Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubisoft hacked, account data compromised

support.ubi.com

Post reply on HN
Print view View original

51–60 of 104 posts

Re: Ubisoft hacked, account data compromised

#51

Post by wmf »

dclowd9901 wrote: post #4

I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.

This is what happens when companies try to own the customer relationship and use their own customers as strategic weapons. Steam isn't a neutral party.

Re: Ubisoft hacked, account data compromised

#52

Post by engtech »

codereflection wrote: post #2

I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.

I was happy that they included the "you should change your password on all other websites if it is the same" line.

I find that's the biggest hurdle that average users can't grasp, it's not about one website getting hacked.. it's that if your ubisoft password is the same as your email address password then they can now log into your email address, which means they can probably take over every online account you have.

Re: Ubisoft hacked, account data compromised

#53

Post by mattmanser »

andrewmunsell wrote: post #44
cookiecaper wrote: post #17

Earlier quoted context omitted.

No one encrypts passwords. They just refer to one-way hashes, typically MD5, as encryption.

Unfortunately, I have to disagree. In fact, there are some large vendors of software that truly use encryption instead of some form of one way hashing. Sadly, I have to deal with software like this and there's no chance it's going to change any time soon.

It's a built-in feature of ASP.Net's membership provider (user accounts for those not knowing MS's Enterprise Obfuscation Naming And Extension Standard).

Re: Ubisoft hacked, account data compromised

#54

Post by rocky1138 »

Everlag wrote: post #16
psycr wrote: post #7

Let's play the guessing game: by "encrypted" they mean MD5'd?

By encrypted they probably mean they applied the most potent of all cryptographic techniques: base64 encoding!

It would be hilarious if this is what it was and hackers couldn't figure it out and abandoned the hack because they're trying all these advanced techniques and none of it is working.

Re: Ubisoft hacked, account data compromised

#55

Post by deelowe »

zachlatta wrote: post #47
deelowe wrote: post #45

Earlier quoted context omitted.

Why don't you like lastpass? Genuinely curious. I've been pretty happy with them.

Mostly because the interface is clunky and I'd rather not be forced to have my passwords stored on a company's servers.

Ahh. OK. One small nit. Passwords aren't stored, the has is. If you forget your lastpass password, there's no way to retrieve them. I'm OK with this, which is why I continue to use lastpass.

That said, the interface is definitely terrible. It could use a refresh at this point.

Re: Ubisoft hacked, account data compromised

#56

Post by andybak »

biot wrote: post #39
dclowd9901 wrote: post #4

I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.

That's a pretty lousy, defeatist attitude to have. "Girls, stop trying to be as good at math as boys -- you won't." "Google, stop trying to do better than AltaVista/HotBot/Lycos/Excite -- you won't." "Apple/Linux, stop trying to do better than Microsoft -- you won't." "PlayStation/Xbox, stop trying to do better than Nintendo -- you won't." "Tesla, stop trying to do better than Toyota -- you won't." "Renewable energy…

"User-hostile dinosaur companies. Stop trying to do better than..." Oh wait.

Re: Ubisoft hacked, account data compromised

#57

Post by codereflection »

zachlatta wrote: post #49
codereflection wrote: post #22

Earlier quoted context omitted.

Dashlane is pretty nice, I'm using it and RoboForm, which I've owned for years.

How is RoboForm? I've never used them before.

Showing it's age. They continue to update it, but it's definitely lacking in usability compared to Dashlane.

Re: Ubisoft hacked, account data compromised

#58

Post by codereflection »

deelowe wrote: post #55
zachlatta wrote: post #47

Earlier quoted context omitted.

Mostly because the interface is clunky and I'd rather not be forced to have my passwords stored on a company's servers.

Ahh. OK. One small nit. Passwords aren't stored, the has is. If you forget your lastpass password, there's no way to retrieve them. I'm OK with this, which is why I continue to use lastpass. That said, the interface is definitely terrible. It could use a refresh at this point.

Dashlane's interface is really nice compared to Lastpass & RoboForm

Re: Ubisoft hacked, account data compromised

#59

Post by just2n »

quaunaut wrote: post #26
zachlatta wrote: post #13

Earlier quoted context omitted.

Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?

There's no reason to limit the length of passwords whatsoever, except perhaps to be sure you're not trying to hash 20mb of text.

You could really support an arbitrary password size by locally hashing the password to a length at least as long as the one you store in the database to preserve entropy, then send the fixed length hash as the user's "password", and hash it again on the server using something slower, like PBKDF2 with a few thousand rounds.

Re: Ubisoft hacked, account data compromised

#60

Post by xyzzyz »

daeken wrote: post #36
eranation wrote: post #10

To add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and typed my email. Usually, security best practices say that you should not volunteer any information for a potential attacker, e.g. don't tell the user if an email was sent or not, as this can be used for example to eventually construct a list of all their user's em…

I'm going to speak strongly against the prevailing view in the security community here: a forgot password email/username oracle is not an issue . Not in any way, shape, or form. Why? Because if I go to register an account with a given email or username, it's going to tell me if that account is already registered! Unless you make multiple accounts with a given username/email possible (please, please don't do that), th…

How about this: when you register an account with an already existing email, the website returns the same message as it would if the email didn't already exist: "The account have been created, but needs to be activated. Click on the link in the activation email that has been sent to your email address.". Now, the email that is actually sent says "Someone tried to create an account with your email address. If it was you, we remind you that you already have an account at our website". If the email does not exist, then usual activation email is sent.

This way, we don't leak the emails of registered users. If we use emails as usernames, we don't leak usernames either.

Post reply on HN