[deleted]
Ubisoft hacked, account data compromised
61–70 of 104 posts
Re: Ubisoft hacked, account data compromised
#62Earlier quoted context omitted.
I have mixed feelings about that. On the one hand, I fully agree - I hate having all kinds of junky game clients running on my computer when I ought to just be able to have one, Steam, which is obviously doing a decent job. On the other hand, I think that competition will drive Steam to be better (or maybe, just maybe, result in something better than Steam), and so I don't necessarily want the other companies to stop…
This isn't really a market that benefits from competition doing anything less than the same the same thing, though. Steam is acting as more of a dumb distributor than a publisher, and are an established player. All Ubisoft and EA have is their own titles. They're not going to attract indie players, and they're not going to attract other publishers' work if all they're trying to do is utilize their titles to garner us…
Can't speak for Ubisoft, but Origin sells games not published by EA. I think right now they sell Sega, Square and Warner Brother games. They also sell physical copies of games not published by them, including some Valve games. They're growing their catalog.
Re: Ubisoft hacked, account data compromised
#63Earlier quoted context omitted.
I have mixed feelings about that. On the one hand, I fully agree - I hate having all kinds of junky game clients running on my computer when I ought to just be able to have one, Steam, which is obviously doing a decent job. On the other hand, I think that competition will drive Steam to be better (or maybe, just maybe, result in something better than Steam), and so I don't necessarily want the other companies to stop…
The other companies aren't really trying to compete with Steam per se, they just want to inject their own custom babysitter to analyze your computer and see if they're complying with their rules. When you open a game from Steam that's produced by one of these companies, it chains in its own loaders and achievements and stuff. It totally sucks, and it's a terrible end user experience. It'll be exciting when the fogies…
I think they are probably more interested in avoiding the ~15-30% (rumored) cut that Steam takes for digital sales of their games. And I know in EA's case, they want to sell DLC through their game, not through Steam's client specifically to avoid that charge (that's the reason some EA games were removed from Steam when Valve changed their policy on the matter).
Re: Ubisoft hacked, account data compromised
#64I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
Here is a good list of DRM free Ubisoft games: http://www.gog.com/catalogue?search=Ubisoft
This doesn't matter though in regards to personal information. Any service where you buy the game will have your information for the sake of enabling purchase. Steam is no better here, and even GOG. If either of them is hacked - your personal info will be leaked.
Re: Ubisoft hacked, account data compromised
#65I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.
As an alternative, you could GPG a text file with all passwords and use... hexdump -n 16 -v -e '/1 "%02X"' /dev/urandom ...as a password generator
I built an extension to use PBKDF2 and some other cleverness to generate predictable passwords for websites because I was tired of needing "random" passwords for every site and some kind of password keeper that stored them. I'd rather generate the password when I need it, and to do so from a password I have memorized, but which isn't written down or used anywhere else.
Re: Ubisoft hacked, account data compromised
#66To add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and typed my email. Usually, security best practices say that you should not volunteer any information for a potential attacker, e.g. don't tell the user if an email was sent or not, as this can be used for example to eventually construct a list of all their user's em…
Also, the password is limited to 16 chars.
Re: Ubisoft hacked, account data compromised
#67They sent a notification email to every customer asking them to change their password. The email includes the user's current password.
I know this because I received such an email-- intended for someone else who accidentally used my email address for their account. So not only is Ubisoft storing raw passwords and sending them via email, they're not verifying email addresses during account creation.
Re: Ubisoft hacked, account data compromised
#68Earlier quoted context omitted.
Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
None that wouldn't be better handled with a warning of "excessive password complexity, we're not sure you'll remember this". Even truncating all password entries (create/change and auth) and simply taking the used subset would be better than blocking me from using my intended password.
Hmmm... if your password was
password30jf0sd09jga09ja0i9sdfasi09djf0-sdj9faspiodjf
and they only used the first 8 characters, you'd think you had a strong password, but would really have a very weak password. Hashing then truncating as discussed above would be much safer.
Re: Ubisoft hacked, account data compromised
#69Re: Ubisoft hacked, account data compromised
#70Earlier quoted context omitted.
None that wouldn't be better handled with a warning of "excessive password complexity, we're not sure you'll remember this". Even truncating all password entries (create/change and auth) and simply taking the used subset would be better than blocking me from using my intended password.
Hmmm... if your password was password30jf0sd09jga09ja0i9sdfasi09djf0-sdj9faspiodjf and they only used the first 8 characters, you'd think you had a strong password, but would really have a very weak password. Hashing then truncating as discussed above would be much safer.
Really no reason to truncate after hashing. The output size of any cryptographic hash function should be more than small enough to send down the wire and hash again properly.
Really though, just reject passwords over a few KB. Nobody will ever notice that limit except for people trying to fuck with you.