Not a huge deal.
"- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address."
I don't remember this ever happening.
Then it clearly must have not happened.
Wouldn't cutting your key search space roughly in half reduce your cracking time greatly, though?
According to Wolfram, for a 12 character password:
password type | total number | example
digits 0 through 9 | ~~ 2^40~~1 trillion | 287088364476
case-insensitive alphabetic | ~~ 2^56~~95.43 quadrillion | ycwcgndabspw
case-insensitive alphanumeric | ~~ 2^62~~4.738×10^18 | okcm5tfe8odr
case-sensitive alphabetic | ~~ 2^68~~3.909×10^20 | SgilPtNTKmuQ
case-sensitive alphanumeric | ~~ 2^71~~3.226×10^21 | xhWuSN5HBETz
printable ASCII characters | ~~ 2^79~~4.759×10^23 | [i{}I"2Bz9sN
More characters is always numerically better... but better, as they say, is the enemy of good enough.
And "more ornerous" is the enemy of a paying casual userbase and doesn't help you at all vs the most common attack vectors (keyloggers and social).
Because of blizzard server limits you're not going to brute force login to my battlenet account even if I tell you my username and half of my password.
If you steal the hashes you're probably not going to be able to do anything with it because of work factor key lengthening and the fact that you have to attack each account one at a time.
Even then let's say you've managed to steal blizzards user/salt/hash databases and put a small country's GDP worth of GPU resources into breaking all the passwords. Now you come up against the fact that the vast majority of the accounts, including prohibitively all of the best ones, have 2 factor authentication.
Get past those 3 mission impossibles and you run into even more server side limits on IP logins. And logging in and doing anything on accounts takes time and blizzard's going to quickly figure out something is going on and put the whole thing on lockdown.
So yeah, not a huge deal imho.
...
"bits of entropy" is just the binary log of the character space, 81 bits -> 2^81.
On the other hand, if users choose their passwords themselves... Well I made a quick script to analyze the RockYou leak of 32 million plaintext passwords:
91% of passwords are lowercase
5% are uppercase
3% are lowercase but begin with a capital letter
In other words, you can crack 99% of case sensitive passwords just by trying these 3 possibilities!
It's on the bnet forums somewhere.