the idea that this could be or could have been anything short of an absolute top priority for the company is a ridiculous assertion that I'd expect on any other site, but not HN. I'm a former Blizzard employee with knowledge of the situation and internal wor…
Not speaking for the security team, how likely would it be that this was an attack using reused passwords from another website?
How likely, specifically, is it that someone got into one or multiple employee accounts, found the admin console password lying around (or in an onboarding email that wasn't deleted, or in chat logs), and then accessed the internal admin site? The list of what was taken looks like it's straight from what a Support Rep would need to deal with password resets, OTPs, etc.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#85"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we curren…
Wow, my secret question is "Who was your first employer?" How is the answer to that even a secret?! Did I pick that or did they?
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#86This is ridiculous. Maybe the world is ending, because it feels like every major website/provider of some popular service is getting hacked these days. A company of Blizzard's stature and wallet size has no excuse for this kind of thing happening, no excuse at all. If you're charging people exorbitant amounts of cash to buy your games and then charging some of your customers a fee for the privilege of using your so-c…
Blizzard operates in a free market. Average consumers don't care that much about security until something happens, then they forget. Therefore, security isn't a priority to Blizzard. It is really as simple as that.
Blizzard doesn't exactly target "average consumers". Many WoW players are very serious gamers, and StarCraft is played for $$$.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#87Earlier quoted context omitted.
Did you really just insinuate that banks never get robbed?
I didn't say that at all. I said it's easy to break into a bank but getting into a vault in this day and age is impossible. And if you somehow by luck or knowledge get into the vault there are secondary, third, etc security procedures in place such as alarms, self-locking doors, cameras and heat/movement detectors. A database is a vault. It's for storing things you don't want anyone to be able to access and even if a…
This metaphor seems compelling, but it breaks down when you consider that in a digital break in, nothing physical must be moved. Were vault breaches like database breaches, one would merely have to look at the money to have a personal copy of it. This is a very different security scenario.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#88Earlier quoted context omitted.
I believe Blizzard makes you supply a scanned copy of your state issued identification in order to get a password reset.
This is only to remove an authenticator. I just changed my password and it didn't even send a confirmation email to confirm the change - it just changed it and sent me a notification email.
Reset password, not change password.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#89How can I change my security questions? I can't find them in the account settings.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#90Earlier quoted context omitted.
I think the bigger point is that a ton of signups use this question. Whether you say 'Mr. Smith' or 'Pecan Pie' isn't going to save you if you use it for all of them.
Actually, you often get to pick your question. If they don't hash the answer, however, you're screwed. It seems doable to me: drop on non alphanumeric (or something), split on whitespace, trim, lowercase, put back together. It beats the hell out of putting in the "right," googleable, answer. Sarah Palin can attest to that.
Getting to pick your own question in my experience is rare.
We've already gone over the possible reasoning for not hashing the answer.