can someone please make a hall of shame for all the big Companies which where hacked!
i think there are quite a lot by now.
Ubisoft hacked, account data compromised
11–20 of 104 posts
Re: Ubisoft hacked, account data compromised
#12I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
Relying on one service is good for no one. Specially consumers.
It's better for my hard drive and RAM. It's bad enough having just one program on my PC whose only purpose is to allow me to play the games I've purchased legitimately, I don't want any more.
It's also better for That One Service... but that's besides the point. ;-)
Re: Ubisoft hacked, account data compromised
#13I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.
Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
Re: Ubisoft hacked, account data compromised
#14I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.
I've been looking for a Lastpass alternative forever. Had no idea Dashlane existed, thanks!
Re: Ubisoft hacked, account data compromised
#15Earlier quoted context omitted.
Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.
Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
No.
A potential common excuse may be, "No one will remember a secure password in excess of 16 characters, we are trying to minimize support volume", but this is not a "reasonable" excuse.
Re: Ubisoft hacked, account data compromised
#16Let's play the guessing game: by "encrypted" they mean MD5'd?
By encrypted they probably mean they applied the most potent of all cryptographic techniques: base64 encoding!
Re: Ubisoft hacked, account data compromised
#17To add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and typed my email. Usually, security best practices say that you should not volunteer any information for a potential attacker, e.g. don't tell the user if an email was sent or not, as this can be used for example to eventually construct a list of all their user's em…
No one encrypts passwords. They just refer to one-way hashes, typically MD5, as encryption.
Re: Ubisoft hacked, account data compromised
#18Earlier quoted context omitted.
Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.
Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
None that wouldn't be better handled with a warning of "excessive password complexity, we're not sure you'll remember this". Even truncating all password entries (create/change and auth) and simply taking the used subset would be better than blocking me from using my intended password.
Re: Ubisoft hacked, account data compromised
#19can someone please make a hall of shame for all the big Companies which where hacked! i think there are quite a lot by now.
It shouldn't be a hall of shame for companies being hacked, getting hacked is thing you can only mitigate not prevent.
The shaming should be for storing your sensitive data in an insufficiently secure manner. If a company used scrypt to hash their passwords then they would essentially have no issue with getting hacked.
Re: Ubisoft hacked, account data compromised
#20Earlier quoted context omitted.
Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.
Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
The only reasonable restriction is in overall POST body length. I recall an exploit once on node.js where unreasonably large POST requests could DDOS a server with minimal effort.