So why am I finding out about this via HN/Kotaku? Why haven't I gotten an email from Blizzard yet? I haven't logged into my Battle.net account in the past few days, so maybe they're alerting people on login, but you know, a lot of people don't have the time to game every day, or even every week. An email alerting me to the need to change my password would be appreciated.
Blizzard Network Breached; Change Your Battle.Net Passwords
101–110 of 164 posts
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#102Earlier quoted context omitted.
Blizzard is _literally_ under _constant_ attack and has an incredible security team in place. Obviously the only acceptable result is 100% attack deflection, but the idea that this could be or could have been anything short of an absolute top priority for the company is a ridiculous assertion that I'd expect on any other site, but not HN. I'm a former Blizzard employee with knowledge of the situation and internal wor…
Not speaking for the security team, how likely would it be that this was an attack using reused passwords from another website? How likely, specifically, is it that someone got into one or multiple employee accounts, found the admin console password lying around (or in an onboarding email that wasn't deleted, or in chat logs), and then accessed the internal admin site? The list of what was taken looks like it's strai…
I imagine something like you describe would have resulted in a different subset of information being compromised.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#103Earlier quoted context omitted.
Security has nothing to do with preventing the attack, it's more so protecting the data much like a bank protects it's assets. It's pretty easy to break into a bank (they're merely glass and brick after all), but there is no way you're getting into that vault once inside and even so, if you get into the vault there are secondary security procedures in place to ensure that nothing is easily taken. So regardless of whe…
Just curious, are you actually a data security professional? Because while you have a very nice metaphor with the whole bank vault thing, you haven't offered any actual examples, or any specific criticisms of Blizzard's setup (not that we know what it was), or even examples of what you're talking about. I know nothing about data security myself, but I'm not exactly learning anything about it from your posts. Sorry to…
I may or may not be a data security professional, but I hardly see how that would make anything I've said more or less credible. Without knowing how Blizzard have set up their infrastructure, I can't really give any examples because each environment is different and requires different forms of security and protocols in place.
While Blizzard were apparently using SRP and while I can't say for sure I am guessing Blizzard are using the SRP authentication algorithm out-of-the-box which is bad for a number of reasons, but the main one being SRP by default is an over-glorified way of SHA1 encrypted and salting a password and by the sounds of it the hackers were able to access those salts and could theoretically brute force the passwords which by todays hardware capabilities is not very hard at all, this is LinkedIn all over again.
Take a look at the SRP design specification: http://srp.stanford.edu/design.html - if Blizzard didn't modify the algorithm, I think we've yet to see the full effects of this breach. LinkedIn learned the hard way and now one of the worlds largest multiplayer gaming companies is about to find out what a simple mistake like this can do. I hope for their sakes they customised SRP and if they didn't, I think we have the right to know.
As a Battle.net account holder, I have the right to voice my concerns about this. I paid money for the privilege of playing Blizzard's games - fortunately my Battle.net password is separate to that of any other account I have, but I feel sorry for the millions who re-use their password for their email accounts, Internet banking and other various accounts that could have all kinds of effects.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#104So why am I finding out about this via HN/Kotaku? Why haven't I gotten an email from Blizzard yet? I haven't logged into my Battle.net account in the past few days, so maybe they're alerting people on login, but you know, a lot of people don't have the time to game every day, or even every week. An email alerting me to the need to change my password would be appreciated.
I know that marketing messages can take days to weeks to send out because of the incredible number of customers Blizzard has (and avoiding being flagged as spam an other considerations). It may be that an e-mail has started going out, but in the meantime the website and game launcher have been updated with messaging and Kotaku/WoW Insider/etc. is a pretty good way to get info to Blizzard's core player base.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#105So I went to update my password for my World of Warcraft account after I saw this. And guess what I discovered, my current password is more secure than their current password policy will allow. So I filled out a support ticket with the following question (which all Blizzard account holders should ask them) I was wondering why even after you discovered a security breach you have not updated your password policy to act…
Note that e.g. BCrypt has a maximum passphrase length of 56 characters.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#106Earlier quoted context omitted.
I think a good balance between usability and security is to normalize the answer (discard case, punctuation, etc) and then hash it.
My favorite security answer is "@#¤ß$ä#$&%^$" so please don't discard case or punctuation. (Yes, I design these answers virtually impossible to brute-force even for myself.)
I too use a random and unique Secret Answer each time I am prompted for one. The Rackspace people, who require the account's SQ/SA before they push you through to the real support people, think I'm weird.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#107Probably explains why the credit card I used there was canceled. Last time was a few months ago for Steam.
Hackers play games. Hackers hack game companies.
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#108"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we curren…
Wow, my secret question is "Who was your first employer?" How is the answer to that even a secret?! Did I pick that or did they?
You're supposed to randomize characters and put them in so that more than 32 chars are there. Am I the only person in the world who does this?
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#109SRP is great at many things, but terrible at securing the server-side password database from brute force attacks. A quick look at http://srp.stanford.edu/design.html and http://srp.stanford.edu/demo/demo.html and you can see that SRP uses simple SHA1 plus a Salt to store the hashed passwords. With the hashes and salts stolen, please assume your password has been brute forced by the attacker (1 billion hashes per seco…
They use SHA1, although they make a couple of tweaks. I've implemented the bnet login stuff (https://github.com/Strilanc/Tinker/blob/master/Bnet/ClientCr...).
Re: Blizzard Network Breached; Change Your Battle.Net Passwords
#110Earlier quoted context omitted.
> Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext? I would hazard a guess that most sites store "Secret Questions/Answers" in plain text, or a two-way hash (that their support app reverses), as they are used to confirm identity along with the basics (DOB, address, email, etc).
They can confirm identity with a one-way hash - the only reason I could think of not supporting this would be fuzzy matching.
You could still do fuzzy matching with a one-way hash, you would just have to generate the fuzz beforehand. Create ten or twenty strings which you will also accept and hash and store them all.