Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubisoft hacked, account data compromised

support.ubi.com

Post reply on HN
Print view View original

21–30 of 104 posts

Re: Ubisoft hacked, account data compromised

#22

Post by codereflection »

zachlatta wrote: post #14
codereflection wrote: post #2

I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.

I've been looking for a Lastpass alternative forever. Had no idea Dashlane existed, thanks!

Dashlane is pretty nice, I'm using it and RoboForm, which I've owned for years.

Re: Ubisoft hacked, account data compromised

#23

Post by pmh »

Zikes wrote: post #6
dclowd9901 wrote: post #4

I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.

Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.

The Steam forums were hacked in Nov 2011. The hackers got access to a DB with Steam users' personal information.

http://arstechnica.com/gaming/2011/11/valve-confirms-steam-h...

Re: Ubisoft hacked, account data compromised

#26

Post by quaunaut »

zachlatta wrote: post #13
Zikes wrote: post #6

Earlier quoted context omitted.

Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.

Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?

There's no reason to limit the length of passwords whatsoever, except perhaps to be sure you're not trying to hash 20mb of text.

Re: Ubisoft hacked, account data compromised

#27

Post by kcbanner »

FredFredrickson wrote: post #9
dclowd9901 wrote: post #4

I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.

I have mixed feelings about that. On the one hand, I fully agree - I hate having all kinds of junky game clients running on my computer when I ought to just be able to have one, Steam, which is obviously doing a decent job. On the other hand, I think that competition will drive Steam to be better (or maybe, just maybe, result in something better than Steam), and so I don't necessarily want the other companies to stop…

I agree. However, in every current case Steam is just making all these other platforms look bad.

Re: Ubisoft hacked, account data compromised

#30

Post by 286c8cb04bda »

eksith wrote: post #5
codereflection wrote: post #2

I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.

As an alternative, you could GPG a text file with all passwords and use... hexdump -n 16 -v -e '/1 "%02X"' /dev/urandom ...as a password generator

    openssl rand 48 -base64
Post reply on HN