Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard Network Breached; Change Your Battle.Net Passwords

kotaku.com

Post reply on HN
Print view View original

131–140 of 164 posts

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#131

Post by warp »

duaneb wrote: post #117
dhimes wrote: post #78

Earlier quoted context omitted.

Actually, you often get to pick your question. If they don't hash the answer, however, you're screwed. It seems doable to me: drop on non alphanumeric (or something), split on whitespace, trim, lowercase, put back together. It beats the hell out of putting in the "right," googleable, answer. Sarah Palin can attest to that.

The only company I use that allows me to pick my security question is google. Apple doesn't, my bank definitely doesnt.

At appleid.apple.com I can pick from a list of 15 security questions or use a custom one.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#132

Post by mindslight »

zaroth wrote: post #128
zaroth wrote: post #114

Earlier quoted context omitted.

Please read the RFC, it's right here: http://www.ietf.org/rfc/rfc2945.txt Password entries are generated as follows: = random() x = SHA( | SHA( | ":" | )) = v = g^x % N G = 47 N = 112624315653284427036559548610503669920632123929604336254260115573677366691719 What was stolen was no better than LinkedIn hashes -- for the purposes of dictionary attacking the database

Define slow tedunangst - Big O notation please. Maybe you can look here: http://en.wikipedia.org/wiki/Modular_exponentiation . Ok, I'll save you the trouble -- the modular exponentiation is O(log exponent). That's log as in... FAST.

What's the Big-O of PBKDF2 ?

Constants matter.

(Also, computational complexity of crypto algorithms is usually specified in terms of nbits, not numeric magnitude)

(Although this argument has given me an idea for everyone that thinks using the same password on different sites is reasonable - a browser extension that runs a client-side KDF :P)

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#133

Post by duaneb »

duaneb wrote: post #117
dhimes wrote: post #78

Earlier quoted context omitted.

Actually, you often get to pick your question. If they don't hash the answer, however, you're screwed. It seems doable to me: drop on non alphanumeric (or something), split on whitespace, trim, lowercase, put back together. It beats the hell out of putting in the "right," googleable, answer. Sarah Palin can attest to that.

The only company I use that allows me to pick my security question is google. Apple doesn't, my bank definitely doesnt.

Strange - I have only preset questions.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#134

Post by tedunangst »

zaroth wrote: post #128
zaroth wrote: post #114

Earlier quoted context omitted.

Please read the RFC, it's right here: http://www.ietf.org/rfc/rfc2945.txt Password entries are generated as follows: = random() x = SHA( | SHA( | ":" | )) = v = g^x % N G = 47 N = 112624315653284427036559548610503669920632123929604336254260115573677366691719 What was stolen was no better than LinkedIn hashes -- for the purposes of dictionary attacking the database

Define slow tedunangst - Big O notation please. Maybe you can look here: http://en.wikipedia.org/wiki/Modular_exponentiation . Ok, I'll save you the trouble -- the modular exponentiation is O(log exponent). That's log as in... FAST.

slow == 172.959 times slower than sha1("password")

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#135

Post by tedunangst »

zaroth wrote: post #129
tedunangst wrote: post #123

Earlier quoted context omitted.

Whatever logic you are using to prove that performing g^x is the same as computing plain sha1 would also prove that bcrypt and pbkdf2 are no better than sha1.

v = g^x % N Finding 'x' given g, v, and N is HARD. Calculating g^x is EASY. O(log X) This is crypto 101 man... This is why SRP is said to be verifier based and not password or password-equivalent based, because you cannot retrieve X from v. But this is ALSO why the CREATOR of SRP Thomas Wu specifically states in his presentations on SRP that it does not resist dictionary attacks when the verifier database is stolen.

Your point is taken, but saying "you cannot retrieve X from v" in a thread about doing exactly that is kind of funny. :)

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#136

Post by comex »

DigitalSea wrote: post #103
mojowo11 wrote: post #71

Earlier quoted context omitted.

Just curious, are you actually a data security professional? Because while you have a very nice metaphor with the whole bank vault thing, you haven't offered any actual examples, or any specific criticisms of Blizzard's setup (not that we know what it was), or even examples of what you're talking about. I know nothing about data security myself, but I'm not exactly learning anything about it from your posts. Sorry to…

I may or may not be a data security professional, but I hardly see how that would make anything I've said more or less credible. Without knowing how Blizzard have set up their infrastructure, I can't really give any examples because each environment is different and requires different forms of security and protocols in place. While Blizzard were apparently using SRP and while I can't say for sure I am guessing Blizza…

Would you mind stating what weaknesses you see in the unmodified SRP? Against a server compromise it's equivalent to salted hash storage, but it's impossible, in general, to do better without losing the ability to authenticate using the password (only).

Edit: do you mean the weakness of salted SHA-1? SRP is not defined for SHA-1 only.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#137

Post by tedunangst »

zaroth wrote: post #114
thechut wrote: post #99

Earlier quoted context omitted.

SRP is supposed to make use of multiple types of entropy to ensure the passwords are far more complicated that salted SHA1. While I agree it's possible that the attackers also got this information but I don't think we can jump to conclusions about the overall security of the passwords until more information is known.

Please read the RFC, it's right here: http://www.ietf.org/rfc/rfc2945.txt Password entries are generated as follows: = random() x = SHA( | SHA( | ":" | )) = v = g^x % N G = 47 N = 112624315653284427036559548610503669920632123929604336254260115573677366691719 What was stolen was no better than LinkedIn hashes -- for the purposes of dictionary attacking the database

Actually, I forgot one minor thing. LinkedIn hashes were unsalted. Even assuming SRP is no better than sha1, cracking all of the battle.net passwords is going to be $number_of_users times harder than LinkedIn.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#138

Post by zaroth »

tedunangst wrote: post #135
zaroth wrote: post #129

Earlier quoted context omitted.

v = g^x % N Finding 'x' given g, v, and N is HARD. Calculating g^x is EASY. O(log X) This is crypto 101 man... This is why SRP is said to be verifier based and not password or password-equivalent based, because you cannot retrieve X from v. But this is ALSO why the CREATOR of SRP Thomas Wu specifically states in his presentations on SRP that it does not resist dictionary attacks when the verifier database is stolen.

Your point is taken, but saying "you cannot retrieve X from v" in a thread about doing exactly that is kind of funny. :)

Right :-) Brute force is 'hard' - dictionary is not.

Calculating 'v' is a bit harder than SHA1 - there is a lot of research on performance of modular exponentiation since it is the foundation of crypto, but most of the current benchmarks are at 1024 or 2048 bit N.

Given that we have a mere 256-bit N, it looks like between 10k - 100k operations / sec is achievable with a modest budget. I should go benchmark this on Google Compute or EC2 GPU, but I need to sleep at some point.

Intel released a benchmark here: http://download.intel.com/design/intarch/PAPERS/324952.pdf claiming they can do 1024-bit ME in 2m cycles, and 512-bit ME in 250k cycles on an i7-2600. Assuming that means you can do 256-bit ME in 32k cycles, that's 100k / sec at 3.4GHz.

So an attacker takes a dictionary with 100k passwords in it (or just the top 10k, that works almost as well...) and tests them for each { username, salt, v }.

If you can do 100k tests per second, you can test 100k passwords for 100k users (10B tests total) in a little over a day. You won't successfully crack every password, but a well formed dictionary with top 100k passwords will crack a majority of them.

So don't tell me it's too slow to dictionary attack, ok?! :-)

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#139

Post by Dylan16807 »

tedunangst wrote: post #127
david_shaw wrote: post #57

Earlier quoted context omitted.

Rather than doing this by hand via Firebug/Chrome Inspect Element, it might be worth looking into creating a quick Chrome Extension or Firefox Add-On (or even a userscript) to do this for you. I understand the initial rationale behind not allowing you to paste a password: (1) Pasting a password can allow a malicious user to find your password somewhere and paste it in (as it would take much more time to type by hand)…

(3) you type your intended password wrong, copy it, paste it, and lock yourself out. The sites make you type the password twice is to make sure you did it right. People who can't be bothered to type a password twice are probably heavily intersecting with people who didn't type it right the first time.

And that is a good reason to stop copy, rather than paste.
Post reply on HN