Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard Network Breached; Change Your Battle.Net Passwords

kotaku.com

Post reply on HN
Print view View original

141–150 of 164 posts

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#141

Post by gizzlon »

cookiecaper wrote: post #106
pestaa wrote: post #74

Earlier quoted context omitted.

My favorite security answer is "@#¤ß$ä#$&%^$" so please don't discard case or punctuation. (Yes, I design these answers virtually impossible to brute-force even for myself.)

I too use a random and unique Secret Answer each time I am prompted for one. The Rackspace people, who require the account's SQ/SA before they push you through to the real support people, think I'm weird.

I just mash my keyboard for 10 seconds if I have to supply one.

But now I wonder if "A bunch of random characters" would be accepted as the answer.. >(

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#142

Post by gizzlon »

elithrar wrote: post #13
famousactress wrote: post #9

Earlier quoted context omitted.

Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext?

> Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext? I would hazard a guess that most sites store "Secret Questions/Answers" in plain text, or a two-way hash (that their support app reverses), as they are used to confirm identity along with the basics (DOB, address, email, etc).

> a two-way hash (that their support app reverses)

Isn't that just encryption?

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#143

Post by stipes »

dsl wrote: post #43

From my time reverse engineering the WoW client, I can tell you Blizzard uses SRP6 [1] for authentication. You'd have to really try hard to be storing anything other than a hash on the backend. 1. http://srp.stanford.edu/design.html

Down-thread [1], someone claims to have found SRP to be about 172 times slower than SHA1 on CPU due to the modular exponentiation and other overhead.

Some numbers run by zaroth (down-thread) [2] show that we could see 100k 1024-bit modular exponentiations per second on a new Intel Core i7 with the cryptography extensions. A 2011 implementation paper [3] had about 20k 1024-bit RSA decryptions per second on a GTX260 using Montgomery exponentiation, so it doesn't seem like using the GPU has that much benefit for performing modular exponentiation. I haven't had time to figure out an estimated price/attempt for SRP, so it's hard to compare to the existing SHA1 figures [4].

Still, if we take the 100k/second figure for modular exponentiation (extrapolated from the number of cycles per 1024-bit modexp on a Core i7), versus the 5B/s for SHA1 on a single GPU, being 50000 times slower than the best SHA1 speeds seems pretty good to me.

1. http://news.ycombinator.com/item?id=4365079

2. http://www.opine.me/blizzards-battle-net-hack/

3. http://trone.di.fc.ul.pt/images/e/e2/ASAP11-paper.pdf

4. http://golubev.com/gpuest.htm

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#144

Post by zaroth »

mindslight wrote: post #112
zaroth wrote: post #94

SRP is great at many things, but terrible at securing the server-side password database from brute force attacks. A quick look at http://srp.stanford.edu/design.html and http://srp.stanford.edu/demo/demo.html and you can see that SRP uses simple SHA1 plus a Salt to store the hashed passwords. With the hashes and salts stolen, please assume your password has been brute forced by the attacker (1 billion hashes per seco…

I haven't studied SRP, but a quick look at it and it seems that one also needs to perform the v = g^x. While still vulnerable to brute forcing due to lack of entropy in a password, this is more expensive than bare SHA1. The opine.me post you linked elsewhere completely glosses this over. edit: okay, just to give you some very rough numbers from 'openssl speed' on my machine. 16 byte SHA1 is about 1M/sec. Projected ds…

Fixed the blog to give more credence to the ME op. Thanks for the great discussion mindslight & tedunangst.

I'm not trying to be sensationalist, but I think it's bullshit that Blizzard is saying SRP makes it "computationally very difficult and expensive" to extract the passwords from the stolen verified database.

Blizzard should come out and say, "the majority of our users' passwords have been stolen. If you have an extremely random password, you may be one of the few that were not cracked, but don't bet on it."

Just to keep the friendly banter going though, even Anandtech was getting better performance back in 2006 with his exponentiation: http://www.anandtech.com/show/2022/5

On EC2 c1.xlarge running AMI ami-ef5ff086 ($0.66 / hour):

./openssl speed rsa -multi 8

rsa 512 bits 54663.2 sign/s

rsa 1024 bits 10709.9 sign/s

./openssl speed dsa -multi 8

dsa 512 bits 56011.1 sign/s

dsa 1024 bits 20449.8 sign/s

So $100 would buy you... about 100 billion guesses?

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#145

Post by coldarchon »

swang wrote: post #4

"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we curren…

I haven't even found a link to change my personal security question, if it was hacked, my account is doomed now no matter if I change my password ..

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#146

Post by riffraff »

Splines wrote: post #125
RKearney wrote: post #20

Earlier quoted context omitted.

I believe Blizzard makes you supply a scanned copy of your state issued identification in order to get a password reset.

This sort of thing kind of bothers me. Is Blizzard in the business of verifying state-issued identification? What prevents me from photoshopping my target's name on top of my own ID?

I'm not sure how ID cards work across the globe but usually they have some code on them that is supposed to be unique.

So you would have to scan your name _and_ the other data, which you would not trivially know.

(Yes, I understand that there are ways to get those too)

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#147

Post by LOLvis »

hanapbuhay wrote: post #36

Here's some detailed information on what happened [1]. A press release from Mike Morhaime [2]. Also, they're currently working on allowing users update their secret question and answers [3]. [1]: http://us.battle.net/support/en/article/important-security-u... [2]: http://us.blizzard.com/en-us/securityupdate.html [3]: http://us.battle.net/support/en/blog/6940803

Until the secret-answer fix is ready, users are advised to change their the names of their first pets and/or favorite teachers.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#148

Post by wlievens »

dkokelley wrote: post #15
famousactress wrote: post #9

Earlier quoted context omitted.

Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext?

Possibly. I've been on phone support with companies that require me to tell them answers to my security questions. Also, automatic security question checking would require support for soft matches like capitalization or punctuation. You could simplify the data before hashing (strip special chars and convert to lower case), or store multiple hashes to each variant. I really wish a lot more work went in to security que…

> The recent iCloud breach makes me believe that in many cases the "security questions" practice is by far the weakest link in modern web authentication.

Isn't that how the Sarah Palin thing happened?

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#149

Post by wlievens »

smsm42 wrote: post #69
dhimes wrote: post #42

Earlier quoted context omitted.

Of course, your answer should NEVER match the question. But that's beside the point. "Whose was your favorite high school teacher?" -Pecan pie.

The only problem is that in 5 years you'd have no idea what you answered there. And that's exactly when you'd need it.

Yeah, unless you do it consistently everywhere, which again defeats the purpose.

Maybe you could do something like consistently answer the previous question from the dropdown?

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#150

Post by ZoFreX »

Steko wrote: post #51
duaneb wrote: post #33

Earlier quoted context omitted.

They're needlessly limiting it. There's nothing wrong with making the limit, say, 256 characters. It's just bad security.

"It's just bad security." In general maybe but if you have safeguards in place such that 16 character passwords can't be bruteforced than you don't gain much by going to 256. Every hack/stolen account I've ever heard about was spoof login/keylogger/MITM, social or same p/w from another service that kept it in plaintext. I'd guess some people just got hacked because they use the most common p/w's ("12345678", etc.). 2…

> if you have safeguards in place such that 16 character passwords can't be bruteforced than you don't gain much by going to 256

Yes, right until the day your database gets accessed by intruders and they steal all your hashes for fast offline cracking. Which just happened.

Post reply on HN