JoelC707Premium
join:2002-07-09
West Point, GA
kudos:5 | Blizzard security breach? Just got the following notice on the launcher: »us.blizzard.com/en-us/securityup···t-banner
Full text for those websensed
Players and Friends,
Even when you are in the business of fun, not every week ends up being fun. This week, our security team found an unauthorized and illegal access into our internal network here at Blizzard. We quickly took steps to close off this access and began working with law enforcement and security experts to investigate what happened.
At this time, we’ve found no evidence that financial information such as credit cards, billing addresses, or real names were compromised. Our investigation is ongoing, but so far nothing suggests that these pieces of information have been accessed.
Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we currently know, this information alone is NOT enough for anyone to gain access to Battle.net accounts.
We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually. As a precaution, however, we recommend that players on North American servers change their password. Please click this link to change your password. Moreover, if you have used the same or similar passwords for other purposes, you may want to consider changing those passwords as well.
In the coming days, we'll be prompting players on North American servers to change their secret questions and answers through an automated process. Additionally, we'll prompt mobile authenticator users to update their authenticator software. As a reminder, phishing emails will ask you for password or login information. Blizzard Entertainment emails will never ask for your password. We deeply regret the inconvenience to all of you and understand you may have questions. Please find additional information here.
We take the security of your personal information very seriously, and we are truly sorry that this has happened.
Sincerely,
Mike Morhaime |
|
 Nick DPremium
join:2010-02-04
Orange, CA | I wonder how you reseed the phone authenticator. |
|
 kingdome74Emotionally UnavailablePremium
join:2002-03-27
Syracuse, NY
kudos:2
 ·Verizon FiOS
 ·RoadRunner Cable
| reply to JoelC707
Well, why the hell not. The VA exposed mine and millions of other vets private info to a massive breach a few years ago (I have that letter framed) so why shouldn't Bliz miss out on all the fun. I've used an authenticator since they first came out and I wouldn't play without it. |
|
| reply to JoelC707
I just reset me and my wife's pw's. Just in case. Now pouring Mt. Dew. |
|
pandoraPremium
join:2001-06-01
Outland
kudos:1 Reviews:
 ·Google Voice
·Comcast
·ooma
·Future Nine Corp..
| reply to JoelC707
Ouch, we shall begin to reset passwords.
Fortunately my family uses unique passwords for every gaming site, different from any email or shopping password.
Though it's annoying to have to change them.
--
"People demand freedom of speech as a compensation for the freedom of thought which they seldom use." |
|
|
|
Reviews:
 ·HughesNet Satell..
| reply to JoelC707
Gonna be a few days before they launch the Secret Questions section (Rather then redoing your email they are working on a easy mode fix for this) (So you can reset the Secret Questions) In the mean time reset the Password on you accounts (and if you are OCD put a new email to it to. One that is not used anywhere else or linked with your 20 yahoo email accounts) This will allow you to reset secret questions to.
By linking Yahoo/Gmail etc email accounts you in fact compromise the security of all the accounts thru secret questions on them. Thus allowing a hacker leverage to try to take a account over. Many friends of mine were hacked in this way. Even after they setup separate emails unrelated to anything, they linked them with the old accounts for recovery... "just in case".
Also roll with the Authenticator. Its a condom for your WOW account. Of coarse it never hurts to do all the above. |
|
| reply to JoelC707
Although I am not pleased they got breached, I am very pleased about their response.
This was a good response on what had happened and what they are doing about it going forward.
Good job "manning up" about the situation.
I agree with the other poster, though: I can see them revising, re-seeding and re-releasing the mobile authenticator, but what do the masses of players with plain authenticators do? |
|
 s1deoutGeek4LifePremium
join:2003-12-10
Troy, OH
kudos:1 | reply to JoelC707
I changed my WoW password last nite and I will probably go ahead and change the email address and password as well.
I have a mobile authenicator too but you just can't be too careful |
|
kingdome74Emotionally UnavailablePremium
join:2002-03-27
Syracuse, NY
kudos:2 | reply to JoelC707
I use this site to generate new passwords. Obviously no one wants to type in 63 characters so I find a nice chunk of code and use that. |
|
 Goldheart
join:2002-06-09
Rio Rancho, NM
kudos:1 | reply to JoelC707
Here is the official FAQ link:
»us.battle.net/support/en/article···date-faq |
|
 KilroyPremium,MVM
join:2002-11-21
Ann Arbor, MI | reply to JoelC707
Changed mine this morning. It was pretty weak, so I buffed it up. I have the authenticator so no worries. My experience with Blizzard security is that they do more to protect my game than my banks and credit card companies do, to protect my money.
As engineercarl  said, I'm not happy that this happened, but the response was good and the passwords weren't plain text. I'm sure that we'll find out more later, but early indicators are good.
I still have issues getting my free copy of my credit report because of the VA breach.
--
Want the shirt? - »www.despair.com/thedestructor.html
Not afiliated or making any profit from sales |
|
 DarkLogixTexan and ProudPremium
join:2008-10-23
Baytown, TX
kudos:3 | reply to kingdome74
Just use this site
»www.domain-logix.net/WiFi/Key.htm
And then get a »www.yubico.com/yubikey
Some models of the yubikey have a mode for static passwords |
|
DarkLogixTexan and ProudPremium
join:2008-10-23
Baytown, TX
kudos:3 | reply to Kilroy
Ya it looks like they did a good job though it could have been better.
Passwords should have been salted and hashed (ie non-reversible but yet capable of doing to what you type and able to verify)
if they had done this then the hackers would never be able to get the passwords, they'd have to know the salt know the hashing algorithm used and then would have to brute force till they find something that is turned into the same output.
but still Is way better than Sony or many banks. |
|
| I changed my password last night without even knowing about this security breach thing. I just felt like changing my password.
Actually relieved now that I did.
--
Good evening! |
|
 TimePremium
join:2003-07-05 | reply to DarkLogix
said by DarkLogix:Ya it looks like they did a good job though it could have been better.
Passwords should have been salted and hashed (ie non-reversible but yet capable of doing to what you type and able to verify)
if they had done this then the hackers would never be able to get the passwords, they'd have to know the salt know the hashing algorithm used and then would have to brute force till they find something that is turned into the same output.
but still Is way better than Sony or many banks.
Eh?
quote:
We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually.
--
"If it can't be done with brains, it can't be done with hours" - Clarence "Kelly" Johnson |
|
Nick DPremium
join:2010-02-04
Orange, CA | reply to DarkLogix
The salt is traditionally stored in plaintext in the database next to each password. The point of salting is to make brute force cracking the passwords hard to do if you just have the pw hash (probably intercepted from the client directly), NOT to help out when someone gets access to the database, so its benefit is lost in this situation.
That said, the wiki page on the SRP protocol says it includes a salt and a bunch of other stuff that I am too far removed from my crypto classes in college to understand fully. I will trust Blizzard when it says that each password is computationally expensive to crack and that they are independent of each other. |
|
JoelC707Premium
join:2002-07-09
West Point, GA
kudos:5 | reply to Tweakbl
said by Tweakbl:Gonna be a few days before they launch the Secret Questions section (Rather then redoing your email they are working on a easy mode fix for this) (So you can reset the Secret Questions) In the mean time reset the Password on you accounts (and if you are OCD put a new email to it to. One that is not used anywhere else or linked with your 20 yahoo email accounts) This will allow you to reset secret questions to. For resetting the security question, do you normally have to provide the existing answer? This has been a major boon for my uncle as he has forgotten the answer to the security question on his account and Blizzard was less than helpful at resetting it. If I can get it reset easily and without providing the previous answer we'll be extremely happy. |
|
JoelC707Premium
join:2002-07-09
West Point, GA
kudos:5 | reply to DarkLogix
I've used GRC's site as well for chunks of randomness and for passwords. I also use KeePass for bank passwords and such and considered using it for Wow as well. But I didn't want to try and memorize a chunk of randomness and instead came up with my own 14 character password that I'll easily remember. I've seen that Yubikey mentioned before, I'll have to check it out. |
|
DarkLogixTexan and ProudPremium
join:2008-10-23
Baytown, TX
kudos:3 | reply to Time
said by Time:said by DarkLogix:Ya it looks like they did a good job though it could have been better.
Passwords should have been salted and hashed (ie non-reversible but yet capable of doing to what you type and able to verify)
if they had done this then the hackers would never be able to get the passwords, they'd have to know the salt know the hashing algorithm used and then would have to brute force till they find something that is turned into the same output.
but still Is way better than Sony or many banks.
Eh? quote:
We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually.
But that means its POSSIBLE to get the password out.
the difference is if it was a proper salted hash then it's impossible to get the password out of the stored data, not just time consuming.
Extremely difficult is not equal to impossible.
And with a salting hash algorithm theft of the DB holding the password would be useless to the hackers as the algorithm and the salting data wouldn't be discovered. |
|
 SnakeoilIgnore Button. The coward's feature.Premium
join:2000-08-05
Mentor, OH
kudos:1 | reply to JoelC707
If you have an authenticator, does it matter that your password was stolen? |
|
