21–30 of 156 posts
Facebook does sort of the same thing: http://www.zdnet.com/blog/facebook/facebook-passwords-are-no... Yes, it's possibly less secure. But for both Facebook and all of the Blizzard games there are other options if you are concerned.
Facebook does sort of the same thing: http://www.zdnet.com/blog/facebook/facebook-passwords-are-no... Yes, it's possibly less secure. But for both Facebook and all of the Blizzard games there are other options if you are concerned.
Related, but different in an important way. If your password is aBc, you can log in to Facebook using aBc (original), AbC (windows caps lock), and ABc (first cap) only. For a regular password, this is just slightly less secure. Being case insensitive entirely is quite a bit less secure (abc, abC, aBc, aBC, Abc, AbC, ABc, ABC).
Although this is a really silly bug, I did already know about it (it's the same in WoW), so frankly at the moment, I'm more concerned about the Diablo 3 bug which is causing a lot of us to not be able to successfully login and play, at all. Really not good.
> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…
I'm even inclined to consider chars within the sets 0o and 1lL i the same, but that's even more controversial :-)
Earlier quoted context omitted.
Related, but different in an important way. If your password is aBc, you can log in to Facebook using aBc (original), AbC (windows caps lock), and ABc (first cap) only. For a regular password, this is just slightly less secure. Being case insensitive entirely is quite a bit less secure (abc, abC, aBc, aBC, Abc, AbC, ABc, ABC).
I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?
Although this is a really silly bug, I did already know about it (it's the same in WoW), so frankly at the moment, I'm more concerned about the Diablo 3 bug which is causing a lot of us to not be able to successfully login and play, at all. Really not good.
> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…
I am interested to know how are they storing case insensitive passwords if they were not plain text, they only way I could imagine is by converting them in a full lower/upper case before hashing is performed.
Earlier quoted context omitted.
Related, but different in an important way. If your password is aBc, you can log in to Facebook using aBc (original), AbC (windows caps lock), and ABc (first cap) only. For a regular password, this is just slightly less secure. Being case insensitive entirely is quite a bit less secure (abc, abC, aBc, aBC, Abc, AbC, ABc, ABC).
I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?
Earlier quoted context omitted.
Related, but different in an important way. If your password is aBc, you can log in to Facebook using aBc (original), AbC (windows caps lock), and ABc (first cap) only. For a regular password, this is just slightly less secure. Being case insensitive entirely is quite a bit less secure (abc, abC, aBc, aBC, Abc, AbC, ABc, ABC).
I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?