Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard Network Breached; Change Your Battle.Net Passwords

kotaku.com

Post reply on HN
Print view View original

71–80 of 164 posts

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#71

Post by mojowo11 »

DigitalSea wrote: post #67
alanfalcon wrote: post #62

Earlier quoted context omitted.

Blizzard is _literally_ under _constant_ attack and has an incredible security team in place. Obviously the only acceptable result is 100% attack deflection, but the idea that this could be or could have been anything short of an absolute top priority for the company is a ridiculous assertion that I'd expect on any other site, but not HN. I'm a former Blizzard employee with knowledge of the situation and internal wor…

Security has nothing to do with preventing the attack, it's more so protecting the data much like a bank protects it's assets. It's pretty easy to break into a bank (they're merely glass and brick after all), but there is no way you're getting into that vault once inside and even so, if you get into the vault there are secondary security procedures in place to ensure that nothing is easily taken. So regardless of whe…

Just curious, are you actually a data security professional? Because while you have a very nice metaphor with the whole bank vault thing, you haven't offered any actual examples, or any specific criticisms of Blizzard's setup (not that we know what it was), or even examples of what you're talking about.

I know nothing about data security myself, but I'm not exactly learning anything about it from your posts. Sorry to be rudely blunt, but I've seen a lot of people who have no idea what Blizzard is up against, the difficulty/feasibility of protecting digital data, what Blizzard has in place, or even what Blizzard could/should have in place really criticizing Blizzard for incompetence here, and that's odd to me.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#72

Post by elithrar »

Digitalxero wrote: post #66

So I went to update my password for my World of Warcraft account after I saw this. And guess what I discovered, my current password is more secure than their current password policy will allow. So I filled out a support ticket with the following question (which all Blizzard account holders should ask them) I was wondering why even after you discovered a security breach you have not updated your password policy to act…

> "The only reason to have those two rules is because you are storing the password in plain text so anyone who gets access to the database can read them freely."

That is certainly not the only reason to have those rules; in fact, it's probably one of the least popular reasons.

It's done to keep customers creating short-ish passwords, which are likely to be more memorable, and therefore reduce the support load for password resets.

Whether this is actually effective or not is another thing entirely.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#74

Post by pestaa »

bithive123 wrote: post #65
famousactress wrote: post #9

Earlier quoted context omitted.

Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext?

I think a good balance between usability and security is to normalize the answer (discard case, punctuation, etc) and then hash it.

My favorite security answer is "@#¤ß$ä#$&%^$" so please don't discard case or punctuation.

(Yes, I design these answers virtually impossible to brute-force even for myself.)

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#75

Post by dagrz »

DigitalSea wrote: post #19

This is ridiculous. Maybe the world is ending, because it feels like every major website/provider of some popular service is getting hacked these days. A company of Blizzard's stature and wallet size has no excuse for this kind of thing happening, no excuse at all. If you're charging people exorbitant amounts of cash to buy your games and then charging some of your customers a fee for the privilege of using your so-c…

You are pointing your anger in the wrong direction. The reality is that security is a hard problem, much too hard for Blizzard, much too hard for RSA, much too hard for banks, and much too hard for governments.

Major companies being hacked is not a new phenomenon. What's new is them (a) detecting the hacks and (b) disclosing them. It's unfortunate but true; you should be happy that they are telling you.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#76

Post by [deleted] »

swang wrote: post #4

"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we curren…

[deleted]

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#77

Post by dkokelley »

MiguelHudnandez wrote: post #59
BadassFractal wrote: post #52

Earlier quoted context omitted.

Is Yubikey superior to something like Keepass/Lastpass/1password?

Yubikey works just like Google Authenticator, except it is a little more convenient to type in the code. (you touch a physical button on the dongle, and it types the code for you) It does not actually save any passwords. It would replace Google Authenticator or an RSA SecurID FOB.

Now this is convent, provided I don't have to access my password safe on a mobile device without a USB port. Does Yubikey have an app or work with Google Authenticator?

I know I can use LastPass with Google Authenticator to identify trusted devices. Still not perfect, but perfect security would be too inconvenient for anyone to use.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#78

Post by dhimes »

Steko wrote: post #63
untog wrote: post #58

Earlier quoted context omitted.

The point still stands, though. There is way, way too much potential variation to hash that stuff.

I think the bigger point is that a ton of signups use this question. Whether you say 'Mr. Smith' or 'Pecan Pie' isn't going to save you if you use it for all of them.

Actually, you often get to pick your question. If they don't hash the answer, however, you're screwed. It seems doable to me: drop on non alphanumeric (or something), split on whitespace, trim, lowercase, put back together. It beats the hell out of putting in the "right," googleable, answer. Sarah Palin can attest to that.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#79

Post by DigitalSea »

Steko wrote: post #70
DigitalSea wrote: post #67

Earlier quoted context omitted.

Security has nothing to do with preventing the attack, it's more so protecting the data much like a bank protects it's assets. It's pretty easy to break into a bank (they're merely glass and brick after all), but there is no way you're getting into that vault once inside and even so, if you get into the vault there are secondary security procedures in place to ensure that nothing is easily taken. So regardless of whe…

Did you really just insinuate that banks never get robbed?

I didn't say that at all. I said it's easy to break into a bank but getting into a vault in this day and age is impossible. And if you somehow by luck or knowledge get into the vault there are secondary, third, etc security procedures in place such as alarms, self-locking doors, cameras and heat/movement detectors.

A database is a vault. It's for storing things you don't want anyone to be able to access and even if a hacker can access it, they shouldn't be able to do anything with the data that they can see.

Banks get robbed all of the time, but the damage is minimal because the cash available over a counter is a write-down for a bank that keeps most of it's wealth in a vault onsite or offsite.

Post reply on HN