Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard Network Breached; Change Your Battle.Net Passwords

kotaku.com

Post reply on HN
Print view View original

31–40 of 164 posts

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#31

Post by csallen »

revx wrote: post #8
swang wrote: post #4

"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we curren…

This is why you never use the actual answer to that question, but actually a separate password for those.

That wouldn't help. For example, let's assume your question was, "Who was your favorite teacher growing up?" and your answer was "fish123jellybean456". If that answer is stored in plaintext (no encryption) in a database that's compromised, then it won't matter that it's not the "real" answer. Attackers will see it, and then use it to answer your security questions on other sites. The only way to protect against this is to ensure you use different answers on different sites.

Using a password instead of the correct answer to the question can be helpful, but in a totally different way. Specifically, it eliminates the risk that someone can guess (or research) the answer to your security questions.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#32

Post by feefie »

How is a breach like this detected and how would they determine what data was accessed? How likely is is that that other sites on the internet are breached but don't detect it? If the answer is too long and you could recommend a book or website I could read up on this topic, that would be awesome.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#33

Post by duaneb »

Steko wrote: post #21
duaneb wrote: post #18

Also, Blizzard has a 16-character password limit... seriously disappointing.

Blizzard has numerous server side protections that prevent your lower case 16 character p/w from ever being brute forced. It's not that big of a deal.

They're needlessly limiting it. There's nothing wrong with making the limit, say, 256 characters. It's just bad security.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#34

Post by barik »

duaneb wrote: post #18

Also, Blizzard has a 16-character password limit... seriously disappointing.

The 16-character limit is not as bothersome to me as the fact that they go out of their way to set onpaste="false" in their HTML, making even 16-character passwords annoying because the average user has to type it all in by hand.

I will never understand the rationale for preventing me from pasting a strong password versus picking a weaker password that I have to type by hand. Currently, my workaround is to use "Inspect Element" with a Web Developer Extension and remove this rather unfortunate attribute.

I know that password manager tools like KeePass can type in the password letter-by-letter (but then, why not just allow paste?), but this automation is normally designed for login screens, not for password change forms.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#36

Post by hanapbuhay »

Here's some detailed information on what happened [1]. A press release from Mike Morhaime [2]. Also, they're currently working on allowing users update their secret question and answers [3].

[1]: http://us.battle.net/support/en/article/important-security-u...

[2]: http://us.blizzard.com/en-us/securityupdate.html

[3]: http://us.battle.net/support/en/blog/6940803

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#37

Post by Shank »

RKearney wrote: post #20
swang wrote: post #4

"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we curren…

I believe Blizzard makes you supply a scanned copy of your state issued identification in order to get a password reset.

This is only to remove an authenticator. I just changed my password and it didn't even send a confirmation email to confirm the change - it just changed it and sent me a notification email.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#38

Post by dangrossman »

duaneb wrote: post #16

Why is it OK to have the security answers not hashed? They are just secondary passwords, and there is absolutely no reason someone else needs to know it.

Because they need to do really fuzzy matching for call-in support, which is where the security question gets most used. Hashing makes that impossible and raises the average call length since the agent would have to type each response rather than simply compare to the answer on screen. No amount of normalization would make "The Blue Dragons" match "Dragons" or "Warwick Elementary School" match "Warwick", or whatever the answers to the questions are. Security questions aren't precise like passwords.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#40

Post by DanBC »

MiguelHudnandez wrote: post #23
dkokelley wrote: post #10

Earlier quoted context omitted.

I agree. As long as the password authentication mechanism is in place, unique, random, and complex passwords are the best way to secure yourself. Unless you can memorize each of these unique passwords yourself, the next best thing is to use a secure password manager program to take care of this for you.

I follow this in practice, but I always have to wonder: what if someone gets my password database and breaks it? It would only take a keylogging trojan to get everything they needed. I would be in for a world of hurt! Way worse than if a few of my accounts were compromised because I had used the same password. But still, the chances of being compromised are probably much smaller.

As mentioned by other people in other recent threads some good quality password safe programs work with Yubikey, so an attacker needs something you know (your password) and something you have (your Yubikey).

I'd be interested in seeing some robust analysis of password safe software. But "Password safe" and "keepass" appear to be reputable.

I'd also like a native, and trustworthy, password safe for OS X that can work with something like Yubikey.

Post reply on HN