Blizzard Network Breached; Change Your Battle.Net Passwords • Hacker News Board

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#161

Post by barik » Fri, Aug 10, 2012, 1:45 PM UTC

tedunangst wrote: post #127

david_shaw wrote: post #57

Earlier quoted context omitted.

Rather than doing this by hand via Firebug/Chrome Inspect Element, it might be worth looking into creating a quick Chrome Extension or Firefox Add-On (or even a userscript) to do this for you. I understand the initial rationale behind not allowing you to paste a password: (1) Pasting a password can allow a malicious user to find your password somewhere and paste it in (as it would take much more time to type by hand)…

(3) you type your intended password wrong, copy it, paste it, and lock yourself out. The sites make you type the password twice is to make sure you did it right. People who can't be bothered to type a password twice are probably heavily intersecting with people who didn't type it right the first time.

This seems somewhat contrived, but in realm of plausible, so let's say it's in the fact the reason for doing so. If so, why do you think that the old/current password field also has paste disabled?

I think an easy solution (that perhaps I just haven't found) in KeePass is to have a feature like "Perform Auto-Type" (which does the full login and password typing sequence), but for any arbitrary field. If I could find that, then this would be a moot issue for me.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#162

Post by dkokelley » Fri, Aug 10, 2012, 4:05 PM UTC

wlievens wrote: post #148

dkokelley wrote: post #15

Earlier quoted context omitted.

Possibly. I've been on phone support with companies that require me to tell them answers to my security questions. Also, automatic security question checking would require support for soft matches like capitalization or punctuation. You could simplify the data before hashing (strip special chars and convert to lower case), or store multiple hashes to each variant. I really wish a lot more work went in to security que…

> The recent iCloud breach makes me believe that in many cases the "security questions" practice is by far the weakest link in modern web authentication. Isn't that how the Sarah Palin thing happened?

Yes. That's exactly the incident I was thinking of.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#163

Post by smsm42 » Fri, Aug 10, 2012, 5:47 PM UTC

roc wrote: post #158

wlievens wrote: post #149

Earlier quoted context omitted.

Yeah, unless you do it consistently everywhere, which again defeats the purpose. Maybe you could do something like consistently answer the previous question from the dropdown?

Or use a tool like 1password to generate and store the 'answers'.

You need those answers exactly when you don't have the password, which means your 1password failed for some reason (otherwise you'd have the password from it). For me it usually happens with sites that generate their own passwords which I for some reason failed to enter into 1password some time ago (probably because I didn't use the site for a long time).

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#164

Post by dsl » Fri, Aug 10, 2012, 10:29 PM UTC

StavrosK wrote: post #47

dsl wrote: post #43

From my time reverse engineering the WoW client, I can tell you Blizzard uses SRP6 [1] for authentication. You'd have to really try hard to be storing anything other than a hash on the backend. 1. http://srp.stanford.edu/design.html

Oh wow, I wasn't aware of that. So the password (or a hash of it) never leaves the client, so an eavesdropper can never get any information? That's very interesting. It looks like both parties end up with a session key, too, which is an added bonus.

Pretty much. The Blizzard guys know their shit. You wouldn't go wrong replicating anything they have done security wise, which is why this breach is surprising to me.