Diablo 3 bug report: "Passwords not case-sensitive." • Hacker News Board

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#141

Post by JackC » Fri, May 25, 2012, 3:14 PM UTC

bluecalm wrote: post #76

vibrunazo wrote: post #71

Complete security newbie here. Doesn't it make brute force attacks almost worthless when you just have a minimum time between each login request after too many attempts per IP ? So you can only try to login every 30sec after you've failed 10 times in a row? I thought brute-forcing logins were a thing of the past after people started implementing this min time between requests strategy. The only weakness I can imagine…

>Am I missing something silly? Yes. It's not that the bad guys try bruteforce to login multiple times and wait to be banned. They could (will/might) steal db with hashed passwords, do their decrypting at home and then login with what they got. The stronger the password (or better, ie slower to calculate hash used) the more time they need for that thus giving more time for Blizzard to realize passwords were compromise…

Besides the salt point others have made, I've also read (on HN) that rainbow tables aren't much use anymore because the speed/storage equation has changed. If your hashing mechanism is dumb enough not to use salts, it is also fast enough to calculate that there's no point doing it in advance.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#142

Post by pcwalton » Fri, May 25, 2012, 3:48 PM UTC

drivebyacct2 wrote: post #27

elithrar wrote: post #20

Earlier quoted context omitted.

> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…

I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume some (plausibly safe) ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do .

Convert to some canonical case on the client side before applying SRP. It's very easy.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#143

Post by scoot » Fri, May 25, 2012, 4:15 PM UTC

Is it completely beyond the bounds of possibility that they're storing the password as originally entered (salted & hashed), but trying all combinations of upper / lower case at login-time (only after the entered password fails)? It would only be for a small subset of logins, and for the majority of passwords, a manageable number of combinations (2^num-alpha-chars-in-passwd). I believe Facebook do something similar.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#144

Post by jackalope » Fri, May 25, 2012, 4:29 PM UTC

Pechtel wrote: post #140

jackalope wrote: post #109

Earlier quoted context omitted.

No. Usually, when I create a password I'm asked to verify it in the next text field. When I visit the login page and enter the exact same characters , I expect it to work. I shouldn't have to guess at my own password because some clever developer's algorithm decides that I made a mistake.

I've implemented this very thing for the same reason--it cuts down on user errors. The real answer to password security is length, not putting odd stuff in the passwords that makes people forget them. There's nothing you need to guess, the logic is in the password encoder and thus will apply both when you set it and when you use it.

Stripping characters reduces length, so you are making passwords less secure by your own criteria.

As for the scenario I described, I experienced it myself in a system that silently stripped spaces from any position in the verification process, storing a different password than the one I typed in, without any warning. My password wouldn't work in the login and I figured it out by examining the password verification code.

I don't understand why it's controversial to simply accept and store a user's password verbatim. Any other approach risks introducing new security issues, from reduced entropy to password clashes. Misguided policy decisions are famous for weakening encryption schemes, like that of the Enigma machine in WWII.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#145

Post by JonnieCache » Fri, May 25, 2012, 4:53 PM UTC

tptacek wrote: post #100

carbocation wrote: post #60

Earlier quoted context omitted.

"Remote Timing Attacks are Practical" https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf

You can't do a timing attack against a password hashed serverside, since you don't control the string being compared enough to make iterated byte-at-a-time changes. Even if I'm misunderstanding, though, this particular remote timing attack is probably not practical in most programming environments; (for instance) straight C memcmp is below the measurement floor, even with signal processing. That is a great paper; als…

There was a nice talk at 28c3 called "time is on my side" by Sebastian Schinzel, specifically about timing attacks over the net; it is pleasingly practical in its approach. He attacks the popular typo3 CMS.

http://www.youtube.com/watch?v=ykNt8pSQFZQ

It's very modern, as you describe, with all the fancy maths and all that.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#146

Post by tptacek » Fri, May 25, 2012, 5:03 PM UTC

JonnieCache wrote: post #145

tptacek wrote: post #100

Earlier quoted context omitted.

You can't do a timing attack against a password hashed serverside, since you don't control the string being compared enough to make iterated byte-at-a-time changes. Even if I'm misunderstanding, though, this particular remote timing attack is probably not practical in most programming environments; (for instance) straight C memcmp is below the measurement floor, even with signal processing. That is a great paper; als…

There was a nice talk at 28c3 called "time is on my side" by Sebastian Schinzel, specifically about timing attacks over the net; it is pleasingly practical in its approach. He attacks the popular typo3 CMS. http://www.youtube.com/watch?v=ykNt8pSQFZQ It's very modern, as you describe, with all the fancy maths and all that.

This is really great. Thanks for sharing it.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#147

Post by nsmartt » Fri, May 25, 2012, 5:09 PM UTC

chc wrote: post #81

nsmartt wrote: post #62

Earlier quoted context omitted.

My fault. I didn't explain properly. I didn't mean it in the normal way- to require strict passwords. I meant in the sense that users who do add a capital in order to up their account security don't get that security added. Only users who know about this bug and go the extra mile then will benefit from the view of "So just make a better password without." I apologize if this is worded badly. I'm not feeling up to my…

I think the point here is that if goofy capitalization is the only thing that kept your password from being trivially guessable, your password was only a little bit harder to guess. If your password isn't guessable, then it doesn't really matter if you have additional entropy, because the server smacks down brute-force attempts before they even get off the ground. In other words, it doesn't seem like capital letters…

That's exactly the problem here. A typical user who adds capitalization to make her password more difficult to guess is basically screwed over by Blizzard who has decided that passwords don't need to be case-sensitive.

Users who opt to (I'm not talking about forcing users to use capitalization here) to use capitalization for a more secure password are unaware that their efforts are in vain.

Also, it isn't only trivially more guessable. That's nonsense. If you're using a password list and you capitalize only the first letter of every password in that list, that list is still double the size of the first list.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#148

Post by stordoff » Fri, May 25, 2012, 5:25 PM UTC

speleding wrote: post #136

loup-vaillant wrote: post #125

Entropy of [a-z0-9] per character : 5,1 bits Entropy of [A-Za-z0-9] per character : 5,95 bits Entropy lost by case insensitivity (per character): 0,85 bits (15%) Bottom line: add 2 characters, and your password stays strong. Still, it would cool to warn users, or at least explicitly advise them to use longer passwords.

Not only is the entropy difference small, there is also an added benefit in less users having to reset their password. Forgetting how their password was capitalized is a big problem for people. Letting improved user experience trump a tiny bit of extra security is a good tradeoff for Blizzard. They're not a bank.

I wonder if this (to some extent) offsets the loss of security by converting to uppercase. I know that I have reduced the complexity of passwords I forget (often by limiting them to lowercase), so I suspect other users do the same when they reset.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#149

Post by alirov » Fri, May 25, 2012, 5:51 PM UTC

fffggg wrote: post #127

The following banks and financial institutions also silently discard case-sensitivity: Citibank Chase Wells Fargo E-Trade US Bank Fidelity Investments SECU HSBC TechCU

I just tried my American Express account and you can add that to the list of financial institutions discarding case-sensitivity.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#150

Post by loup-vaillant » Fri, May 25, 2012, 5:55 PM UTC

speleding wrote: post #136

loup-vaillant wrote: post #125

Entropy of [a-z0-9] per character : 5,1 bits Entropy of [A-Za-z0-9] per character : 5,95 bits Entropy lost by case insensitivity (per character): 0,85 bits (15%) Bottom line: add 2 characters, and your password stays strong. Still, it would cool to warn users, or at least explicitly advise them to use longer passwords.

Not only is the entropy difference small, there is also an added benefit in less users having to reset their password. Forgetting how their password was capitalized is a big problem for people. Letting improved user experience trump a tiny bit of extra security is a good tradeoff for Blizzard. They're not a bank.

> They're not a bank.

Definitely not. My bank forces me to use only numbers, and only six of them. Strooonng security. The only way out of key loggers I suppose (they make me click on numbered boxes).