31–40 of 104 posts
Earlier quoted context omitted.
Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
No. A potential common excuse may be, "No one will remember a secure password in excess of 16 characters, we are trying to minimize support volume", but this is not a "reasonable" excuse.
Let's play the guessing game: by "encrypted" they mean MD5'd?
I received an email from them - the password was included in the email, in plaintext. So I don't know exactly what they mean, but it's at best symmetric encryption.
I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
I have mixed feelings about that. On the one hand, I fully agree - I hate having all kinds of junky game clients running on my computer when I ought to just be able to have one, Steam, which is obviously doing a decent job. On the other hand, I think that competition will drive Steam to be better (or maybe, just maybe, result in something better than Steam), and so I don't necessarily want the other companies to stop…
It'll be exciting when the fogies in charge of these companies die out. They seem to have difficulty grasping the concept of computers and digital distribution.
can someone please make a hall of shame for all the big Companies which where hacked! i think there are quite a lot by now.
To add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and typed my email. Usually, security best practices say that you should not volunteer any information for a potential attacker, e.g. don't tell the user if an email was sent or not, as this can be used for example to eventually construct a list of all their user's em…
Why? Because if I go to register an account with a given email or username, it's going to tell me if that account is already registered! Unless you make multiple accounts with a given username/email possible (please, please don't do that), the forgot password oracle is a non-issue.
You lose absolutely nothing by saying "this email does not exist", and you gain a tremendous amount of user friendliness.
I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
I have mixed feelings about that. On the one hand, I fully agree - I hate having all kinds of junky game clients running on my computer when I ought to just be able to have one, Steam, which is obviously doing a decent job. On the other hand, I think that competition will drive Steam to be better (or maybe, just maybe, result in something better than Steam), and so I don't necessarily want the other companies to stop…
If either of those companies wants to make a real effort at getting a distribution platform off the ground by competing with Steam on the developer side and the pricing side, then that's competition I'm willing to see. As it stands, they're simply trying to leverage their developers' work into membership.
Earlier quoted context omitted.
No. A potential common excuse may be, "No one will remember a secure password in excess of 16 characters, we are trying to minimize support volume", but this is not a "reasonable" excuse.
Yes. It's a DoS vector. The question is, what is a reasonable limit - and 16 characters fails horribly in that section.
I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
"Girls, stop trying to be as good at math as boys -- you won't."
"Google, stop trying to do better than AltaVista/HotBot/Lycos/Excite -- you won't."
"Apple/Linux, stop trying to do better than Microsoft -- you won't."
"PlayStation/Xbox, stop trying to do better than Nintendo -- you won't."
"Tesla, stop trying to do better than Toyota -- you won't."
"Renewable energy companies, stop trying to do better than fossil fuels -- you won't."
Earlier quoted context omitted.
Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.
The Steam forums were hacked in Nov 2011. The hackers got access to a DB with Steam users' personal information. http://arstechnica.com/gaming/2011/11/valve-confirms-steam-h...
No company is immune from hacking, the best anyone can hope for is secure hashing functions are in place and that financial and user account data are properly separated.