Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Electronic Arts Hates Strong Passwords

kaurkuut.com

Post reply on HN
Print view View original

81–90 of 111 posts

Re: Electronic Arts Hates Strong Passwords

#81

Post by fmw »

safeaim wrote: post #78
fmw wrote: post #43

Earlier quoted context omitted.

Limits on password length smell like plain text storage. Hashes tend to make the length of the password irrelevant (although some bad implementations only look at the first n characters of the string and ignore the rest), but when you store it in a relational database row you need to come up with some arbitrary limit.

Hope you're not right, as Paypal only let's you use up to 22 chars if I'm not mistaken

I'm not saying that this is the only reason why people come up with a limit on password length, but that I can imagine that some programmers who come up with such a limit do so because of plaintext storage in a fixed length database row (which is the only quasi-technical excuse for a limit I can up with).

Re: Electronic Arts Hates Strong Passwords

#82

Post by muppetman »

ASB Bank in New Zealand allows a maximum of 8 characters for your passwords. Numbers and letters only.

That's right, all that stands between you and your account details is 8 characters.

If someone tries to transfer out over ~$200 then you get a text message on your phone - IF you've enabled that service. So it's not the end of the world, but it's still pretty terrible.

Re: Electronic Arts Hates Strong Passwords

#83

Post by tedunangst »

skimbrel wrote: post #65
tedunangst wrote: post #34

Earlier quoted context omitted.

I use 16 letter or longer all lowercase passwords. They're easy to type and easy to remember. For example, my HN password might be ishouldbemoreproductive. It's hard to crack, but doesn't require finger gymnastics to enter.

Actually, English phrases contain very little entropy -- as little as 0.6 bits per character. This is because the rules for what constitutes a valid word or phrase dramatically reduce the number of possible characters at a given position. To look at it another way: take an arbitrary string of letters. What's the probability that it forms a valid English word? Very low. Flipping this the other way, if we know that a p…

Obviously, there are rules for what constitutes a valid phrase, but they are rather complex for a password cracker to check.

My computer says there are 234979 words. Pick 5 and there are 716382975036689591261090899 combos. That is actually very very close to a 15 letter alphanumeric. 62 ^ 15 = 768909704948766668552634368.

I don't doubt that IsgoHNlf,bIbmp. is a secure password. But it's a bitch to type. Especially on a phone.

Re: Electronic Arts Hates Strong Passwords

#84

Post by Natsu »

drinian wrote: post #64
nettdata wrote: post #52

Having been an Online Architect brought in for a couple of major EA projects (other than this one) I can tell you that they have a very robust and secure centralized user account system available. The problem comes when you have so many different game teams with varying experience in online security that are allowed to basically implement it as they see fit, and basically "proxy" the account generation/creation proce…

If it's so robust, then why were these hacked passwords being stored unsalted?

Or using MD5, for that matter....

Re: Electronic Arts Hates Strong Passwords

#85

Post by nettdata »

drinian wrote: post #64
nettdata wrote: post #52

Having been an Online Architect brought in for a couple of major EA projects (other than this one) I can tell you that they have a very robust and secure centralized user account system available. The problem comes when you have so many different game teams with varying experience in online security that are allowed to basically implement it as they see fit, and basically "proxy" the account generation/creation proce…

If it's so robust, then why were these hacked passwords being stored unsalted?

If your car has 6 gears, why are you only using one?

Again, it's all about the implementation. Some game teams opt to do their own storage of user information rather than rely on the remote service call to the centralized system.

In some cases, like the two projects I worked on, the central system doesn't store all of the user data you need, so you end up storing some in the local system, extending the centralized one. "Some" teams opted to build their own rather than take advantage of the one that existed. (For what it's worth, there is a lot of "build it ourselves" mentality in some teams).

This particular team have a few "interesting" things that they've done beyond the user authentication. Their authorization and entitlement implementations left more than a few of us from other teams scratching our heads as to how they opted to utilize the centralized EA service. It was less than ideal, and did cause some issues for a few other teams.

I don't want to get into it too much, but I guess if there's one message I'd like to share it's that EA is not one big company, but rather a whole bunch of individual development teams working on their own things. As much as there is an attempt to centralize a lot of knowledge and services, it's by no means a given that everyone's doing the same or right thing.

Just because one team totally screwed the pooch on stuff like this, doesn't mean others have as well.

A lot of the teams have some leeway and discretion when it comes to what technologies or internal services they use, and sometimes that's a good thing, sometimes it's not.

Re: Electronic Arts Hates Strong Passwords

#86

Post by sahillavingia »

starwed wrote: post #72
yason wrote: post #12

Someone heard "must validate all input", scratched his head for a while going about how to validate the password field, and thus came up with some artificial limitations? If so, it's a huge misconception about what it means to "validate" data. If not, someone's just really stupid. This goes into the same category as validating email addresses (just go ahead and send the confirmation email and watch me not replying in…

asking me to provide something twice (I'll just copypaste from the first field, thanks; would be more useful if you just printed a confirmation of what I wrote onto the next page). Asking for something (normally a password or email) twice is for your benefit -- to guard against typos. There are many typos you might miss visual confirmation of, I'm fairly certain the type-twice method is a sound one.

There are places, even Facebook's registration form, that make your re-enter your email address.

Re: Electronic Arts Hates Strong Passwords

#87

Post by hackermom »

kennu wrote: post #67
hackermom wrote: post #37

As for the "special characters" not being allowed, there is a sane and logical reason behind this (but whether or not EA's developers had this in mind will remain unanswered): the ASCII set is intuitively and easily available from any keyboard setup and locale in the world. Using special characters in your login/password, characters perhaps only available through your specific locale and keyboard - people living abro…

Bad excuse. Sure you can _warn_ the user, but completely forbidding using secure passwords is out of the question.

Passwords aren't inherently safe just because you use multibyte characters or the full ASCII set, and likewise they aren't unsafe just because you don't. It's not a bad excuse at all, but with that said it's not implied that EA took the best route on this regardless of the reasons behind their design. It could definitely be better.

Re: Electronic Arts Hates Strong Passwords

#88

Post by yuhong »

nettdata wrote: post #52

Having been an Online Architect brought in for a couple of major EA projects (other than this one) I can tell you that they have a very robust and secure centralized user account system available. The problem comes when you have so many different game teams with varying experience in online security that are allowed to basically implement it as they see fit, and basically "proxy" the account generation/creation proce…

Reminds me of this: http://blogs.msdn.com/b/oldnewthing/archive/2006/07/13/66444...

Re: Electronic Arts Hates Strong Passwords

#89

Post by HoLyVieR »

Derbasti wrote: post #7
arkitaip wrote: post #4

The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.

Think about all-numeric PIN style passwords. I have seen banking websites that enforce [0-9]{4,6}

Enforcing PIN style password for bank is not that bad, as long as they use other factor to identify you.
Post reply on HN