|
On July 21 2011 05:14 windsupernova wrote:Show nested quote +On July 21 2011 03:45 BrTarolg wrote: The fact it used to work, and no longer works, implies they are using an insecure form of storing your password, i.e one that is most likely plaintext
GJ BLIZZARD Eh? I don´t see the logic behind this. They are insecure about your password security so.... they make it laxer?
If it's not case-sensitive that doesn't imply it's simple text, I have no idea how he drew this conclusion either.
|
On July 20 2011 02:32 windsupernova wrote:Show nested quote +On July 20 2011 02:12 ApBuLLet wrote:I don't really think this is as big of a deal as people are making it out to be. People tend to panic a bit when they feel like they or their property is at risk, and rightfully so. However, the vast majority of the time people get their accounts stolen is due to some sort of keylogging malware, in which case the a case sensitive password system would not matter, because your hacker would know anyway. The only thing I can see it being good for is if somebody is trying to guess your password or something like that. Case sensitive passwords make that a million times harder I would imagine, as you'd have to guess the password and the patter of lowercase/uppercase. So overall, yes I think it is bad and there is no reason not to have case sensitive passwords for that little bit of extra security, but in reality I don't really think it is that big of a deal. I'm not going to worry about it personally  Haha, not even that. Most of the time when they lose control of their accounts its because they fall for some social engineering scheme.
Not totally true (I don't have the numbers though >.>. But just from what people have said). In FFXI (not sure about WoW), most accounts were lost by visiting well known FFXI sites like ffxiah, ffxi wiki (from wikia), somepage, atlus, or even your linkshell(clan/guild)'s site (yes drama happens, someone who has access to the site loads it up with all the malware they can find). Seeing as how the WoW Wiki used to be hosted on wikia, I wouldn't be surprised if the wiki hosted bad ads occasionally too.
Sometimes this even happened with noscript and adblock plus users too (noscript needs to be set to block all things including iframes and be set to block it on trusted sites too).
Main reason is most of those sites need revenue from ads and some bad ads slip by (also sometimes the site owner leaves or is lazy and site ends up being compromised without anyone fixing it and without users who checked it before knowing).
Finally authenticators aren't full proof either. Some malware redirect, replace, or infect playonlineviewer.exe (for example) to something else. It brings the usual (really spoofed) pop up screen, asks for the one time password and password.
User enters it, it doesn't work. They find out that their authenticator has been disabled and password changed (this can happen by using the one time password the user entered and entering it on the site with the password then disabling the authenticator which is possible with SE, not sure about Blizzard).
Yes so even two step authentication is not completely safe (but it is still much safer).
Anyway as for is cap locks safer? Yes. Now in cases where its stranger vs stranger, account hackings usually happen with the full password given (social engineering, keylogger, etc).
But not all account lost are due to that. Maybe it's a PC bang or public place (where some may be able to sneak and look at what you're typing), or someone you know IRL, etc.
Having caps lock would reduce the risk of passwords stolen in that case (even though it's already small since it's already hard, it'd make it harder at least).
Anyway I think someone should bring this up on the battle.net forums (the caps thing) so they can read it.
|
What the heck blizzard, my password seems easy enough as it is.....
|
They probably figure that it will result in less overall hassle for them since the number of people who are getting locked out of their bnet account will go through the roof if its case sensitive. If you have a good password its still going to take someone a ridiculously long time to brute force it even without case sensitivity (if its good they can't dictionary it).
|
Well, the thing is...
a) if you really want a well protected password, you'd have to use upper case, down case, numbers and symbols. b) efficient hacking methods won't really care about uppercase or not c) If you REALLY want to protect your account, use an authenticator.
Either way, it isn't such a big deal.
|
On July 21 2011 09:17 UnitedKronos wrote: What the heck blizzard, my password seems easy enough as it is..... lol well that's not really blizzard's fault
|
Didn't realize how many conspiracy theorists we had on TL until I read this thread.
Blizzard making it easier for you to get hacked so people will get authenticators? lol Blizzard loses a ton of time and money because of hacking, and their Game Masters are legendary for how efficiently they handle your case in the event of a compromised account (if you scoff at this, you have never played another online game). Furthermore, if someone gets your password through keylogging, whether your letters were capped or not has near zero significance.
It's funny to see cryptoanalasys/bruteforcing brought up in this thread. Unless you're Destiny or BoxeR, you have no reason to worry about the safety of your account.
On July 21 2011 05:14 Aberu wrote: Case sensitivity is not some integral aspect to internet security, if your password has a decent amount of numbers and a word that isn't predictable, along with having an authenticator, it should never get hacked, and if it still does, then YOU did something wrong.
On July 21 2011 05:14 Aberu wrote: Case sensitivity is not some integral aspect to internet security, if your password has a decent amount of numbers and a word that isn't predictable, along with having an authenticator, it should never get hacked, and if it still does, then YOU did something wrong.
Quoted twice in case you skip over it the first time.
|
At least they don't store our passwords in a text file. Right? RIIIIIIIGHT?
|
who the hell cares? it's been ages since i took a data management/probability class so i won't bother trying to prove it, but i have a good feeling that removing 26 possible characters doesn't put a dent in the total permutations of passwords available for you to choose.
|
capitalization is not a big deal when the majority of password leaks are due to a) User visiting phishing website, and giving up the full password b) User having a keylogger, and program logs the full password
The only time capitalization ever matters is i) Blizzard has their user database leaked, making it quicker to brute force your weaker password ii) Someone looks over your shoulder and guesses your password and can see that you don't press the shift key so they don't need to worry about that.
Thankfully i) has never happened, and if ii) happened then you deserve it for either typing too slow or having a guessable password
|
|
|
|