31–32 of 32 posts
Earlier quoted context omitted.
"- Their passwords aren't case sensitive." Not a huge deal. "- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address." I don't remember this ever happening.
>>I don't remember this ever happening. Then it clearly must have not happened.
Earlier quoted context omitted.
"- Their passwords aren't case sensitive." Not a huge deal. "- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address." I don't remember this ever happening.
>Not a huge deal. Wouldn't cutting your key search space roughly in half reduce your cracking time greatly, though? According to Wolfram, for a 12 character password: password type | total number | example digits 0 through 9 | ~~ 2^40~~1 trillion | 287088364476 case-insensitive alphabetic | ~~ 2^56~~95.43 quadrillion | ycwcgndabspw case-insensitive alphanumeric | ~~ 2^62~~4.738×10^18 | okcm5tfe8odr case-sensitive alp…
More characters is always numerically better... but better, as they say, is the enemy of good enough.
And "more ornerous" is the enemy of a paying casual userbase and doesn't help you at all vs the most common attack vectors (keyloggers and social).
Because of blizzard server limits you're not going to brute force login to my battlenet account even if I tell you my username and half of my password.
If you steal the hashes you're probably not going to be able to do anything with it because of work factor key lengthening and the fact that you have to attack each account one at a time.
Even then let's say you've managed to steal blizzards user/salt/hash databases and put a small country's GDP worth of GPU resources into breaking all the passwords. Now you come up against the fact that the vast majority of the accounts, including prohibitively all of the best ones, have 2 factor authentication.
Get past those 3 mission impossibles and you run into even more server side limits on IP logins. And logging in and doing anything on accounts takes time and blizzard's going to quickly figure out something is going on and put the whole thing on lockdown.
So yeah, not a huge deal imho.
...
"bits of entropy" is just the binary log of the character space, 81 bits -> 2^81.