/v/ - Video Games » Thread #140641246

[250 / 30 / ?]

Anonymous Fri 25 May 2012 13:03:40 No.140641246 View View Reply Original Report

Quoted By: >>140642057 >>140648175 >>140654793 >>140666924 >>140668134

>Hey guys, even though Blizzard doesn't case-sensitive their passwords, who really gives a shit right?
>Not like we should all care, right?
>Right...?
Fucking hell Blizzard are really out of touch with this shit.

http://us.battle.net/d3/en/forum/topic/5152409863

Anonymous

Anonymous Fri 25 May 2012 13:06:36 No.140641395 Report

Quoted By:

>demanding/defending casualisation of passwords

It's over

Anonymous

Anonymous Fri 25 May 2012 13:07:21 No.140641448 Report

Quoted By:

>bad security
that explains the mass hacking shitstorm a few days ago

Anonymous

Anonymous Fri 25 May 2012 13:07:58 No.140641491 Report

Quoted By:

Hahahaha oh wow. No wonder people are getting hacked so easily.

Anonymous

Anonymous Fri 25 May 2012 13:08:17 No.140641515 Report

Quoted By:

Fucking Christ. That's almost as daft as Gawker's "any characters after the eighth one don't matter" password issue. What the fuck.

Anonymous

Anonymous Fri 25 May 2012 13:09:50 No.140641605 Report

Quoted By: >>140641753

It gets worse, people are actually defending this shit.

http://us.battle.net/d3/en/forum/topic/5151271278

>Nah guys, case-sensitive passwords are a waste of time, it annoys the customers and if you get it wrong it locks you out

Fuck off.

Anonymous

Anonymous Fri 25 May 2012 13:10:50 No.140641663 Report

Quoted By: >>140641843

Makes sense though. Why waste time trying to brute force a password when you can just phish for the average WoW/D3 player's account info and still be successful?

Anonymous

Anonymous Fri 25 May 2012 13:12:36 No.140641753 Report

Quoted By: >>140641901

>>140641605
>I disagree. Case sensitivity creates a lot more potential for people to forget their passwords, but adds an almost meaningless security benefit.

WHAT THE FUCK AM I READING

Anonymous

Anonymous Fri 25 May 2012 13:13:48 No.140641817 Report

Quoted By: >>140642049 >>140642208 >>140654161 >>140659101 >>140668323

>/v/ getting upset over case sensitive letters

this place has hit an all time low, stop making issues out of non-issues, this has to be one of the worst cases I've seen

Anonymous

Anonymous Fri 25 May 2012 13:14:18 No.140641843 Report

Quoted By: >>140642161

>>140641663
I can understand if someone was brute forcing, but still, it is just an added measure for ease of mind and its not like it takes huge amount of hours to implement. It's just absurd when Blizzard, the guys who stress enough that you should attach a authenticator to your account to STOP getting hacked, have a huge flaw in their system themselves.

Anonymous

Anonymous Fri 25 May 2012 13:15:11 No.140641901 Report

Quoted By: >>140642767

>>140641753

>meaningless security benefit.
>essentially doubles the amount of brute-force attempts needed for a hack
>meaningless

Jesus Christ...

Anonymous

Anonymous Fri 25 May 2012 13:17:25 No.140642049 Report

Quoted By:

>>140641817
Hi Blizzard!

Anonymous

Anonymous Fri 25 May 2012 13:17:31 No.140642057 Report

Quoted By:

>>140641246
>Doubles
That shit is exponential, yo.

a-z: 26
A-Z: 26
1-0: 10
!-): 10

Total: 72, versus 46.

Assuming 8 characters:
72^8: 722,204,136,308,736
46^8: 28,179,280,429,056

Anonymous

Anonymous Fri 25 May 2012 13:19:09 No.140642161 Report

Quoted By:

>>140641843

but if you want to make your password to ease your mind, just make your password in all lower case.

inb4 faggetts who forget about capslock

Anonymous

View Same Google ImgOps iqdb SauceNAO 1337005737750.png, 173KiB, 375x475

Anonymous Fri 25 May 2012 13:19:15 No.140642170 Report

Quoted By: >>140642263

Don't you guys understand they want people buying their authenticator? I lost my D3 account and they just told me to get an authenticator to resolve future issues.

> implying blizzard and I have a future.

Anonymous

Anonymous Fri 25 May 2012 13:19:52 No.140642208 Report

Quoted By:

>>140641817

Next you're telling me if I get hacked and my account gets stolen with over a 100$ worth of games I shouldn't care and get a life.

Anonymous

Anonymous Fri 25 May 2012 13:20:44 No.140642263 Report

Quoted By: >>140642501

>>140642170
I reckon this and the RMAH. Oh whats that, all your gear is stolen? Well why not just buy a complete set for $9.99 and be ready to take on Inferno!!

Anonymous

Anonymous Fri 25 May 2012 13:24:15 No.140642501 Report

Quoted By: >>140642608

>>140642263
That's easy mode.
Most likely BUY OUR MAGIC FINDER CHARM/BUFF/WHATEVER FOR 10 BUCKS SO YOU CAN RECOVER YOUR LOSES FASTER

Anonymous

Anonymous Fri 25 May 2012 13:25:57 No.140642608 Report

Quoted By: >>140642645

>>140642501
I forgot said buff/charm will work only for 12 hours upon usage so stack up now due to limited supplies

Anonymous

Anonymous Fri 25 May 2012 13:26:31 No.140642645 Report

Quoted By:

>>140642608
And require a subscription.

Anonymous

Anonymous Fri 25 May 2012 13:26:50 No.140642656 Report

Quoted By:

Blizztard giving biodrones a run for their money.

Anonymous

Anonymous Fri 25 May 2012 13:28:58 No.140642765 Report

Quoted By:

>implying Blizzard didn't just wipe characters randomly to make you buy gear from the RMAH.

Anonymous

Anonymous Fri 25 May 2012 13:28:59 No.140642767 Report

Quoted By: >>140642992

>>140641901
does much more than double it. double would be if it's either no caps, or all caps. You can use combinations as well.

Anonymous

Anonymous Fri 25 May 2012 13:32:51 No.140642992 Report

Quoted By:

>>140642767
The benefits of having case-sensitive passwords well outweighs non-case sensitive passwords. Blizzard are just once again proving how fucked up they are as a developer.

Anonymous

Anonymous Fri 25 May 2012 13:34:43 No.140643096 Report

Quoted By: >>140652371 >>140652887 >>140654376

- create hard as balls passwords for everything
- put them all in a text file
- encrypt with TrueCrypt
- copy/paste when needed
- only have to remember one password for TrueCrypt

Problem solved.

Anonymous

Anonymous Fri 25 May 2012 13:36:59 No.140643224 Report

Quoted By: >>140643401

Sometimes passwords just aren't case sensitive. I stumbled across some discussion elsewhere and apparently other large companies like Facebook or even some Norwegian bank (although there's also a mandatory physical authenticator) have case-insensitive passwords.

And it doesn't really matter all that much. Of course it IS worse security-wise, but exchanging hundreds of "maybe you should turn off caps lock" support calls to bruteforce attempt taking two decades instead of three is an understandable trade-off in my eyes. Unless it's a case of espionage or something, you simply don't bruteforce passwords (especially when the authentication-servers probably blacklist the IP after ten thousand attempts... hopefully). All the hacked accounts are acquired through keyloggers, social engineering or MAYBE trying out passwords and e-mails used on other sites after those get stolen.

Anonymous

Anonymous Fri 25 May 2012 13:39:58 No.140643401 Report

Quoted By: >>140644018

>>140643224
To solve the "turn off caps lock" just simply have a message saying "hey, check to see if you have caps lock on" after the first failed attempt, exactly how Windows does with OS login. The idea that Blizzard hasn't even bothered putting in this security feature that is of the most basic practice, is utterly terrible.

The worse thing is that Blizzard are always spouting that they offer the best security when in fact they offer the shittiest security because that random forum website uses capitalisation.

Anonymous

Anonymous Fri 25 May 2012 13:50:48 No.140644018 Report

Quoted By:

>>140643401
Yeah well, it's Blizzard. Profits come before everything else, including player enjoyment and security.

The reason they do this is to reduce the number of tech support calls due to idiots having caps lock on when typing their password. So essentially they significantly reduce the security for everyone so they can save money on tech support costs.

View Same Google ImgOps iqdb SauceNAO password_strength.png, 89KiB, 740x601

OP Fri 25 May 2012 14:41:25 No.140647042 Report

Quoted By: >>140647226 >>140647617 >>140650196 >>140650748 >>140653210 >>140659769 >>140662246 >>140668864

I'm posting XKCD for this one.

Hover text:

To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.

Anonymous

Anonymous Fri 25 May 2012 14:44:50 No.140647226 Report

Quoted By: >>140647354 >>140647902

>>140647042
ok i'm going to say that i know almost nothing about cyber security, but even i know that a dictionary attack on the second password would nail it in no time, yet the first one would never be obtained

OP Fri 25 May 2012 14:47:45 No.140647354 Report

Quoted By: >>140647617

>>140647226
Dictionary attacks really only work well on single word passwords.

Anonymous

Anonymous Fri 25 May 2012 14:49:05 No.140647429 Report

Quoted By:

I actually use passwords with random caps and i am ok remembering it. What the fuck?

Anonymous

Anonymous Fri 25 May 2012 14:53:02 No.140647617 Report

Quoted By: >>140648172

>>140647042
>>140647354
>>140647042
Problem: There is such a thing as a 'Password limit'.
I.E. passwords are stuck between normally 6~12 characters. The few that offer more don't offer it by much ( the largest I recall was perhaps 18 ). While indeed, longer passwords ARE harder to crack in a decent timeframe (as a computer will rummage EVERY possible outcome of letters per slot ), the real issue is that most places disallow you that option!

Anonymous

Anonymous Fri 25 May 2012 14:58:03 No.140647902 Report

Quoted By: >>140666827

>>140647226
How many words are the in English language? Wikipedia suggests a million, but let's be generous and say 200k. Let's imagine we're trying to use a dictionary attack on four-word password like in the comic strip.

200000^4 = 1.6*10^21

And that's a lot. Unless I calculated something wrong (I'm not good at mathematics), going through that would take about 50 million years assuming a million attempts each second.

Or let's use a fairly average vocabulary:

20000^4=1.6*10^17

That's over a million years with million attempts each second. Certainly enough for most uses.

Hopefully I didn't say anything catastrophically stupid. As said, I'm bad at math.

Anonymous

Anonymous Fri 25 May 2012 15:02:45 No.140648172 Report

Quoted By: >>140648490

>>140647617
But that's wrong, passwords can be as large as the system that stores them allows. WPA and WEP, which are encryption methods for wireless access points allow up to 64 character, 256 bit passwords.

Anonymous

Anonymous Fri 25 May 2012 15:02:48 No.140648175 Report

Quoted By: >>140649072

>>140641246

How can they defend that? It's an obvious flaw and they defend it. Fucking hell.

Anonymous

Anonymous Fri 25 May 2012 15:08:07 No.140648490 Report

Quoted By: >>140649220

>>140648172
>But that's wrong, passwords can be as large as the system that stores them allows. WPA and WEP, which are encryption methods for wireless access points allow up to 64 character, 256 bit passwords.
Yes, and what I'm SAYING is that almost every GAMING system has a hard cap on this.

Blizzard's Battle.Net for example disallows passwords past 16 characters. Try to make one, find yourself caught with a 'your passwords is too long' error. Most other locations only allow for far less ( Runescape, for example only allows at max 12. MySpace 10, and LinkedIn 16 )

Anonymous

Anonymous Fri 25 May 2012 15:19:31 No.140649072 Report

Quoted By:

>>140648175
It's a feature

Anonymous

Anonymous Fri 25 May 2012 15:22:21 No.140649220 Report

Quoted By: >>140656474

>>140648490
More examples:
TOR is limited to 16
Steam to log in is 64, but to password reset is actually limited to 16 (meaning if you use a 64 value password, you can not password reset).
GFWL is maxed at 16
FFXI is maxed at 15
PSP WEP key limit is 8 (HAHAHAHAHAHAHA)

This isn't even TALKING about say bank websites that have a EXACT limit of 6 or 8 characters, and other such bullshit.

Anonymous

Anonymous Fri 25 May 2012 15:26:58 No.140649427 Report

Quoted By: >>140650546

No matter how you look at it, it's an intended feature. For remotely guessing your password, it doesn't matter if it's 72 or 46 characters - you can't do it.

I, personally, would prefer case-sensitive password, just because it's always been done like this.

But there really is no problem using case-insensitive passwords for service like BNet.

Anonymous

Anonymous Fri 25 May 2012 15:41:02 No.140650196 Report

Quoted By:

>>140647042
But you aren't OP...I am...

Anonymous

Anonymous Fri 25 May 2012 15:47:56 No.140650546 Report

Quoted By: >>140650879

>>140649427
The problem is that it is so easy to add, and would be more beneficial to users then when someone gets hacked because their system doesn't differentiate between caps. The defence that someone will forget their password or enter it wrong too many times just proves that the people playing video games aren't capable of noting it down somewhere secure or aren't able to properly remember simple words.

Especially considering Blizzard hard cap it at 16 characters, and the majority of users probably use between 6-10 at max, it isn't that hard to remember JossiE406. Hell just add a "it seems you may have caps lock on, our system is case-sensitive". The idea that an actual technical supporter (who is probably just using copy paste responses) is still agreeing that their system is fine when Blizzard always push security so highly.

Anonymous

Anonymous Fri 25 May 2012 15:51:57 No.140650748 Report

Quoted By:

>>140647042
Analysis for first password is bullshit. There are plenty ways to make it more obscure, each adding entropy, even if you don't use all of them in your password.

In 8-letter password, if you, when making it up, either capitalize or not just the first letter, entropy raises by one bit (assuming attacker knows you do this). If you choose one letter to capitalize, entropy raises by 3 bits. If you just randomly capitalize some letters - by 8 bits. You can add all kinds of punctuation, catenate two short words instead of using one long, insert random letters and numbers in random places. With all this, entropy is nowhere near 28 bits he predicted - it times higher.

Anonymous

Anonymous Fri 25 May 2012 15:54:16 No.140650879 Report

Quoted By: >>140651167

>>140650546
> someone gets hacked because their system doesn't differentiate between caps
This is not going to happen. Can you think of a way to abuse the fact that caps in BNet passwords do not matter? No? Okay.

Anonymous

View Same Google ImgOps iqdb SauceNAO ainsley.jpg, 569KiB, 842x1093

Anonymous Fri 25 May 2012 15:56:13 No.140650982 Report

Quoted By:

>mfw how easy it is to crack all lower case passwords

Anonymous

Anonymous Fri 25 May 2012 15:57:49 No.140651067 Report

Quoted By: >>140651167

case sensitivity doesn't matter for this type of service and if you think it does you're an idiot.

Anonymous

Anonymous Fri 25 May 2012 15:59:26 No.140651167 Report

Quoted By: >>140651556 >>140651851

>>140650879
So your saying a lower cased system isn't easier to hack over a system that uses a mixture of upper case, lower case and numbers?

>>140651067
Why does it not matter? Because its hard entering your password in because you have to shift click a key? Oh god please stop it hurts so much.

It is extra security that is so common and so rookie for any online website that handles user information, yet Blizzard disregard it and they are fucking billion dollar company. This isn't right and should not be defended.

Anonymous

Anonymous Fri 25 May 2012 15:59:40 No.140651182 Report

Quoted By:

>passwords should be simpler and easier to 'use'.

Am I in fucking crazy land? I bet these retards are the first to howl when they get their accounts hacked.

Honestly. Sometimes I think if the sun smashed into our planet, it might be a good thing.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1335823257209.gif, 3MiB, 200x150

Anonymous Fri 25 May 2012 16:00:42 No.140651258 Report

Quoted By: >>140651562

>mfw i'm a student and I have better security practices than blizzard.

What the fuck is going on.

Anonymous

View Same Google ImgOps iqdb SauceNAO 2edz0v5.jpg.gif, 400KiB, 180x180

Anonymous Fri 25 May 2012 16:04:43 No.140651490 Report

Quoted By:

>mfw people cant memorize passwords.

Anonymous

Anonymous Fri 25 May 2012 16:05:59 No.140651556 Report

Quoted By: >>140651621

>>140651167
No. I'm not saying this. Case sensitive password is more difficult to brute force. What I'm saying, though, is that case sensitive or not, it is physically impossible to brute force it by making multiple requests to Battle Net service, and all other ways of hacking user's account do not become easier from passwords being case insensitive.

Anonymous

Anonymous Fri 25 May 2012 16:06:12 No.140651562 Report

Quoted By:

>>140651258

They already have the money, therefore they don't care.

>BUY BUY BUY, THIS IS THE BEST THING EVER, I WILL SUCK YOUR PELVIS OUT THROUGH YOUR DICK IF YOU JUST BUUUUUYYYYY!
I already have it bro.
>You are not even worth the carbon you're printed on. You are worse than scum. Please remove yourself from my view.

Anonymous

Anonymous Fri 25 May 2012 16:07:34 No.140651621 Report

Quoted By: >>140651921

>>140651556
And I can understand that, because most hacking is occured through social means. What I'm arguing is that a billion dollar company can't provide that little bit extra in security (and fucking simple one at that) because >I can't remember my password fuck you Blizzard

Anonymous

Anonymous Fri 25 May 2012 16:08:29 No.140651671 Report

Quoted By: >>140652367

But does it matter ? Aren't passwords hashed anyway ? You don't expect me to believe people brute login servers ?

Anonymous

Anonymous Fri 25 May 2012 16:11:51 No.140651851 Report

Quoted By:

>>140651167
Let me break this down for the tech illiterate.
8 characters is the minimum length and with 36 possible values (case insensitive) you get 2821109907456 possible combinations. AKA IT IS NOT POSSIBLE TO GUESS.

Anonymous

Anonymous Fri 25 May 2012 16:13:15 No.140651921 Report

Quoted By: >>140652102

>>140651621
I just wrote that security won't improve from switching back to case-sensitive password, and you seem to agree. Do you?

If you do, and you place yourself on the place of a person who came up with this, you have two options:
1. Leave passwords case-sensitive.
2. Make them case-insensitive, preventing problems for people who are new to this and not creating any new problems.

What do you pick?

Anonymous

Anonymous Fri 25 May 2012 16:16:35 No.140652102 Report

Quoted By: >>140652212

>>140651921
Security would increase though, as the number of combinations increase due to 26 more capital letters. If they made it simple enough to understand i.e "Hey, we use capital letters in our passwords now, ensure you remember this!" then that would be perfect and would cover anyone who can't understand.

In today's age of swamped technology, if you can't even remember a password for a game that you play constantly, or are at least alluded to playing constantly, the upped security would mean peace of mind, plus wouldn't be as hard to remember.

Anonymous

Anonymous Fri 25 May 2012 16:18:33 No.140652212 Report

Quoted By: >>140652301 >>140653540

>>140652102
But number of combination doesn't mean shit. It already is high enough. I spent my whole post before elaborating on this and you wrote that you agree. Were you joking?

Anonymous

Anonymous Fri 25 May 2012 16:19:51 No.140652280 Report

Quoted By: >>140652330

It's really just laziness on Blizzard's part, like so many things.

Anonymous

Anonymous Fri 25 May 2012 16:20:14 No.140652301 Report

Quoted By: >>140652457

>>140652212
the guy is retarded, save your breath

Anonymous

Anonymous Fri 25 May 2012 16:20:44 No.140652330 Report

Quoted By:

>>140652280
To make passwords case-insensitive you need more effort than to make them sensitive.

Anonymous

Anonymous Fri 25 May 2012 16:21:24 No.140652367 Report

Quoted By:

>>140651671
it was discovered recently that the battle.net login servers do not lock accounts after several unsuccessful logins

Anonymous

Anonymous Fri 25 May 2012 16:21:27 No.140652371 Report

Quoted By:

>>140643096
I do this too bbrofist

Anonymous

Anonymous Fri 25 May 2012 16:22:48 No.140652445 Report

Quoted By:

Does it really matter though? I mean who loses their account to people that just guess the password? Never mind the fact that they'd first have to guess the email adress too.

Anonymous

Anonymous Fri 25 May 2012 16:22:53 No.140652457 Report

Quoted By:

>>140652301
Adults are talking.

Anonymous

View Same Google ImgOps iqdb SauceNAO diablo3.png, 95KiB, 831x427

Anonymous Fri 25 May 2012 16:23:20 No.140652481 Report

Quoted By:

Anonymous

Anonymous Fri 25 May 2012 16:23:59 No.140652520 Report

Quoted By: >>140652941

Why not use special characters and numbers? It's a simply way of increasing your security.

Anonymous

Anonymous Fri 25 May 2012 16:24:23 No.140652538 Report

Quoted By:

>>140643435
Either a blizzdrone, retard or someone new here. You've never seen passwords dump have you they happen frequently. Last time I remembe was minecraft and wow

Anonymous

View Same Google ImgOps iqdb SauceNAO 1326415152327.jpg, 3KiB, 126x115

Anonymous Fri 25 May 2012 16:24:48 No.140652567 Report

Quoted By:

>Blood Elf Paladin
Confirmed for Gayboy

Anonymous

Anonymous Fri 25 May 2012 16:25:10 No.140652584 Report

Quoted By:

>>140652525
How about you read the thread before spouting shit?

Anonymous

Anonymous Fri 25 May 2012 16:25:20 No.140652591 Report

Quoted By:

>>140652525

So make a thread about those issues and stop sageing, you fag.

Anonymous

Anonymous Fri 25 May 2012 16:28:08 No.140652754 Report

Quoted By:

>>140652525
You could say that about anything you monumental retard.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1309812951436.jpg, 77KiB, 677x461

Anonymous Fri 25 May 2012 16:28:09 No.140652756 Report

Quoted By:

>>140652640
So you didnt read the thread and are bitching about it?

Anonymous

Anonymous Fri 25 May 2012 16:29:10 No.140652810 Report

Quoted By:

Why would you need a case-sensitive password? Just don't be retarded and go one websites where you can get keylogged. And come up with a password that is better than "passw0rd" or something equally as stupid. You guys are really pathetic. You actually believe Microshit when they tell you your password strength is dependent on your use of capslock? This is why gaming on my mac is so convenient. Good luck hacking my password chumps.

inb4 people fall for this

Anonymous

Anonymous Fri 25 May 2012 16:30:12 No.140652867 Report

Quoted By: >>140652930 >>140653081

So, is Blizzardrones a thing now?

Anonymous

Anonymous Fri 25 May 2012 16:30:14 No.140652871 Report

Quoted By:

3.5 million sold
deal with it, nerds

Anonymous

Anonymous Fri 25 May 2012 16:30:33 No.140652887 Report

Quoted By:

>>140643096
Look into a program called KeePass.

Anonymous

Anonymous Fri 25 May 2012 16:31:18 No.140652930 Report

Quoted By:

>>140652867
>implying blizzdrones haven't existed before this.

How fucking new are you? go back to r/gaming

Anonymous

Anonymous Fri 25 May 2012 16:31:28 No.140652940 Report

Quoted By:

>>140652843
You still haven't read the thread, why continue to reply?

Anonymous

Anonymous Fri 25 May 2012 16:31:29 No.140652941 Report

Quoted By: >>140661365

>>140652520
Why not use a passphrase of a useful length? It's much easier to remember and far, far more complex. If you password max is anywhere below 20 characters, you're basically saying you don't care about user security.

40 characters is the shortest the max should be in this day and age. Tiny password limits encourage people to reuse passwords and use crappy ones.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1337207766314.jpg, 118KiB, 368x276

Anonymous Fri 25 May 2012 16:34:09 No.140653081 Report

Quoted By:

>>140652867

Every developer has a following that believes said developer can do no wrong. It just so happens that the more popular the developer the greater the following.

And you obviously haven't spent much time on Blizzard forums.

Anonymous

Anonymous Fri 25 May 2012 16:34:16 No.140653090 Report

Quoted By:

hahaha, what kind of fanboy retard would support shitty security practices?
>I-It's a good thing that our masters reduced password strength by 26 characters! It means our passwords are easier to remember and guess!

Anonymous

Anonymous Fri 25 May 2012 16:34:26 No.140653105 Report

Quoted By: >>140653182

They should add DLC to allow case sensitive passwords in games

Anonymous

Anonymous Fri 25 May 2012 16:35:48 No.140653170 Report

Quoted By:

>>140652525
>WHY DO YOU GUYS CARE ABOUT DRM? IT'S JUST ONE ISSUE!
>WHY DO YOU GUYS CARE ABOUT SECURITY BREACHES? IT'S JUST ONE ISSUE!
>WHY DO YOU GUYS CARE ABOUT PASSWORDS? IT'S JUST ONE ISSUE!

and on and on and on and on and on

blizzard has fucked up in so many ways, it's just one giant pile now

Anonymous

Anonymous Fri 25 May 2012 16:36:04 No.140653182 Report

Quoted By:

>>140653105

>$5 a month

Anonymous

Anonymous Fri 25 May 2012 16:36:38 No.140653210 Report

Quoted By: >>140653515 >>140653548

>>140647042
Except that the author of this has shit for brains and knows exactly nothing about computer security.
It's called a dictionary attack.
BRB, stealing all his online accounts because he revealed his retarded practices

Anonymous

Anonymous Fri 25 May 2012 16:37:21 No.140653248 Report

Quoted By:

The amount of ignorance in this thread is astonishing.

Anonymous

Anonymous Fri 25 May 2012 16:38:12 No.140653285 Report

Quoted By:

Just wait until Blizzard gets hacked and it turns out they kept all their user data including passwords in plaintext.

Anonymous

Anonymous Fri 25 May 2012 16:38:19 No.140653294 Report

Quoted By: >>140653540

Knock it off already, there is no way to abuse the fact that bnet passwords are case-insensitive. DRM is bad, boring games are bad, but case-insensitive passwords have nothing to do with what's wrong with Blizzard.

Anonymous

Anonymous Fri 25 May 2012 16:42:39 No.140653515 Report

Quoted By:

>>140653210
You're going to run a dictionary attack against a password of an undetermined amount of words of varying sizes? Even if you know that it's always four words, you're still going to have some issues with that.

Anonymous

Anonymous Fri 25 May 2012 16:43:14 No.140653540 Report

Quoted By: >>140653868

>>140652212
I'm sorry I should have been more clear, I agreed that a brute force attack would be harder either way, but you then said that any other form of attack wouldn't change if it was case-sensitive or not, which I disagree with. Changing passwords to allow case-sensitive passwords would increase the security measures, even if it doesn't seem apparent to you yet. More combinations will always be better, and making a hacker try to choose between whether it was a captial E or a lower case e would be much better then "well the system doesn't have capitals so that just leaves me with 26+10*16 combinations instead of 26+26+10*16".

>>140653294
Why ignore such a glaring factor? As I've been saying, common sites that store usernames/passwords always have case-sensitive, it is just a basic measure against hacking.

>>140653479
Obviously you don't care enough for security, or you are happy to pay money to get your gear back when its stolen by some gook.

Anonymous

Anonymous Fri 25 May 2012 16:43:18 No.140653548 Report

Quoted By:

>>140653210
But he definitely is suggesting a dictionary attack, in both cases. His analysis for the password with four words is correct.

Anonymous

Anonymous Fri 25 May 2012 16:47:05 No.140653757 Report

Quoted By:

>>140653479

So make a better thread about something else. Your bitching about others solves nothing.

>>140653290

>Focus on shitty publishers, DLC and Diablos shitty DRM

Non of those are issues, only opinions about if DLC is good or not, publishers being good or bad or if you enjoy DRM. The thread is about a potential security issue.

Get it straight Toady.

Anonymous

Anonymous Fri 25 May 2012 16:48:55 No.140653868 Report

Quoted By:

>>140653540
> "well the system doesn't have capitals so that just leaves me with 26+10*16 combinations instead of 26+26+10*16".
This is a brute force attack. By brute force attack I mean any attack where you try passwords repeatedly until one matces. Brute force attacks do not work on remote servers. You only consider brute force attack when you have a hashed password.

And so, my point is, because case-sensitive passwords are only better then case-insensitive for brute force attacks, there is no point in having them case-sensitive.

> Why ignore such a glaring factor
So that you don't have problems with hundreds with their caps lock on of users calling tech support. This is an advantage. No disadvantages. The choice should be obvious.

Anonymous

Anonymous Fri 25 May 2012 16:51:49 No.140654031 Report

Quoted By: >>140654095

hey guys my password was lememeface4chon and my acc got hacked,fuck blizzard bunch of hippy money grabing jews

Anonymous

Anonymous Fri 25 May 2012 16:52:54 No.140654095 Report

Quoted By:

>>140654031
That's a fairly strong password.

Anonymous

Anonymous Fri 25 May 2012 16:53:11 No.140654113 Report

Quoted By:

I can log in leaving out the character past 16 in my password. Great!

Anonymous

View Same Google ImgOps iqdb SauceNAO password cracking.png, 52KiB, 1777x518

Anonymous Fri 25 May 2012 16:53:44 No.140654153 Report

Quoted By: >>140654387

If your password isn't at least 20 characters long, you are doing it wrong.

Anonymous

Anonymous Fri 25 May 2012 16:53:56 No.140654161 Report

Quoted By:

>>140641817
>cases

clever

Anonymous

Anonymous Fri 25 May 2012 16:55:00 No.140654230 Report

Quoted By:

>>140653870

>Implying I'll ever read through an post of sagefag manchild imagining that it's actually a non-security issue.

Anonymous

Anonymous Fri 25 May 2012 16:56:51 No.140654356 Report

Quoted By: >>140654384

wait, so do they store them as plain text or something? If they had them hashed then the case would matter.

Anonymous

Anonymous Fri 25 May 2012 16:57:03 No.140654371 Report

Quoted By:

>>140654323

Which poster do you think I am?

Anonymous

Anonymous Fri 25 May 2012 16:57:11 No.140654376 Report

Quoted By: >>140654402 >>140655587

>>140643096
>HDD dies or fails
>your life is fucked

Problem solved

Anonymous

Anonymous Fri 25 May 2012 16:57:26 No.140654384 Report

Quoted By: >>140655110

>>140654356

I assume they just lowercase it before hashing.

Anonymous

Anonymous Fri 25 May 2012 16:57:32 No.140654387 Report

Quoted By: >>140654491

>>140654153
> 200,000,000 guesses per second
Maybe you should post in a relevant thread.

Anonymous

Anonymous Fri 25 May 2012 16:57:46 No.140654402 Report

Quoted By:

>>140654376
>recover from tape drive
>problem solved

Anonymous

Anonymous Fri 25 May 2012 16:57:48 No.140654406 Report

Quoted By:

>>140654323
For someone who is constantly saging to not bump the thread, you're giving an awful amount of input.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1297432501877.jpg, 26KiB, 526x482

Anonymous Fri 25 May 2012 16:58:06 No.140654420 Report

Quoted By: >>140654559 >>140654648

>mfw my passwords are NATO military alphabet words mixed with numbers

I also randomly replace letters with 1337 equivalents. I also sprinkle capitals in there, but I wouldn't consider them the lynchpin of the password. My passwords get maximum strength on every tester I've tried before I'm even half done typing.

Get on my level of paranoia.

Anonymous

pasta

Anonymous Fri 25 May 2012 16:58:19 No.140654437 Report

Quoted By: >>140654670 >>140654753

Apparently all the hacking going on in D3 is that blizzard sends a session id of everyone playing the game to each client, all in clear text. All that a hacker needs to do is take that id and insert it in their client and they can login as you. Your friends all have session ids that you can access any time so even if you aren't added in a public game, you are still vulnerable if you have a friendslist.

Of course blizzard won't admit it and we might never actually see them admit it, but someone already demonstrated how it's done and their a program floating around (in chinese) that automates the process. Best part is that blizzard never sees it on their end since everything is done clientside somehow (like GMs see no activity on the account when everything is taken).

Anonymous

Anonymous Fri 25 May 2012 16:59:06 No.140654491 Report

Quoted By: >>140654942

>>140654387
>>140654249
how many attempts does d3 give you before the account is locked down?

you could defeat any ip-based block with a botnet

Anonymous

Anonymous Fri 25 May 2012 16:59:22 No.140654516 Report

Quoted By:

>>140654408

That's not me.

Anonymous

Anonymous Fri 25 May 2012 16:59:58 No.140654559 Report

Quoted By: >>140654921

>>140654420
>Revealing your password methods to people on the internet
Great security there bro

Anonymous

pasta

Anonymous Fri 25 May 2012 17:00:55 No.140654619 Report

Quoted By: >>140654753 >>140654961 >>140655071

http://us.battle.net/d3/en/forum/topic/5271500000

Two Blizzard Forum users with IT experience, Fremd and Maged, discovered that, despite "common knowledge" that password security was being handled properly on Blizzard's end, they could enter their passwords wrongly into the client any number of times, even attempting this with spoofed (faked) IPs, and not get locked out.

Let me explain this in layman's terms. Blizzard didn't put in a basic security measure that stops people from simply typing in random numbers and letters until they get your password. Something simple, bruteforce hacking can accomplish. Something they did with World of Warcraft. And, most importantly, something they *didn't* do with a game that's going to have a Real Money Auction House.

Add to this that it was also discovered that passwords are not case sensitive, and the security barn door has been shown to be firmly locked open. Normally, case insensitive passwords wouldn't be a problem with anti-bruteforce measures like limited password attempts, but in this case? It makes the problem worse.

Anonymous

Anonymous Fri 25 May 2012 17:01:06 No.140654632 Report

Quoted By: >>140654741

>>140654408
That is me, and you actually not being worried that a system that holds a whole lot of important information to gamers saddens me. It is a security risk, one that is so rookish that it makes Blizzard look terrible. All for the simplicity of their users because they can't remember a password.

Anonymous

Anonymous Fri 25 May 2012 17:01:19 No.140654648 Report

Quoted By: >>140654921

>>140654420

Enjoy your hard to remember password that's easy to force.

Anonymous

Anonymous Fri 25 May 2012 17:01:43 No.140654670 Report

Quoted By:

>>140654437
> Apparently all the hacking going on in D3 is that blizzard sends a session id of everyone playing the game to each client, all in clear text.
No fucking way, I refuse to believe it.

I imagine they are just sending session id in plain text, so whoever can spy on your packets, can steal your shit too.

What you're suggesting is too much of an idiotic mistake, even newbie programmers won't do this.

Source?

Anonymous

Anonymous Fri 25 May 2012 17:02:53 No.140654741 Report

Quoted By:

>>140654632
And yet you will never reply with a way to abuse this 'security risk'. You can't and it's not.

Anonymous

Anonymous Fri 25 May 2012 17:03:01 No.140654753 Report

Quoted By: >>140654818

>>140654437
>>140654619
Haha this just proves my entire thread. Blizzard are losing the plot. What's the bet the passwords are plain text with no hashing or salting.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1337847008161.jpg, 94KiB, 673x720

Anonymous Fri 25 May 2012 17:03:48 No.140654793 Report

Quoted By:

>>140641246
This fucking explains it why I accidently misstyped my password yesterday and still got logged in.. (misstyped my case'd letters) fucksake

Anonymous

Anonymous Fri 25 May 2012 17:04:10 No.140654818 Report

Quoted By:

>>140654753
>plain text with no hashing/salting
jesus christ it's like it's the 80's all over again!

Anonymous

Anonymous Fri 25 May 2012 17:05:45 No.140654921 Report

Quoted By:

>>140654559
Totally broski. My random choice of letters, capitals, and numbers is kaput now. Bro tip: I don't even always use military alphabet, they're just a good starting place.

>>140654648
Just picking from the alphabet and hitting the shift key: ViCtOR9374YAnk3EK1lo3857. I have maybe 5 things I care about enough to use passwords like that for, and I remember them all easily because I'm not retarded, and I use them often enough. Call me crazy, but I consider that harder to force than "Scruffy5".

Anonymous

Anonymous Fri 25 May 2012 17:06:16 No.140654942 Report

Quoted By:

>>140654491
Do you see that chart someone posted? Where they have it going as 200000000 guesses per second? You won't get that many. You will probably get 1/sec, given how long it seems to take Blizzard's servers to respond to password entries when I make a typo. Even if you're brute forcing it, you'd better hope that person has a short, stupid password.

Which, granted, Blizzard encourages with its short password max, but still.

Anonymous

Anonymous Fri 25 May 2012 17:06:35 No.140654961 Report

Quoted By: >>140655135

>>140654619
10 tries no problem but after 1000 that account is getting locked

Anonymous

Anonymous Fri 25 May 2012 17:06:45 No.140654972 Report

Quoted By:

>Not having you password Revolutionhero4689
Enjoy never having some chink steal your stuff

Anonymous

Anonymous Fri 25 May 2012 17:08:24 No.140655071 Report

Quoted By: >>140655375

>>140654619
> attempting this with spoofed (faked) IPs
And how did they get responses from BNet with their address spoofed I wonder? What does this even have to do with anything?

Two faggots entered their password 10 times and didn't get locked out. This doesn't really mean anything.

Anonymous

Anonymous Fri 25 May 2012 17:09:07 No.140655110 Report

Quoted By:

>>140654384
didnt windows 98 do that?

Anonymous

Anonymous Fri 25 May 2012 17:09:30 No.140655131 Report

Quoted By:

Guys, almost literally no finding other peoples' passwords come from brute forcing.

When it comes to security the best thing you can do is have a password listed in the common hash function tables and use different passwords for different sites.

Anonymous

Anonymous Fri 25 May 2012 17:09:33 No.140655135 Report

Quoted By: >>140655192 >>140655301

>>140654961
Well some of the guys in that forum thread went upwards of 100 tries without anything happening, so I doubt any lock-out is on.

Anonymous

Anonymous Fri 25 May 2012 17:10:34 No.140655192 Report

Quoted By: >>140655323 >>140655375

>>140655135

They just activate a capcha after 3 or 5 attempts.

Anonymous

Anonymous Fri 25 May 2012 17:12:41 No.140655301 Report

Quoted By: >>140655379

>>140655135
Yet Blizzard's security occasionally goes nuts when I try to log in while using my laptop in a location I frequently go to outside of my home, claiming it's suspicious activity. At one point it force a password change twice within the span of three days, once when I was out a friend's house, then again when I logged in *at my own home* a couple days later. Because logging on from places I go to extremely regularly is suspicious.

Anonymous

Anonymous Fri 25 May 2012 17:13:07 No.140655323 Report

Quoted By: >>140655415

>>140655192
Better hope that the captcha doesn't have some easily bypassable flaw like the early days of the 4chan one.

If I remember correctly you could just type anything into the sound captcha and it would go through.

Anonymous

Anonymous Fri 25 May 2012 17:13:57 No.140655375 Report

Quoted By: >>140655613

>>140655071
You can create a Botnet to brute force the password with all the data being sent to the Master
>>140655192
Let's hope captcha-recognition software sucks

Anonymous

Anonymous Fri 25 May 2012 17:14:04 No.140655379 Report

Quoted By: >>140655860

>>140655301
Mmm, would be interesting to test to see if Diablo 3 does it. Sounds like WoW's security is tight except for the non-capitals, however D3 is looking to be wide open.

Anonymous

Anonymous Fri 25 May 2012 17:14:40 No.140655415 Report

Quoted By: >>140656609

>>140655323

That's not really a security flaw. Only one of the words is for security, it's for making money. And you can still do that.

Anonymous

Anonymous Fri 25 May 2012 17:15:26 No.140655462 Report

Quoted By:

I can't even remember my password, it's all in my fingers. I just start with the finger placing I've always done, and then the rest comes, even with caps. I have no idea why it's so hard for some people to just do that, much better than actually having to remember a real word.

Anonymous

Anonymous Fri 25 May 2012 17:17:18 No.140655587 Report

Quoted By:

>>140654376
>not making backups.

Anonymous

Anonymous Fri 25 May 2012 17:17:34 No.140655603 Report

Quoted By:

I'm not defending blizz, but http://www.codinghorror.com/blog/2012/04/speed-hashing.html

Anonymous

Anonymous Fri 25 May 2012 17:17:42 No.140655613 Report

Quoted By: >>140655736

>>140655375
1. Spoofed IP address is not what you think it is. It's not an address of someone in your botnet.
2. The server limits guess attempts per unit of time per user. If one member of botnet just sent a password trying to login, no other would be able to for the next second or so.

Anonymous

Anonymous Fri 25 May 2012 17:19:34 No.140655736 Report

Quoted By: >>140655919

>>140655613
Sorry I meant to correlate 'spoofed IPs' with 'real IPs in which a zombie could use' in the botnet scenario

Anonymous

Anonymous Fri 25 May 2012 17:21:44 No.140655860 Report

Quoted By: >>140656017

>>140655379
I wouldn't call WoW's security tight, honestly. As much as people babble on about keyloggers, one of the people I know got his account hacked after he'd been inactive for months and had been running the game on Linux via Wine the entire time he played and up to the point his account was compromised. Not exactly a situation in which it's likely he got a keylogger installed by a bad executable or the like.

Actually come to think of it both people I know personally who had their accounts compromised had inactive accounts for several months. So not only did someone get access to their account they also had time bought for them. Amusing.

Anonymous

Anonymous Fri 25 May 2012 17:22:55 No.140655919 Report

Quoted By:

>>140655736
The author of the article meant the same. I just pointed out that he doesn't know what spoofed IP address means and so it's probably better to ignore anything he says. It was silly of you to not notice that.

Anonymous

Anonymous Fri 25 May 2012 17:24:28 No.140656017 Report

Quoted By: >>140656417

>>140655860
what about phising? or middle men attack? or dns poisoning?
Linux does not protect you against that

Anonymous

View Same Google ImgOps iqdb SauceNAO 1323135441168.jpg, 42KiB, 640x427

Anonymous Fri 25 May 2012 17:25:19 No.140656073 Report

Quoted By: >>140656282 >>140656510 >>140670269

I think the main issue is that if they suddenly made passwords case sensitive (assuming they're even stored as such and the capitalization isn't stripped beforehand), they're going to get millions of people who aren't able to get into their accounts because they held shift too long or had caps lock turned on when they first chose their password.

And you still get 20 characters of letters numbers and special characters which is more than enough to create a secure password.

Anonymous

Anonymous Fri 25 May 2012 17:27:57 No.140656230 Report

Quoted By:

What's the problem here? I hate kotickblizzard as much as the next guy, but case insensitive passwords are nothing new. Sure, it reduces the security a little, but that's hardly the issue since the hackers aren't just bruteforcing every password there is.
That's a simple design decision, I'm sure the architects had their reasons for it.
Want more security? Slap on a couple more characters you dumb fucks

Anonymous

Anonymous Fri 25 May 2012 17:29:02 No.140656282 Report

Quoted By: >>140656352

>>140656073

Actually you just get 16. I can log out without writing out the characters past the 16th.

Anonymous

Anonymous Fri 25 May 2012 17:30:27 No.140656352 Report

Quoted By:

>>140656282

You're right I just checked. I have no idea why I thought it was 20

Anonymous

View Same Google ImgOps iqdb SauceNAO 0001-1306868815077.png, 95KiB, 303x303

Anonymous Fri 25 May 2012 17:30:51 No.140656371 Report

Quoted By: >>140656418 >>140657325

>mfw I'm security specialist at large software company and this thread gave me cancer

Anonymous

Anonymous Fri 25 May 2012 17:31:45 No.140656417 Report

Quoted By:

>>140656017
Aside from the first one-- it's highly unlikely he'd fall for a phishing attempt-- those are possible but not particularly likely.

Anonymous

Anonymous Fri 25 May 2012 17:31:46 No.140656418 Report

Quoted By:

>>140656371
Grats. I hope you die soon.

Anonymous

Anonymous Fri 25 May 2012 17:32:02 No.140656438 Report

Quoted By: >>140656671 >>140656796 >>140656832

Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator. Shutup, buy an authenticator.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1323804746037.jpg, 66KiB, 460x300

Anonymous Fri 25 May 2012 17:32:49 No.140656474 Report

Quoted By: >>140656554 >>140656692 >>140656712 >>140657232 >>140658787

>>140649220

>bank websites that have a EXACT limit of 6 or 8 characters

fucking this. My bank won't let me use more than 12 characters, no special symbols and it's case insensitive.

Anonymous

Anonymous Fri 25 May 2012 17:33:22 No.140656510 Report

Quoted By:

>>140656073
20 is still pretty short. Granted, the average user is just going to try for something like l33twowpassw0rd but I'd like to be able to have an actual sentence with punctuation and meaning.

Anonymous

Anonymous Fri 25 May 2012 17:34:11 No.140656554 Report

Quoted By:

>>140656474
WHAT?

Anonymous

Anonymous Fri 25 May 2012 17:34:32 No.140656579 Report

Quoted By:

>>140656492
>implying I don't already

Anonymous

Anonymous Fri 25 May 2012 17:34:56 No.140656609 Report

Quoted By:

>>140655415
no bro, he was talking about the AUDIO captchas

Anonymous

Anonymous Fri 25 May 2012 17:35:51 No.140656671 Report

Quoted By:

>>140656438
What the fuck is this retard going on about

Anonymous

Anonymous Fri 25 May 2012 17:36:07 No.140656692 Report

Quoted By:

>>140656474
I've seen at least one site that requires numbers *in the username* but has other restrictions on the password that makes it harder for me to make a decent password. Can't put numbers in certain places, etc.

Anonymous

Anonymous Fri 25 May 2012 17:36:25 No.140656712 Report

Quoted By: >>140669646

>>140656474
My bank sends you a keycode paper in the mail which you have to match with a random number they give you every time you login in addition to your password.

Anonymous

View Same Google ImgOps iqdb SauceNAO herp.png, 80KiB, 256x270

Anonymous Fri 25 May 2012 17:36:54 No.140656747 Report

Quoted By: >>140656903 >>140657043

>Thinking you know anything about the mathematics of password security
>mfw this entire thread

Anonymous

Anonymous Fri 25 May 2012 17:37:28 No.140656796 Report

Quoted By:

>>140656438
>Who cares about security if you don't have to pay extra for it!

Anonymous

Anonymous Fri 25 May 2012 17:38:00 No.140656832 Report

Quoted By:

>>140656438
Blizzard_Marketing.txt

Anonymous

Anonymous Fri 25 May 2012 17:38:49 No.140656885 Report

Quoted By:

blizzard just generally has bad security practices. They only allow lowercase and numbers, which is fucking retarded.

you're talking about 36^x vs 96^x. In a 13 character password, just adding ONE capital and ONE special character in addition to a number makes the possible password pool go from 36^13 to 96^13.

Blizzard's strategy: Enforce bad password practice and then blame the user and force them to buy your special "authenticator."

Anonymous

Anonymous Fri 25 May 2012 17:39:06 No.140656903 Report

Quoted By: >>140658176

>>140656747
The only sane person.

Really, the caps are not necessary anymore, if there is any attack to your password, it probably will be against blizz servers and databases, wich are encrypted.

Putting random characters is not safe anymore.

Dont delude yourself /v/

Anonymous

Anonymous Fri 25 May 2012 17:41:24 No.140657043 Report

Quoted By: >>140657258

>>140656747
>greentexting but not actually saying anything useful

Sure told us.

Anonymous

Anonymous Fri 25 May 2012 17:41:39 No.140657060 Report

Quoted By: >>140657108 >>140658176

Who the fuck cares? No one uses capitals in passwords so what the fuck is the problem... God you guys love complaining

Anonymous

Anonymous Fri 25 May 2012 17:41:40 No.140657061 Report

Quoted By:

I am horribly confused why they would do more work to get worse security as it's not more convenient and it's a source for bad publicity. Or otherwise, what kind of wacky tools are they using where case is insensitive by default?

Anonymous

Anonymous Fri 25 May 2012 17:42:21 No.140657108 Report

Quoted By:

>>140657060
>They shouldn't give us extra security!

Anonymous

View Same Google ImgOps iqdb SauceNAO alrighty then.jpg, 35KiB, 291x400

Anonymous Fri 25 May 2012 17:42:55 No.140657145 Report

Quoted By: >>140657279

>people saying no case sensitivity is a major security risk
>twelve year olds defending the change because "it's annoying to get it wrong"
I bet my bottom vidya that the people defending this have had their accounts hacked multiple times and have bought an authenticator.

Anonymous

Anonymous Fri 25 May 2012 17:44:16 No.140657232 Report

Quoted By:

>>140656474

My bank has this new retarded system now where if you check your bank info online you need:

Account Number
Acct Password
Date of birth
Answer to your security questions EACH time you log in.

Now i just go to the local ATM when i need to check my balance since I got locked out of my online account.

Anonymous

Anonymous Fri 25 May 2012 17:44:43 No.140657258 Report

Quoted By: >>140658283 >>140659832

>>140657043
If an attacker has the full user database, enabling any brute forcing, it's basically game over anyway, that's pretty much all you need to know

Anonymous

Anonymous Fri 25 May 2012 17:44:56 No.140657279 Report

Quoted By:

>>140657145
I just told my friend that Blizz games don't have case sensitive passwords. He said:
>Huh, I guess that's why I was forced to buy this auth

Anonymous

Anonymous Fri 25 May 2012 17:45:31 No.140657325 Report

Quoted By: >>140657887 >>140658278

>>140656371
So what's your take on it? Is Blizzard doing the right thing?

Anonymous

Anonymous Fri 25 May 2012 17:46:34 No.140657395 Report

Quoted By:

>Please leave discussions like this to the General Discussion forums. I'm not going to keep posting on threads if my answer to someone's bug report is a huge discussion about something that isn't a bug.
So, people actually concerned with security after the "answer" that wasn't really an answer isn't worth taking a serious look at their security methods? DEVELOPER OF THE YEAR ALL YEARS!

Anonymous

Anonymous Fri 25 May 2012 17:52:58 No.140657887 Report

Quoted By: >>140658321 >>140658783

>>140657325
Facebook does a similar thing, it's a negligible decrease in security and to second guess Facebook's and Blizzard's security experts is laughable

And no, that's not an appeal to authority, the companies' web presences would be in smouldering ruins now if they were bad

Anonymous

Anonymous Fri 25 May 2012 17:57:18 No.140658176 Report

Quoted By:

>>140657060
>>140656903
So you actually don't care about extra security at all? That extra upper case character increases your security and decreases the chance of being hacked. Why is this a bad thing? Why do you not want extra security? Or do you like being hacked?

Anonymous

Anonymous Fri 25 May 2012 17:58:41 No.140658278 Report

Quoted By: >>140658616

>>140657325
>Handle millions of players with a billion earning MMO
>/v/ thinks they can't handle security
>/v/ thinks they know better
Oh lawd my sides are moving on their own

Anonymous

Anonymous Fri 25 May 2012 17:58:43 No.140658283 Report

Quoted By: >>140658586 >>140660707

>>140657258
Some actual verifiable information on that would be nice, instead of just saying "here, trust me."

Some links discussing how easy it is to grab passwords when there is a properly salted hash etc.-- I'm making the assumption here that Blizzard is smart enough to at least do salting.-- to the point that your password complexity is utterly meaningless would be nice. I need something to read as I'm kind of bored.

Anonymous

Anonymous Fri 25 May 2012 17:59:18 No.140658321 Report

Quoted By: >>140658682

>>140657887
It doesn't matter if their "security experts" otherwise are good. This is a laughable practice as it only takes away and doesn't add anything. Adding more code to remove a feature (if case sensitivity can be called that, basic as it is) does nothing but introduce the possibility for more bugs.

Anonymous

Anonymous Fri 25 May 2012 18:02:56 No.140658565 Report

Quoted By:

Hey retards,
The advantage to having all your information serverside is if your account were compromised they can easily roll-back your account.
It's really not worth hacking when they can easily trace the source of the hack (e.g. accounts where things were transferred to and ban those) and also return all your stuff.

Anonymous

Anonymous Fri 25 May 2012 18:03:22 No.140658586 Report

Quoted By: >>140659007

>>140658283
http://www.game-boyz.com/content/node/18677
This guy is updating on the matter

Anonymous

Anonymous Fri 25 May 2012 18:03:50 No.140658616 Report

Quoted By: >>140658823

>>140658278
They certainly couldn't handle logins first day.

Anonymous

Anonymous Fri 25 May 2012 18:05:06 No.140658682 Report

Quoted By:

>>140658321
>This is a laughable practice as it only takes away and doesn't add anything.
>Not understand the purpose of this at all

I guess only the retards are left in this thread

Anonymous

Anonymous Fri 25 May 2012 18:06:29 No.140658783 Report

Quoted By: >>140658918

>>140657887
>and to second guess Facebook's and Blizzard's security experts is laughable
> Facebook
>security
Yeah you have no idea what you're talking about

Anonymous

Anonymous Fri 25 May 2012 18:06:33 No.140658787 Report

Quoted By: >>140659019 >>140659084

>>140656474
You need a better bank.

My bank REQUIRES 1 Capital letter, 1 lower, 1 special, and 1 number and a MINIMUM password of 8 characters.

In addition, they also ask a security question from a list of 5 questions you approve if you log on outside of your "home" computer.

Anonymous

Anonymous Fri 25 May 2012 18:07:14 No.140658823 Report

Quoted By:

>>140658616
Servers were full retard.
It has nothing to do with log ins not working

Anonymous

Anonymous Fri 25 May 2012 18:08:24 No.140658918 Report

Quoted By: >>140659350

>>140658783
So, when was the last time the contents of the master user db was dumped?

I thought so

Anonymous

Anonymous Fri 25 May 2012 18:09:52 No.140659007 Report

Quoted By: >>140659550

>>140658586

Interesting, though a summary of things already discussed and also not talking about how a brute force attack against a database of passwords once the person has it means that it's basically "game over", implying that any password will be cracked within a reasonable amount of time, regardless of its complexity.

Anonymous

Anonymous Fri 25 May 2012 18:10:08 No.140659019 Report

Quoted By: >>140659370

>>140658787

Mine is the same, but it also requires a second unique password to move any money and they have to be typed into an onscreen keyboard that shifts around with every click.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1330286993132.gif, 3MiB, 267x199

Anonymous Fri 25 May 2012 18:10:19 No.140659034 Report

Quoted By: >>140659174

>raging over case sensitive passwords
>200 replies
>raging over case sensitive passwords
>200 REPLIES

Anonymous

Anonymous Fri 25 May 2012 18:11:06 No.140659084 Report

Quoted By:

>>140658787

Pa$sw0rd

Anonymous

Anonymous Fri 25 May 2012 18:11:21 No.140659101 Report

Quoted By:

>>140641817
I'm glad new /v/ doesn't give a fuck about computer science anymore.

It reaffirms my belief that summer is finally here.

Anonymous

Anonymous Fri 25 May 2012 18:12:26 No.140659174 Report

Quoted By: >>140659984

>>140659034
Anti-intelectual summerfag. Go back to Reddit. I heard they're full of people like you who can't even manage basic computer knowledge.

Anonymous

Anonymous Fri 25 May 2012 18:14:37 No.140659350 Report

Quoted By: >>140659604

>>140658918
who needs that when they can do this every week:
http://www.pcworld.com/article/255898/crossbrowser_worm_spreads_via_facebook_security_experts_warn.h
tml
at least apple requires a screening of some sort. later

Anonymous

Anonymous Fri 25 May 2012 18:14:56 No.140659370 Report

Quoted By: >>140659551 >>140659559

>>140659019

True story: I know the guy that came up with the "shifting keyboard" technology for banks (or at least ATMs). That's right, it wasn't even a copyrighted idea until just recently. Dude made a fortune.

Anonymous

Anonymous Fri 25 May 2012 18:17:40 No.140659550 Report

Quoted By: >>140659797 >>140659832

>>140659007
Because it's not "game over" unless you have a super computer that does 500k+ passwords a second or some shit. Every additional character increases the complexity exponentially so it's not a drop of a hat.

Anonymous

Anonymous Fri 25 May 2012 18:17:42 No.140659551 Report

Quoted By:

>>140659370

You can't copyright ideas.

Anonymous

Anonymous Fri 25 May 2012 18:17:49 No.140659559 Report

Quoted By:

>>140659370
Shifting keyboards have been around-- even as just jokes-- since the 90s. I hope it was more than just that, otherwise that's one of the most trivial things to copyright that I've heard of lately.

Anonymous

Anonymous Fri 25 May 2012 18:18:32 No.140659604 Report

Quoted By:

>>140659350
>A voluntarily installed malware extension constitutes a facebook security hole

Ok guy

Anonymous

View Same Google ImgOps iqdb SauceNAO 1336076468286s.jpg, 2KiB, 83x126

Anonymous Fri 25 May 2012 18:20:58 No.140659769 Report

Quoted By:

>>140647042
I just put both these passwords into a key encryption program.

It told me the first one (that he estimated at 28 Bits), is actually 69 Bits.

The second one (that he estimated at 44 Bits), is actually 77 Bits.

But the second one has more than double the amount of characters than the first. If you limit the second password to just "correcthorse", it yields 44 Bits. If you extend the first password to "Tr0ub4dor&3l33tsUprc00L92" you get 137 Bits.

Anonymous

Anonymous Fri 25 May 2012 18:21:21 No.140659797 Report

Quoted By:

>>140659550
You can hire a near-enough-supercomputer from EC2 for a $100-300/hr

It's not that hard

Also you can do thousands of millions of hashes per second with that kind of setup

Anonymous

Anonymous Fri 25 May 2012 18:21:53 No.140659832 Report

Quoted By:

>>140659550
That was my point, hence my question to >>140657258

Anonymous

View Same Google ImgOps iqdb SauceNAO 1298483420412.gif, 146KiB, 250x250

Anonymous Fri 25 May 2012 18:24:15 No.140659984 Report

Quoted By:

>>140659174

One of us is in the middle of setting up a VPN for a company with multiple branch offices throughout the state of Florida (granted, not difficult) and the other one is a neckbeard complaining about summer /v/. I'll let you take one guess as to who is who.

Anonymous

Anonymous Fri 25 May 2012 18:34:41 No.140660707 Report

Quoted By: >>140661365

>>140658283
already posted
http://www.codinghorror.com/blog/2012/04/speed-hashing.html

Anonymous

Anonymous Fri 25 May 2012 18:44:08 No.140661365 Report

Quoted By: >>140661653

>>140660707
The link itself states that particularly long passwords are *still* absurdly time-intensive to crack. I'm not one of the people stating that upper case is critical, although it's nice. I'm one saying that I should be allowed to use at least 40 characters in a password, and the link you posted recommends *12* as a minimum.

Hell, the link you posted even specifically recommends passphrases, which I mentioned back in >>140652941 as a better idea. Once again, I'm asking why someone appears to think that *any* password/passphrase is going to be compromised if the attacker has access to the database(s), regardless of password complexity.

Anonymous

Anonymous Fri 25 May 2012 18:48:02 No.140661653 Report

Quoted By: >>140661930

>>140661365
oh sorry i did not follow your whole train of thought.
Also, we are discussing about the Blizz not allowing uppercase/lowercase passwords

Anonymous

Anonymous Fri 25 May 2012 18:51:40 No.140661930 Report

Quoted By:

>>140661653
True, but the thread kind of fragmented and I was somewhat ignoring that topic because it looks like a bunch of people who know just enough to think they know a lot trying to discuss it. On the upside, the information on the use of GPUs to brute force passwords is really interesting, so it's not a total loss of a thread.

But yeah, the thing I was asking about was kind of hard to follow here, sorry about that.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1336939493870.jpg, 7KiB, 145x120

Anonymous Fri 25 May 2012 18:55:56 No.140662246 Report

Quoted By: >>140662554

>>140647042
>implying a website will allow you to brute force a billion combinations, several thousands per second

Anonymous

View Same Google ImgOps iqdb SauceNAO 1336861761112.png, 651KiB, 620x786

Anonymous Fri 25 May 2012 18:59:51 No.140662554 Report

Quoted By: >>140662638 >>140662903

>>140662246
uhh, dude Blizzard does NOT block you after making any number of wrong guesses.

Tried it myself, 30 wrongly typed passwords and it would let me keep on trying.

Yes, it's retarded but this is Activizzard we're talking about.

Anonymous

Anonymous Fri 25 May 2012 19:01:04 No.140662638 Report

Quoted By: >>140662912

>>140662554
I'm sure they block you after a few hundred attempts.

I'm not sure if I'm making a joke here or not.

Anonymous

Anonymous Fri 25 May 2012 19:04:35 No.140662903 Report

Quoted By: >>140663472

>>140662554
They are going to make it more than 30.

Try a couple hundred.

Anonymous

View Same Google ImgOps iqdb SauceNAO tears.gif, 2MiB, 372x262

Anonymous Fri 25 May 2012 19:04:46 No.140662912 Report

Quoted By:

>>140662638
Joke or not
>mfw
when I tried this myself and saw that he wasn't trolling

Anonymous

Anonymous Fri 25 May 2012 19:06:23 No.140663056 Report

Quoted By:

GUYS GUYS GUYS

SHITTY SECURITY IS A FEATURE
STOP BEING SO ENTITLED

Anonymous

View Same Google ImgOps iqdb SauceNAO such horrors.jpg, 174KiB, 500x900

Anonymous Fri 25 May 2012 19:08:09 No.140663183 Report

Quoted By: >>140663302

>Chinks constantly bruteforcing passwords
Is this why the Blizzard servers are laggy pieces of shit?

Anonymous

Anonymous Fri 25 May 2012 19:09:45 No.140663302 Report

Quoted By: >>140663801

>>140663183
It's unlikely that someone would be trying to brute force passwords by attempting server logins. That's not only time-consuming as hell, but I would hope would throw up a red flag *somewhere* even if they don't lock you out.

Anonymous

Anonymous Fri 25 May 2012 19:12:06 No.140663472 Report

Quoted By:

>>140662903
I'm not that autistic. Besides the only thing I have on my account is a fiver year inactive WoW account.
They can have it.

Anonymous

Anonymous Fri 25 May 2012 19:16:25 No.140663801 Report

Quoted By:

>>140663302
if an automated system does not simply autoblock it I think it's little likely that someone even bothers watching for stuff like that.

Anonymous

Anonymous Fri 25 May 2012 19:18:46 No.140664003 Report

Quoted By:

Wow, I just tried this and it works

I had to fight my muscle memory constantly trying to hit shift automatically at the right times though, shit's weird.

Anonymous

Anonymous Fri 25 May 2012 19:26:08 No.140664596 Report

Quoted By: >>140664827 >>140665163 >>140668135

If someone was going to bruteforce my password by going through every combination wouldn't that make "ZZZZZZZZ" the strongest 8 digit password since it would be the last thing to be guessed?

Anonymous

Anonymous Fri 25 May 2012 19:28:40 No.140664827 Report

Quoted By:

>>140664596
no, but i like your logic. they don't try them in alphabetical order.

Anonymous

Anonymous Fri 25 May 2012 19:30:55 No.140665018 Report

Quoted By: >>140665163

I think the best thing to do with a password, is to use words..but made up words like...pisciatoio or cibernacolo or shadernessitude, retoolosh, brayshgord, piridilicolo and so on.

Anonymous

Anonymous Fri 25 May 2012 19:32:38 No.140665163 Report

Quoted By: >>140667013 >>140667425

>>140664596
That's still like being the strongest first-grader on the playground though.

>>140665018
The best thing to do with a password is use a passphrase of sufficient length. Unfortunately, many places will not allow you enough space to do this.

Anonymous

Anonymous Fri 25 May 2012 19:35:23 No.140665381 Report

Quoted By: >>140665778 >>140667307

Wait does blizzard really not have lockouts and case sensitive passwords?

That's fucking awful especially when one of their solutions to this problem is 2BUY THIS THING!"

Anonymous

Anonymous Fri 25 May 2012 19:36:35 No.140665494 Report

Quoted By:

While we're at it, type down 10 digits of random letters, capitals and numbers in notepad.

Then type it again and hit enter, repeat this for 1 minute until you have a huge line of your password.

Congratulations, you've most likely committed that to muscle memory, even if you forget what the password is you should be able to remember the finger movements.

Anonymous

Anonymous Fri 25 May 2012 19:39:37 No.140665778 Report

Quoted By: >>140666364

>>140665381
They do have lockouts.

Just because some assholes manually put in the wrong pass 10 times and it didn't lock them out, doesn't mean they don't have a lockout.

Anonymous

Anonymous Fri 25 May 2012 19:46:35 No.140666364 Report

Quoted By:

>>140665778
Care to define the actual number before a lockout happens?

Anonymous

Anonymous Fri 25 May 2012 19:52:02 No.140666827 Report

Quoted By:

>>140647902
200000^4=2x10^5^4=2x10^20
your answer may also be correct

Anonymous

View Same Google ImgOps iqdb SauceNAO rustle.jpg, 33KiB, 308x294

Anonymous Fri 25 May 2012 19:53:33 No.140666924 Report

Quoted By:

>>140641246
>not having a password consisting of hexadecimal equations in upper and lower case as well as symbols.

Anonymous

Anonymous Fri 25 May 2012 19:54:58 No.140667013 Report

Quoted By:

>>140665163
>Unfortunately, many places will not allow you enough space to do this
Mmh...use a word and then m5 hash it?

Anonymous

Anonymous Fri 25 May 2012 19:56:25 No.140667127 Report

Quoted By:

I found this out in like 2005 when I typed in my password for WoW account only to realize I had caps lock on the whole time.

Anonymous

Anonymous Fri 25 May 2012 19:59:00 No.140667307 Report

Quoted By: >>140667573

>>140665381
First of all: Are you sure that random password generators are the way people are getting hacked?
If you know the e-mail adress of someone who has a DIII account (which is probably pretty easy to acquire) all you have to do is hack his e-mail.
Putting more security on the game password than on the e-mail one is trivial.

Anonymous

Anonymous Fri 25 May 2012 20:00:44 No.140667425 Report

Quoted By: >>140667564 >>140667581

>>140665163
I've seen places that limited the length to 8 (alphanumeric only). On the flip side, gmail has a limit of 100.

Anonymous

Anonymous Fri 25 May 2012 20:02:17 No.140667564 Report

Quoted By: >>140667712

>>140667425
>limit of 100
Holy shit that's like 5.4*10^185 combinations

Anonymous

Anonymous Fri 25 May 2012 20:02:24 No.140667573 Report

Quoted By: >>140667654

>>140667307
So far it seems more and more likely the people who got hacked are just idiots.
Blizzard have come out and said that the SID spoofing theory is impossible, and that nobody with an authenticator currently attached to their account has been hacked, only those who added one after the fact.

Of course how much you believe what they said is a matter of opinion.

Anonymous

Anonymous Fri 25 May 2012 20:02:32 No.140667581 Report

Quoted By:

>>140667425
but gmail 'reads' your mails so that's kinda trivial...
(they don't actually read it, they just scan it to make better adds etc, but that's kinda the same thing imo)

Anonymous

Anonymous Fri 25 May 2012 20:03:33 No.140667654 Report

Quoted By: >>140667938

>>140667573
I'm a sensible person who understands account security and I haven't been hacked, go figure.

Anonymous

Anonymous Fri 25 May 2012 20:04:16 No.140667712 Report

Quoted By:

>>140667564
>Holy shit that's like 5.4*10^185 combinations
>5.4*10^185
oh you're doing it on purpose... That's an xkcd joke as well isn't it?

P.S.: captcha isn't case-sensitive

Anonymous

View Same Google ImgOps iqdb SauceNAO baby otter strangling.gif, 3MiB, 300x213

SpoilerClick to view

Anonymous Fri 25 May 2012 20:05:18 No.140667785 Report

Quoted By:

Anonymous

Anonymous Fri 25 May 2012 20:07:22 No.140667938 Report

Quoted By: >>140668512

>>140667654
most people aren't
That's not blizzard's fault though.
Attacking them on the case-sensitive is rather lame imo.
If it's true that there's no lockout however, that's kinda stupid of them. I assume it's pretty easy to implement.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1262574639206.png, 46KiB, 200x200

Anonymous Fri 25 May 2012 20:09:49 No.140668134 Report

Quoted By:

>>140641246
That idiot is assuming that if the passwords were case sensitive, EVERYONE would still use lower case symbols anyway. That doesn't work like that.
It's completely irrelevent how many uppercase symbols people actually use in passwords, but how many symbols THERE CAN BE IN YOUR PASSWORD.
As in, if you want to hack a case sensitive password system, you WILL assume that upper case symbols are used in every password, that forcing you to make more calculations.
But when you're dealing with a case insensitive password system, you can be 100% sure that half the possible characters don't exist.

Just adding ONE single uppercase symbol in your 10 character password makes it quantilion times harder to hack.
FUICK

Anonymous

Anonymous Fri 25 May 2012 20:09:50 No.140668135 Report

Quoted By:

>>140664596
Depends how they do it. A smart dude would try everything in the dictionary first, then the same with some numbers appended, etc. only moving on to nonsense passwords as a last resort. Odds are he'll give it a shot somewhere along the rine since single-letter passwords are not so uncommon with lazy people.

Anonymous

Anonymous Fri 25 May 2012 20:11:56 No.140668323 Report

Quoted By:

>>140641817
>cases
I GET IT

Anonymous

View Same Google ImgOps iqdb SauceNAO 1278963667733.jpg, 11KiB, 297x275

Anonymous Fri 25 May 2012 20:13:15 No.140668457 Report

Quoted By:

>log in to check if this is legit
>want to post in the thread
>can't post without a D3 character

No wonder 80% of the posts are shit eating fanboys

Anonymous

Anonymous Fri 25 May 2012 20:13:55 No.140668512 Report

Quoted By: >>140668864 >>140669350 >>140670271

>>140667938
Attacking them on case-insensitive is pretty useless anyway.
The minimum pass length (8 I think) would still give nigh on 3 trillion combinations (assuming only a-z and 0-9 are allowed, case-insensitive).
This would take nearly 90 years to run through at 1000 login attempts a second with, just for a single password.

I hope my statistics experience has proved right here, someone else check my figures.

Also, only retards would try and bruteforce passwords, it's far easier and more fruitful to just keylog and scam idiots out of their passwords.

Anonymous

Anonymous Fri 25 May 2012 20:18:35 No.140668864 Report

Quoted By: >>140669597 >>140670042

>>140668512
see
>>140647042

90 years seems pretty far off

Anonymous

Anonymous Fri 25 May 2012 20:23:59 No.140669350 Report

Quoted By: >>140670042

>>140668512
Something like that. Of course, it still reduces your password strength. It's equivalent to a couple of extra characters.

Anonymous

Anonymous Fri 25 May 2012 20:27:04 No.140669597 Report

Quoted By:

>>140668864
The comic assumes a particular style of password.

Anonymous

Anonymous Fri 25 May 2012 20:27:33 No.140669646 Report

Quoted By:

>>140656712
Do you live in Denmark?

Anonymous

Anonymous Fri 25 May 2012 20:32:01 No.140670042 Report

Quoted By:

>>140668864
Assuming completely random strings used as login attempts I'm sure that's correct.
The comic is assuming that the password is indeed a real word with various simple substitutions like numbers for letters.

>>140669350
Indeed, adding case sensitivity increases the amount of combinations from 3 trillion to nearly 220 trillion for 8 character passwords.

Anonymous

View Same Google ImgOps iqdb SauceNAO 1337043850865.gif, 469KiB, 500x281

Anonymous Fri 25 May 2012 20:34:30 No.140670269 Report

Quoted By:

>>140656073

Just prompt the fuckers to change their passwords, yes they'll be mad but they'd be less mad than if they couldn't get in at all.

On the other hand:

>mfw I used complicated passwords with cases and everything when I played WoW, and it was completely fucking pointless.

Anonymous

Anonymous Fri 25 May 2012 20:34:31 No.140670271 Report

Quoted By:

>>140668512
>This would take nearly 90 years to run through at 1000 login attempts a second with, just for a single password.

Assuming nobody is using something vulnerably to a dictionary attack.

I mean, it's not like half the population is dumb enough to have their password be a word with 0 or 1 at the end.
Sad part is, most of them use all lowercase anyway.

Capcode	All Only User Posts Only Verified Posts Only Moderator Posts Only Manager Posts Only Admin Posts Only Developer Posts Only Founder Posts
Show Posts	All Only With Images Only Without Images Only Spoiler Images Only Non-Spoiler Images
Deleted Posts	All Only Deleted Posts Only Non-Deleted Posts
Ghost Posts	All Only Ghost Posts Only Non-Ghost Posts
Post Type	All Only Sticky Threads Only Opening Posts Only Reply Posts
Results	All Grouped By Threads
Order	Latest Posts First Oldest Posts First

On these archives

Your latest searches