Hacker News Reader

Comment by rartichoke | Hacker News Reader

Pretty much. Look at company's like Blizzard who are even bigger.

- Their passwords aren't case sensitive.

- Their login form's GET request isn't using https.

- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address.

* This information is based from about June 2012, I'm not sure if their security measures changed since then but I remember the thread on the bnet forums and it being confirmed by an official moderator-like person saying blizzard was aware of the problem for the longest time but didn't care about fixing it.

I never understood how game companies could be so lazy when it comes to security. They obviously have the talent to do things right and rake in silly amounts of $. Why jeopardize the integrity of their name.

View on HN

it's one of the reasons why i don't play Blizzard games anymore. it gets old when every time i want to play a game, i need to go through endless webpages to reactivate my account that has been blocked because of 'suspicious activities'.

"- Their passwords aren't case sensitive."

Not a huge deal.

"- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address."

I don't remember this ever happening.

>Not a huge deal.

Wouldn't cutting your key search space roughly in half reduce your cracking time greatly, though?

According to Wolfram, for a 12 character password:

    password type | total number | example
    digits 0 through 9 | ~~ 2^40~~1 trillion | 287088364476
    case-insensitive alphabetic | ~~ 2^56~~95.43 quadrillion | ycwcgndabspw
    case-insensitive alphanumeric | ~~ 2^62~~4.738×10^18 | okcm5tfe8odr
    case-sensitive alphabetic | ~~ 2^68~~3.909×10^20 | SgilPtNTKmuQ
    case-sensitive alphanumeric | ~~ 2^71~~3.226×10^21 | xhWuSN5HBETz
    printable ASCII characters | ~~ 2^79~~4.759×10^23 | [i{}I"2Bz9sN

The difference comes out to be 6.7 bits of entropy for a 12 chraracter, case sensitive and case insensitive alphanumeric with symbols. 81.38 vs 88.08. (Note that this "bits of entropy" number is mostly beyond my comprehension.. could anyone elaborate a bit? I'd assume more==better)

I agree with Steko that being case insensitive is not a big deal. If you force users to use randomly generated passwords, 12+ characters is safe whether case sensitive or not.

On the other hand, if users choose their passwords themselves... Well I made a quick script to analyze the RockYou leak of 32 million plaintext passwords:

91% of passwords are lowercase

5% are uppercase

3% are lowercase but begin with a capital letter

In other words, you can crack 99% of case sensitive passwords just by trying these 3 possibilities!

"reduce your cracking time greatly"

More characters is always numerically better... but better, as they say, is the enemy of good enough.

And "more ornerous" is the enemy of a paying casual userbase and doesn't help you at all vs the most common attack vectors (keyloggers and social).

Because of blizzard server limits you're not going to brute force login to my battlenet account even if I tell you my username and half of my password.

If you steal the hashes you're probably not going to be able to do anything with it because of work factor key lengthening and the fact that you have to attack each account one at a time.

Even then let's say you've managed to steal blizzards user/salt/hash databases and put a small country's GDP worth of GPU resources into breaking all the passwords. Now you come up against the fact that the vast majority of the accounts, including prohibitively all of the best ones, have 2 factor authentication.

Get past those 3 mission impossibles and you run into even more server side limits on IP logins. And logging in and doing anything on accounts takes time and blizzard's going to quickly figure out something is going on and put the whole thing on lockdown.

So yeah, not a huge deal imho.

...

"bits of entropy" is just the binary log of the character space, 81 bits -> 2^81.

>>I don't remember this ever happening.

Then it clearly must have not happened.

Not what I said but yes I was asking for a cite on something he claimed.

It was during the time when a bunch of people claimed they were "hacked" a bit after Diablo 3 came out.

It's on the bnet forums somewhere.

Reply on news.ycombinator.com