Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diablo 3 bug report: "Passwords not case-sensitive."

us.battle.net

Post reply on HN
Print view View original

31–40 of 156 posts

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#31

Post by eridius »

drivebyacct2 wrote: post #27
elithrar wrote: post #20

Earlier quoted context omitted.

> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…

I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume some (plausibly safe) ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do .

Why do you need to compare in a case-insensitive manner? Just lowercase the password before hashing it, and the backend doesn't even have to care.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#32

Post by elithrar »

drivebyacct2 wrote: post #27
elithrar wrote: post #20

Earlier quoted context omitted.

> Although this is a really silly bug, Personally, I don't believe it is a bug at all. They have obviously made the decision to not enforce case in an effort to reduce customer service load/player frustration. Yes, it reduces the time needed to brute force your password if someone got hold of their user DB. But 1) we are still talking an excessively long time (their min. password length is 8) and 2) once they have th…

I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume some (plausibly safe) ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do .

> I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do.

Whilst I would hope they use a strong encryption scheme (with a variable work factor...), most of us know that even the biggest organisations in tech can fail miserably in this area.

But, I don't believe the majority of the forum posters see things the way we do. Many of them obviously correlate "case sensitivity" with "strong password", even though that's not exactly true.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#33

Post by AgentConundrum »

Twisol wrote: post #22
nostromo wrote: post #11

Earlier quoted context omitted.

Related, but different in an important way. If your password is aBc, you can log in to Facebook using aBc (original), AbC (windows caps lock), and ABc (first cap) only. For a regular password, this is just slightly less secure. Being case insensitive entirely is quite a bit less secure (abc, abC, aBc, aBC, Abc, AbC, ABc, ABC).

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

They would only have to store a single hash - the proper password.

When you log in to Facebook, they hash the password you gave them and try that. If it fails, they modify the password you gave them, reversing the case on all letters (and possibly convert numbers to special characters, or vice versa - I don't know if they go that far), and hash that.

Remember that when you log in, the server is receiving your password in plain text. Facebook is just "massaging" that data a bit (possibly several times) to try to correct a user error, rather than just bailing at the first sign of trouble.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#34

Post by TWAndrews »

duaneb wrote: post #19
tylermenezes wrote: post #7

Earlier quoted context omitted.

Facebook's is a little better - you can't disregard case entirely. Blizzard just cut the search space by a lot. Then again, it would be pretty difficult to brute force a password in Battle.net, to be honest. I'm assuming they'd lock out the account after just a handful of tries.

Yea, until someone steals their hashes.

All your hashes are belong to us

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#35

Post by TWAndrews »

gte910h wrote: post #2

Use a passphrase then if this bothers you? If you want to be serious about security of your account, use one of the two factor authentication systems available that they offer. The faster passwords stop looking like: C@tV0m!t And start looking like: correct battery horse staple the better for security and actually remembering the phrase rather than writing it down. (XKCD on this: http://xkcd.com/936/ )

One has to imagine that the actual phrase "correct battery horse staple" is a fairly poor choice of password, at this point though...

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#36

Post by willvarfar »

duaneb wrote: post #19
tylermenezes wrote: post #7

Earlier quoted context omitted.

Facebook's is a little better - you can't disregard case entirely. Blizzard just cut the search space by a lot. Then again, it would be pretty difficult to brute force a password in Battle.net, to be honest. I'm assuming they'd lock out the account after just a handful of tries.

Yea, until someone steals their hashes.

But there are plenty of password stretching algorithms like bcrypt.

A very reduced keyspace, but we all knew people's password choices are poor anyway right?

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#38

Post by e-dard »

elithrar wrote: post #32
drivebyacct2 wrote: post #27

Earlier quoted context omitted.

I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume some (plausibly safe) ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do .

> I don't think anyone's nearly as concerned about case enforcement as they are about backend storage of passwords. I can assume ways of storing/verifying passwords that are case insensitive, but I'm not naive enough to assume they do. Whilst I would hope they use a strong encryption scheme (with a variable work factor...), most of us know that even the biggest organisations in tech can fail miserably in this area. B…

And by encryption scheme, you really mean hashing scheme. Yup, it's easy to get confused.

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#39

Post by e-dard »

Twisol wrote: post #22
nostromo wrote: post #11

Earlier quoted context omitted.

Related, but different in an important way. If your password is aBc, you can log in to Facebook using aBc (original), AbC (windows caps lock), and ABc (first cap) only. For a regular password, this is just slightly less secure. Being case insensitive entirely is quite a bit less secure (abc, abC, aBc, aBC, Abc, AbC, ABc, ABC).

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

I don't under stand the confusion in the other replies here.

1) lowercase inputted password. 2) hash password 3) compare hash to db hash (which was from a lowercased initial password).

Re: Diablo 3 bug report: "Passwords not case-sensitive."

#40

Post by Devilboy »

tonyedgecombe wrote: post #24
Twisol wrote: post #22

Earlier quoted context omitted.

I wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?

Or perhaps they aren't storing it hashed ...

Facebook won't make that mistake.
Post reply on HN